SecurityAdvisory GraphQL API 新增字段

现在，你可以直接通过 GraphQL API 读取更多 GitHub Advisory Database 数据，无需再回退使用 REST API。

SecurityAdvisory 对象新增了五个字段：

• cveId：该公告的 CVE 标识符。
• sourceCodeLocation：与该公告相关的受影响源代码链接。
• githubReviewedAt：GitHub 审核该公告的时间。
• nvdPublishedAt：National Vulnerability Database（NVD，国家漏洞数据库）发布其记录的时间。
• repositoryAdvisoryUrl：关联的仓库安全公告链接（如有）。

securityAdvisories 查询也新增了两个筛选条件：severities 和 isWithdrawn。这样，你可以在服务端缩小结果范围，而不必下载全部数据后再自行筛选。它们可与现有筛选条件配合使用，例如分类、标识符、EPSS，以及发布时间或更新时间下限。

这意味着，读取公告数据的集成将拥有更少的往返请求、统一的认证路径以及统一的速率限制额度。这也让构建以下功能更加容易：基于严重性的问题分流信息流、已撤回公告审计，以及追踪公告从 NVD 发布到 GitHub 审核所需时间。

这些变更均为新增的只读能力，因此现有查询将继续正常运行。

请参阅 GraphQL API 文档，并分享你的反馈。

You can now read more of the GitHub Advisory Database directly from the GraphQL API without falling back to the REST API.

The SecurityAdvisory object gained five new fields:

• cveId: The advisory’s CVE identifier.
• sourceCodeLocation: A link to the affected source code relevant to the advisory.
• githubReviewedAt: When GitHub reviewed the advisory.
• nvdPublishedAt: When the National Vulnerability Database (NVD) published its record.
• repositoryAdvisoryUrl: A link to the linked repository security advisory when there is one.

The securityAdvisories query also gained two new filters, severities and isWithdrawn, so you can narrow results on the server instead of downloading everything and filtering it yourself. They work alongside the filters you already use, such as classification, identifier, EPSS, and published or updated since.

This means fewer round trips, one authentication path, and one rate limit budget for integrations that read advisory data. It also makes it easier to build things like severity-based triage feeds, withdrawn advisory audits, and tracking of how quickly advisories move from NVD publication to GitHub review.

These changes are additive and read-only, so your existing queries keep working.

Learn more in the GraphQL API documentation and share your feedback.