GitHub’s changelog confirms a REST API that lets developers read, add, and edit comments on repository security advisories, including advisories created from private vulnerability reports, in public preview.
Previously, discussion on an advisory was reachable only through the web UI, even though it often provides useful triage context for vulnerability reports.
WHAT YOU CAN DO WITH THE NEW ENDPOINTS
The new endpoints let you list the comments on a repository security advisory, with an option to filter to comments updated since a given time. TechStaged has also covered GitHub expands SecurityAdvisory GraphQL API with five new fields and two filters.
- Repository security advisory responses now include a comments count, and global advisory responses include the count for their linked repository advisory, so you can see which advisories have discussion before fetching comments.
- These counts reflect non-confidential comments and help identify advisories with activity before retrieving the full comment set.
- Access follows the same rules as the advisory itself. You need the repository security advisories scope, and non-seeing users cannot view an advisory’s comments.
MORE PRACTICAL NOTES
This API supports exporting advisory discussions for audits and migrations, automatically adding triage notes, and building advisory workflows that are consistent with existing issue and pull request workflows.
- Deleting comments isn’t supported yet through the API.
- Non-collaborators cannot view internal comments, and confidential comments are not returned by these REST endpoints.
- The feature is available in public preview for public repositories on GitHub Free, GitHub Pro, GitHub Team, and GitHub Enterprise Cloud.
WHY IT MATTERS
By enabling programmatic access to advisory discussions, developers can integrate triage notes and discussion history into audits, migrations, and automated workflows—paralleling the capabilities already available for issues and pull requests.
WHAT HAPPENS NEXT
The changelog notes public preview status but does not specify a rollout timeline, suggesting that access may expand or evolve based on feedback and usage.
RELATED COVERAGE
- GitHub expands SecurityAdvisory GraphQL API with five new fields and two filters
- Kubernetes v1.37 introduces Node Lifecycle Conditions to standardize Node maintenance signals
- GPT-6 Astra on GitLab Duo Agent Platform delivers faster runs and fewer tokens
- GitLab Duo Self-Hosted gains Bring-Your-Own-Model support with Microsoft Foundry
- Developer Tools articles
SOURCES
- Archive: 2026 - GitHub Changelog: Repository security advisory comments API in public preview Published · Primary source
