{
  "slug": "gh-graphql-securityadvisories-adds-severity-and-withdrawal-filters-9f8f9bdc90c8",
  "title": "gh GraphQL securityAdvisories adds severity and withdrawal filters",
  "tools": [
    "gh"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-10-02T13:18:00.000Z",
  "announced_at": "2026-10-02T13:18:00.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "For severity triage or a withdrawn-advisory audit, call `securityAdvisories` with the relevant `severities` or `isWithdrawn` filter and select the advisory fields you need.",
    "examples": [
      "gh api graphql -F 'severities[]=HIGH' -f query='query($severities: [SecurityAdvisorySeverity!]) { securityAdvisories(severities: $severities, first: 100) { nodes { ghsaId severity summary } } }'",
      "gh api graphql -F isWithdrawn=true -f query='query($isWithdrawn: Boolean) { securityAdvisories(isWithdrawn: $isWithdrawn, first: 100) { nodes { ghsaId severity summary withdrawnAt } } }'"
    ],
    "gotchas": [
      "severities: List of advisory severities to filter by; values: `CRITICAL`, `HIGH`, `LOW`, `MODERATE`, `UNKNOWN`.",
      "isWithdrawn: `true` returns only withdrawn advisories; `false` excludes withdrawn advisories.",
      "gh api graphql (required): `gh api` makes an authenticated API request; `graphql` selects GitHub API v4.",
      "-F, --field <key=value>: Adds a typed parameter; for GraphQL, fields other than `query` and `operationName` are variables. Supports array fields with `key[]=value`.",
      "-f, --raw-field <key=value> (required): Adds a string parameter; used here to pass the GraphQL query.",
      "Prerequisite: `gh api` makes authenticated requests; this task needs an authenticated GitHub CLI session.",
      "The new filters work alongside existing filters, including classification, identifier, EPSS, and published or updated since.",
      "The changes are additive and read-only; existing queries keep working."
    ]
  },
  "why_it_matters": "Narrow advisory results for a severity-based triage feed or withdrawn-advisory audit.",
  "before": "The release note says integrations previously downloaded results and filtered them client-side.",
  "sources": [
    "https://github.blog/changelog/2026-10-02-new-fields-for-securityadvisory-graphql-api",
    "https://cli.github.com/manual/gh_api",
    "https://docs.github.com/en/graphql/reference/security-advisories",
    "https://github.blog/changelog/2026-10-02-new-fields-for-securityadvisory-graphql-api/"
  ],
  "rank": 0.98028,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v1+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "recover-20261008",
    "verdict_id": "recover-20261008:recover-20261008-cc63315d45126414-1:gate",
    "evidence_hash": "823cd32c411e7598ed982b7fa74656c121e25ab9067bbc69106218eb889da443"
  },
  "review": {
    "draft_hash": "39d85b39c9770cf15f338935cfbf868c00eb4159464b99004f7c689f789f3617",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "recover-20261008:gate",
    "reason": "3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.98 >= 0.9; 2 needed) and Jev gave 0.68 (>= 0.6 needed)."
  }
}