Github Application Vulnerability Integration release notes

  • Release version: Store
  • Updated June 11, 2026
  • 4 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Github Application Vulnerability Integration release notes

    The Github Application Vulnerability Integration provides ServiceNow customers with enhanced capabilities to import, process, and manage application vulnerabilities sourced from GitHub, including code scanning, secret scanning, Dependabot alerts, and repository data. This integration ensures vulnerabilities are correctly categorized and linked to discovered applications, supporting vulnerability response and remediation workflows within ServiceNow.

    Show full answer Show less

    Key Features and Enhancements

    • Security and Access Controls: Query ACLs were added across all GitHub plugin tables (including configuration, code scanning, secret scanning, Dependabot, repositories, and organizations) to align with ServiceNow platform security best practices and internal directives.
    • Vulnerability Data Normalization: Rule IDs from GitHub (GHSA, CVE, CodeQL) are now accurately classified and prefixed to prevent malformed records, with a cleanup job to remediate existing data.
    • Dependabot Advisory Handling: Added a GH- prefix to GitHub advisories in vulnerability entries to avoid advisory ID collisions, ensuring Dependabot alerts consistently create Application Vulnerability Items (AVITs).
    • Secret Scanning Integrations: Separate integrations import vulnerabilities related to client secrets and their exact locations, improving visibility into secret exposure risks.
    • GitHub Organizations Integration: New integration to fetch GitHub organization data when using enterprise API, enhancing organizational context for vulnerability data.
    • Improved Data Sync and Pagination: Enhanced handling of delta updates and pagination for Dependabot alerts to ensure complete and consistent vulnerability data ingestion.
    • OAuth and Authentication Improvements: Fixed OAuth configuration issues and enabled enterprise API support to streamline secure integration setup.
    • Repository and Application Data Import: GitHub Repos Integration imports application metadata into the Discovered Applications table, supporting downstream vulnerability scanning integrations.
    • Remediation and CI Lookup Enhancements: Ability to manually create remediation tasks for vulnerabilities and reapply configuration item lookup rules to update existing scanned applications and models.

    Fixes and Stability Improvements

    • Resolved issues causing malformed vulnerability records due to improper ID prefixes.
    • Fixed 404 errors when retrieving custom property values for discovered applications.
    • Addressed failures creating AVITs when CVE identifiers were missing by falling back to GHSA IDs.
    • Corrected collapsing of multiple vulnerabilities in the same package path into a single AVIT by improving uniqueness logic.
    • Improved stability of scheduled migration jobs to prevent looping and ensure reliable completion.
    • Updated access controls to replace overly restrictive roles, allowing appropriate user permissions for configuration management.
    • Standardized repository naming and fixed false error messages related to cross-scope access policies.

    Value for ServiceNow Customers

    ServiceNow customers using this integration can expect a secure, reliable, and comprehensive mechanism to import GitHub vulnerability data, correctly classify and process it, and maintain accurate application and organizational context. The improvements in ACLs, ID normalization, and Dependabot handling ensure consistent and actionable vulnerability records. Integration with GitHub organizations and secret scanning enhances visibility into potential risks. OAuth and enterprise API support facilitate smoother configuration and authentication. Overall, the integration enables faster, more accurate vulnerability response and remediation management within the ServiceNow platform.

    Version history for the Github Application Vulnerability Integration application on the ServiceNow Store.

    Important:
    For details on system requirements and family compatibility, view the application listing on the ServiceNow Store website.

    Version history

    Version 30.2.1 - June 2026(USEM)
    • The following enhancements and changes support internal security directives:
      • Query ACLs added to table-level and field wildcards across all seven GitHub plugin tables: sn_vul_github_config, code_scanning_import, secret_scanning_import, secret_scanning_locations_import, dependabot_import, repos_import, orgs_import to align with ServiceNow Platform Security guidance.
    • Fixed:
      • GHSA / CVE prefix normalization — The GitHub code-scanning and secret-scanning processors previously prepended GHSA- to all rule IDs, producing malformed sn_vul_app_vul_entry records (for example, GHSA-GHSA-* and GHSA-CVE-*). The processors now classify each rule ID and route accordingly: CVE-* rule IDs are used as-is and route to sn_vul_nvd_entry; GHSA-* advisory IDs receive a single GH- prefix; other CodeQL rule IDs receive a GH-GHSA- prefix; already GH-prefixed IDs are not re-prefixed. A scheduled cleanup job remediates existing malformed records on customer instances and self-deactivates once finished.
      • Dependabot duplicate-advisory handling — A GH- prefix is added to GitHub-sourced advisories in sn_vul_app_vul_entry so Dependabot alerts whose GHSA advisory IDs collide with other sources no longer fail to create AVITs. Existing records are updated automatically.
      • Generic-secret migration job stability — The "Mark scantype to generic secret" scheduled job no longer loops on constraint violations and reliably deactivates when no more migration work remains.
    Version 2.4.2 - June 2026
    • The following enhancements and changes support internal security directives:
      • Query ACLs added for table-level and field wildcard across all seven GitHub plugin tables: sn_vul_github_config, code_scanning_import, secret_scanning_import, secret_scanning_locations_import, dependabot_import, repos_import, orgs_import to align with ServiceNow Platform Security guidance.
    • Fixed:
      • GHSA / CVE prefix normalization — The GitHub code-scanning and secret-scanning processors previously prepended GHSA- to all rule IDs, producing malformed sn_vul_app_vul_entry records, for example, GHSA-GHSA-* and GHSA-CVE-*. The processors now classify each rule ID and route accordingly: CVE-* rule IDs are used as-is and route to sn_vul_nvd_entry; GHSA-* advisory IDs receive a single GH- prefix. Other CodeQL rule IDs receive a GH-GHSA- prefix; already GH-prefixed IDs are not re-prefixed. A scheduled cleanup job remediates existing malformed records on customer instances and self-deactivates once finished.
      • Dependabot duplicate-advisory handling — A GH- prefix is added to GitHub-sourced advisories in sn_vul_app_vul_entry so Dependabot alerts whose GHSA advisory IDs collide with other sources no longer fail to create AVITs. Existing records are updated automatically.
      • Generic-secret migration job stability — The "Mark scantype to generic secret" scheduled job no longer loops on constraint violations and reliably deactivates when no more migration work remains.
    Version 30.2.0 - April 2026 (USEM)
    Fixed: Updated GitHub integration configuration ACL to allow users with sn_vul_github.configure_integrationrole to create records in sn_vul_github_configtable. This role replaces the nobodyrole, which was overly restrictive.
    Version 2.4.1 - April 2026
    Fixed: Updated GitHub integration configuration ACL to allow users with the sn_vul_github.configure_integrationrole to create records in the sn_vul_github_configtable. This role replaces the nobodyrole which was overly restrictive.
    Version 2.3.1 - December 2025
    Removed: Admin override check has been removed from the ACLs.
    Version 2.3.0 - August 2025
    Fixed: Addressed an issue where the GitHub Repositories Integration was encountering 404 errors when attempting to retrieve custom property values for discovered applications, despite initially receiving successful 200 responses.
    Version 2.2.0 - June 2025
    Fixed: Resolved a gap where AVITs were not created if the CVE was absent in the response. The system is now made to fall back to using the GHSA ID to create a third-party entry with associated CWEs, ensuring that all findings are processed and AVITs are created without omissions. An issue was addressed where some updates were missing when deltas were pulled from GitHub Dependabot Alerts. A conditional query parameter was introduced using the sort field to ensure complete and consistent data retrieval.
    Version 2.1.0 - May 2025
    Fixed: Ability to create separate AVITs for vulnerabilities within the same package but different paths in Dependabot alerts by enhancing the uniqueness of source_avit_id. This fixes the issue of collapsing multiple occurrences into a single AVIT.
    Version 2.0.1 - March 2025
    • New: We have introduced a new integration 'GitHub Organizations Integration" which can fetch the Organization's data created within an enterprise GitHub account, when an enterprise API is selected on the configuration screen
    • Fixed:
      • Enterprise API Configuration is now enabled.
      • OAuth authentication issues have been fixed.
      • Pagination issues have been resolved with Dependabot integration.
    Version 2.0.0 - February 2025
    • Fixed:
      • Issue resulting in the 422 Error response from the GitHub API for the Secret Scanning Integration.
      • Uniform repository naming convention across GitHub integrations.
      • 'Topics' attribute from the API response payload to the GitHub data model to accommodate longer strings and prevent truncation.
      • False error message, '[operation] has been refused due to table's cross-scope access policy' displayed on the configuration page.
      • 'Last found' and 'First found' values to accurately reflect these dates on the Secret Scanning Integration.
    Version 1.2.2 - August 2024
    • New:
      • Two GitHub Secret Scanning Integrations import vulnerabilities that result from potentially exploitable Client Secrets as well as their locations.
        • GitHub Secret Scanning Integration - This integration imports the vulnerabilities for the potentially exploitable Client Secrets.
        • GitHub Secret Scanning Location Integration - This integration provides the locations of the Client Secrets in the system.
    Version 1.1.3 - May 2024
    • New:
      • Import your application data with the GitHub Repos Integration
      • The GitHub Repos Integration imports application information from your GitHub repositories and stores it in the Discovered Applications table. The GitHub CodeScan and Dependabot integrations require the current application data that is imported by the GitHub Repos Integration.
      • Improvements to the setup for the Authentication Type (OAuth) credentials on the GitHub Configuration page.
    Version 1.0.4 - February 2024
    • New:
      • You can reapply your configuration item (CI) lookup rules to update existing CIs (scanned applications and product models).
      • Manually create remediation tasks (AVULs) for application vulnerable items (AVITs) from remediation task records on the Group Configuration tab.
    Version 1.0.2 - November 2023
    Integrate your Veracode deployment with ServiceNow Vulnerability Response to prioritize and remediate application vulnerabilities.