Ghsa Advisories

Look up known GitHub Security Advisories (GHSA) for a package + ecosystem — the same {ecosystem, package} shape a Renovate merge request reports. Built to complement a Renovate triage flow: given what a bump MR names, returns ranked advisories (GHSA id, associated CVE ids, severity, vulnerable version range, first patched version) so a human reviewing the MR can judge whether it matters for security, not just how far the version number moved. One method, advisories. Read-only, host-locked to api.github.com, pages GitHub's GraphQL securityVulnerabilities connection internally, and never throws: a missing token, an exhausted rate-limit retry, or a GraphQL error all degrade into errors/unreadable fields on the result rather than an exception, so a partial result can never be mistaken for "no advisories". Requires a GitHub token (GraphQL rejects anonymous calls) — no special scopes needed for public advisory data.

Quick Start

  --global-arg 'token=${{ vault.get("briefing", "GITHUB_TOKEN") }}'
swamp model method run advisories advisories \
  --input ecosystem=NPM --input package=lodash