SecurityAdvisory GraphQL APIに新しいフィールドを追加New fields for SecurityAdvisory GraphQL API

SecurityAdvisory GraphQL API

The SecurityAdvisory GraphQL API now exposes five additional advisory fields and provides two more filters for the securityAdvisories query. The changes matter because API users can read more of the GitHub Advisory Database directly through GraphQL and narrow vulnerability data before retrieving it, rather than falling back to the REST API or downloading all results for local filtering.

Additional advisory fields

The cveId field returns the advisory’s CVE identifier. The sourceCodeLocation field provides a link to affected source code that is relevant to the advisory.

Two new timestamp fields indicate when advisory records were reviewed or published. The githubReviewedAt field shows when GitHub reviewed the advisory, while nvdPublishedAt shows when the National Vulnerability Database, or NVD, published its record.

The repositoryAdvisoryUrl field links to the associated repository security advisory when one exists. Together, these five fields make more of the information held in the GitHub Advisory Database directly available from the GraphQL API.

severities and isWithdrawn

The securityAdvisories query has gained the severities and isWithdrawn filters. These options allow users to narrow query results on the server by severity or withdrawal status.

Server-side filtering means users do not need to download every matching advisory and then apply those criteria themselves. Instead, the query can request a more focused set of vulnerability records before retrieval.

Filters you already use

The two new filters work alongside existing securityAdvisories filters. Those existing options include classification, identifier, EPSS, and criteria for advisories published or updated since a specified point.

The expanded combination of fields and filters supports more targeted access to advisory data through GraphQL. Users can retrieve CVE identifiers, relevant source-code links, GitHub review times, NVD publication times, and linked repository advisory URLs while limiting the returned records by severity or whether an advisory has been withdrawn.