--- title: New fields for SecurityAdvisory GraphQL API | daily.dev description: GitHub's GraphQL API now exposes five new fields on the SecurityAdvisory object: cveId, sourceCodeLocation, githubReviewedAt, nvdPublishedAt, and... canonical: https://daily.dev/posts/new-fields-for-securityadvisory-graphql-api-lqo1bdlm6 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: New fields for SecurityAdvisory GraphQL API | daily.dev og:description: GitHub's GraphQL API now exposes five new fields on the SecurityAdvisory object: cveId, sourceCodeLocation, githubReviewedAt, nvdPublishedAt, and... og:url: https://daily.dev/posts/new-fields-for-securityadvisory-graphql-api-lqo1bdlm6 og:image: https://api.daily.dev/og/posts/lQo1bDLM6.png og:image:alt: New fields for SecurityAdvisory GraphQL API og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # New fields for SecurityAdvisory GraphQL API **[GitHub Changelog](https://daily.dev/sources/github_updates)** · 2 min read · 0 upvotes · 0 comments ## Summary GitHub's GraphQL API now exposes five new fields on the SecurityAdvisory object: cveId, sourceCodeLocation, githubReviewedAt, nvdPublishedAt, and repositoryAdvisoryUrl. The securityAdvisories query also gains two new filters, severities and isWithdrawn, allowing server-side narrowing of results alongside existing filters like classification, identifier, and EPSS. These additive, read-only changes let integrations read advisory data entirely through GraphQL without falling back to the REST API, reducing round trips and simplifying authentication and rate limiting for use cases like severity-based triage and withdrawn advisory audits. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What new fields were added to the SecurityAdvisory object in GitHub's GraphQL API? Five new fields were added: cveId (the advisory's CVE identifier), sourceCodeLocation (a link to the affected source code), githubReviewedAt (when GitHub reviewed the advisory), nvdPublishedAt (when NVD published its record), and repositoryAdvisoryUrl (a link to the linked repository security advisory, when one exists). These changes are additive and read-only, so existing queries keep working. _Teams building advisory tooling can track GraphQL API changes like this one on daily.dev._ ### What filters can I use with the securityAdvisories GraphQL query on GitHub? The securityAdvisories query supports filters including classification, identifier, EPSS, published or updated since, and now two new ones: severities and isWithdrawn. These let you narrow results server-side instead of downloading everything and filtering client-side, useful for building severity-based triage feeds or withdrawn advisory audits. _Developers integrating vulnerability data can follow API filter updates like this via daily.dev._ ## Similar posts on daily.dev - [Innersource security advisories are generally available](https://daily.dev/posts/innersource-security-advisories-are-generally-available-9rg1pixhd) · GitHub Changelog · 1 upvotes · 0 comments - [A year of open source vulnerability trends: CVEs, advisories, and malware](https://daily.dev/posts/a-year-of-open-source-vulnerability-trends-cves-advisories-and-malware-xirztt4ff) · GitHub Blog · 0 upvotes · 0 comments - [OpenClaw Advisory Surge Highlights Gaps Between GHSA and CVE...](https://daily.dev/posts/openclaw-advisory-surge-highlights-gaps-between-ghsa-and-cve--a3dqiotwa) · Socket · 0 upvotes · 0 comments - [How I Created a Security Advisory with GitHub](https://daily.dev/posts/how-i-created-a-security-advisory-with-github-mhjybtn5j) · Atomic Spin · 0 upvotes · 0 comments - [Lock and unlock draft repository security advisories](https://daily.dev/posts/lock-and-unlock-draft-repository-security-advisories-oezzpwtg8) · GitHub Changelog · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#github](https://daily.dev/tags/github), [#architecture](https://daily.dev/tags/architecture), [#graphql](https://daily.dev/tags/graphql) [View this post on daily.dev](https://daily.dev/posts/new-fields-for-securityadvisory-graphql-api-lqo1bdlm6) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"New fields for SecurityAdvisory GraphQL API","url":"https://daily.dev/posts/new-fields-for-securityadvisory-graphql-api-lqo1bdlm6","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/new-fields-for-securityadvisory-graphql-api-lqo1bdlm6"},"datePublished":"2026-10-02T15:26:36.232Z","dateModified":"2026-10-02T15:34:09.184Z","description":"GitHub's GraphQL API now exposes five new fields on the SecurityAdvisory object: cveId, sourceCodeLocation, githubReviewedAt, nvdPublishedAt, and...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/130b3bca59caa9a1837c28072eef0242?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/130b3bca59caa9a1837c28072eef0242?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"GitHub Changelog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"GitHub Changelog","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/15004b7835da4d89b02b115871f0f6dc","url":"https://daily.dev/sources/github_updates"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/new-fields-for-securityadvisory-graphql-api-lqo1bdlm6","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,github,architecture,graphql","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"GitHub Changelog","item":"https://daily.dev/sources/github_updates"},{"@type":"ListItem","position":3,"name":"New fields for SecurityAdvisory GraphQL API"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/new-fields-for-securityadvisory-graphql-api-lqo1bdlm6#faq","mainEntity":[{"@type":"Question","name":"What new fields were added to the SecurityAdvisory object in GitHub's GraphQL API?","acceptedAnswer":{"@type":"Answer","text":"Five new fields were added: cveId (the advisory's CVE identifier), sourceCodeLocation (a link to the affected source code), githubReviewedAt (when GitHub reviewed the advisory), nvdPublishedAt (when NVD published its record), and repositoryAdvisoryUrl (a link to the linked repository security advisory, when one exists). These changes are additive and read-only, so existing queries keep working. Teams building advisory tooling can track GraphQL API changes like this one on daily.dev."}},{"@type":"Question","name":"What filters can I use with the securityAdvisories GraphQL query on GitHub?","acceptedAnswer":{"@type":"Answer","text":"The securityAdvisories query supports filters including classification, identifier, EPSS, published or updated since, and now two new ones: severities and isWithdrawn. These let you narrow results server-side instead of downloading everything and filtering client-side, useful for building severity-based triage feeds or withdrawn advisory audits. Developers integrating vulnerability data can follow API filter updates like this via daily.dev."}}]} ```