Coding Tools
GitHub GraphQL API expands SecurityAdvisory fields
GitHub Changeloghigh confidence
Why it matters
- →Consolidates GitHub Advisory data retrieval into a single GraphQL endpoint, reducing API complexity.
- →Enables efficient server-side filtering by severity and withdrawal status, lowering client-side processing overhead.
- →Provides direct access to NVD publication timestamps and CVE IDs for better vulnerability tracking integrations.
GitHub has expanded its SecurityAdvisory GraphQL API with five new fields and two query filters to improve data retrieval efficiency. The new fields include cveId, sourceCodeLocation, githubReviewedAt, nvdPublishedAt, and repositoryAdvisoryUrl, allowing direct access to key vulnerability metadata without REST fallbacks. Additionally, the securityAdvisories query now supports severities and isWithdrawn filters for server-side result narrowing. These additive, read-only changes reduce round trips and simplify integration logic for security tooling.
Read originalThe story around this
Earlier coverage that leads up to this article, and what followed. Lines connect each piece to the closest one after it, converging here.
How we got here
- 1GitHub enforces structured vulnerability reports
GitHub Changelog · October 1, 2026 · Related
- 2GitHub API adds security advisory comments
GitHub Changelog · October 2, 2026 · Related
More from GitHub Changelog
© GitHub ChangelogCoding Toolscoding
GitHub Copilot Code Review API and Default Effort Change
GitHub finally exposes Copilot code review to external automation via REST and GraphQL APIs, moving it from a manual UI action to an integrable pipeline step. This allows developers to trigger reviews directly from scripts or internal tools rather than relying on the web interface. Simultaneously, the default effort level shifts to Balanced, striking a middle ground between speed and depth for most repositories. While Lite remains available for those prioritizing raw throughput, the API access is the real win here, enabling true CI/CD integration for automated code quality checks.
GitHub Changelog
© GitHub ChangelogCoding Toolscoding
GitHub Copilot deprecates specific models
GitHub quietly retired several underlying models for Copilot Chat and code completions, forcing a shift in the default inference stack. Enterprise admins must now manually enable alternative models via policy settings to maintain access, turning what was once automatic into an administrative task. This signals that GitHub is actively pruning its model portfolio rather than just adding new ones, likely to consolidate costs or improve quality control. Developers relying on specific legacy behaviors may find their workflows broken until policies are updated.
GitHub Changelog
© GitHub ChangelogCoding Toolscoding
GitHub adds confidential comments to security advisories
Security triage just got a much-needed privacy layer. GitHub now allows maintainers to post confidential comments on repository security advisories, visible only to those with write access. This solves the awkward workflow of moving sensitive investigation details or abuse reports off-platform to keep them away from reporters and external collaborators. The feature respects existing permissions and logs views in the audit trail, making internal coordination seamless without exposing strategic discussions.
GitHub Changelog
More in Coding Tools
Coding Toolscoding
Claude Code v2.1.288 fixes resume and MCP bugs
This release stabilizes the core session management of Claude Code, specifically targeting the fragile state of resumed conversations where context or thinking traces were previously lost. It also patches critical reliability issues in the Model Context Protocol (MCP) integration, ensuring tool calls don't duplicate or hang indefinitely when remote servers misbehave. The addition of $.ui.selection() for mods and better GitHub CLI handling in cloud sessions shows a focus on developer workflow friction rather than new capabilities. These are necessary maintenance updates that make the tool more robust for heavy daily use.
Claude Code Releases
Coding Toolscoding
Claude Code v2.1.289 patches sandbox and plugin stability
This release is a classic maintenance patch for Claude Code, focusing on stabilizing the terminal interface and tightening security rules. It fixes critical bugs where deny/ask rules were bypassed in nested shell commands or via symlinks, ensuring sandbox policies actually hold. The update also resolves numerous UI freezes caused by malformed HTML tags and plugin rendering errors, making the agent feel less brittle during complex coding sessions.
Claude Code Releases
Coding Toolscoding
llama.cpp b11372 optimizes Qwen4-Exp memory and GPU support
This release tackles the notorious memory hunger of long-context inference for Qwen4-exp models by halving indexer score memory. The optimization works by computing head scores in place rather than materializing separate tensors, a change that significantly reduces VRAM pressure during heavy workloads. Beyond memory efficiency, b11372 expands hardware coverage with CUDA 13 support and Vulkan tiling for the lightning indexer. It also adds ROCm 10.0 binaries, keeping AMD users in step with NVIDIA's latest driver ecosystem. The result is a leaner runtime that handles extended contexts without hitting out-of-memory errors as quickly.
llama.cpp Releases