GitHub GraphQL adds security advisory filters and fields
Introduced 2026-10-05 · score 0.96
HOW TO USE IT
When querying GitHub Security Advisories, pass `isWithdrawn` and/or `severities` to filter results, then select the advisory metadata fields you need.
query { securityAdvisories(isWithdrawn: true, severities: [HIGH, CRITICAL], first: 100) { nodes { cveId githubReviewedAt nvdPublishedAt repositoryAdvisoryUrl sourceCodeLocation } } }WHY THIS HELPS
Query security advisories to filter withdrawn advisories or severities and retrieve additional advisory metadata.
BEFORE THIS CHANGE
The changelog records these filters and metadata fields as additions; before this change, queries could not use these new arguments or select these new fields.
REQUIREMENTS AND LIMITATIONS
- isWithdrawn: Boolean filter: `true` returns only withdrawn advisories; `false` excludes withdrawn advisories.
- severities: List of `SecurityAdvisorySeverity` values to filter advisories. Allowed values: `CRITICAL`, `HIGH`, `LOW`, `MODERATE`, `UNKNOWN`.
- cveId: CVE identifier for the advisory.
- githubReviewedAt: When GitHub Security reviewed the advisory; may differ from GitHub’s publication time.
- nvdPublishedAt: When NVD published its advisory record, independent of GitHub’s publishing timeline.
- repositoryAdvisoryUrl: URL for the associated repository security advisory, if the global advisory is linked to one.
- sourceCodeLocation: URL to the upstream source code relevant to the advisory.
FIRST-PARTY EVIDENCE
- https://docs.github.com/en/graphql/overview/changelog#schema-changes-for-2026-10-05
- https://docs.github.com/en/graphql/reference/security-advisories
Check the installed version and the source before using it. Entry JSON