{"as_of":"2026-08-10T08:53:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:008fff5f9fff32accaf1283a9d3b3fd037982317393d4a52b1883d3ac47476ac","coverage":[{"denominator":36,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":36,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-08T22:08:43.355975Z","state":"measured"},{"denominator":36,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":36,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-10T06:31:04.303077+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2502.04621/citation-record","integrity":"/paper/2502.04621/integrity","json":"/paper/2502.04621/citation-record.json","paper":"/paper/2502.04621"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T22:09:28.880126Z","title":"Structure and evolution of package dependency networks,","venue":null,"work_id":"41313d05-3fa2-4cf2-94b6-634b9aefa13d","year":2017},"citing_paper":{"arxiv_id":"2502.04621","last_updated":"2025-02-16T15:28:24Z","snapshot_observed_at":"2026-08-08T22:03:03.576931Z","submitted_at":"2025-02-07T02:43:35Z","title":"Tracing Vulnerabilities in Maven: A Study of CVE lifecycles and Dependency Networks","version":2},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-08T22:08:42.715900Z"},"links":{"citing_paper":"/paper/2502.04621"},"observation_digest":"sha256:217b5ef957f7be719fbff2d9c117eff9888a6329038dec076e830588245a4e6e","observation_id":"2a0bc92c-93a4-4e9b-b0ff-c94ac42b5204","resolution":{"observed_at":"2026-08-08T22:09:28.883603Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T22:09:28.870736Z","title":"Analyzing the direct and transitive impact of vulnerabilities onto different artifact repositories,","venue":null,"work_id":"9c64590d-5ef3-42db-afdf-46acb2477a4f","year":2022},"citing_paper":{"arxiv_id":"2502.04621","last_updated":"2025-02-16T15:28:24Z","snapshot_observed_at":"2026-08-08T22:03:03.576931Z","submitted_at":"2025-02-07T02:43:35Z","title":"Tracing Vulnerabilities in Maven: A Study of CVE lifecycles and Dependency Networks","version":2},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-08T22:08:42.720535Z"},"links":{"citing_paper":"/paper/2502.04621"},"observation_digest":"sha256:5b4a4a917b48a0d939a9d3fa579b40b8e5d0cc6afb0d25a13ac2a08dbe947973","observation_id":"299b5c6f-85c1-4338-af11-0c32e81dea69","resolution":{"observed_at":"2026-08-08T22:09:28.874030Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T22:09:28.861316Z","title":"Software vulnerabilities overview: A descriptive study,","venue":null,"work_id":"82acb43e-675e-4a0f-9a7c-6f61c143eead","year":2020},"citing_paper":{"arxiv_id":"2502.04621","last_updated":"2025-02-16T15:28:24Z","snapshot_observed_at":"2026-08-08T22:03:03.576931Z","submitted_at":"2025-02-07T02:43:35Z","title":"Tracing Vulnerabilities in Maven: A Study of CVE lifecycles and Dependency Networks","version":2},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-08T22:08:42.748954Z"},"links":{"citing_paper":"/paper/2502.04621"},"observation_digest":"sha256:a7c7a02b323a3a260e0dab5e84361623df7e176f59d480667c55fbc48da84159","observation_id":"cb3b88e9-503d-406b-8bf1-daa8833114a3","resolution":{"observed_at":"2026-08-08T22:09:28.864776Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T22:09:28.851285Z","title":"Common vulnerabilities and exposures (cve): Overview,","venue":null,"work_id":"ce6288d6-9389-476d-9fd9-37e424b586c3","year":2024},"citing_paper":{"arxiv_id":"2502.04621","last_updated":"2025-02-16T15:28:24Z","snapshot_observed_at":"2026-08-08T22:03:03.576931Z","submitted_at":"2025-02-07T02:43:35Z","title":"Tracing Vulnerabilities in Maven: A Study of CVE lifecycles and Dependency Networks","version":2},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-08T22:08:42.752903Z"},"links":{"citing_paper":"/paper/2502.04621"},"observation_digest":"sha256:11614c09c79550788125fdca036e7e08e3a28c2f9fa637ebe58e96cffd160827","observation_id":"50f12c23-01a2-4ca9-9ea8-60341e8ff462","resolution":{"observed_at":"2026-08-08T22:09:28.854835Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T22:09:28.840985Z","title":"Osv: Open source vulnerabilities,","venue":null,"work_id":"c9795f8e-1d90-4fec-8930-f015cffe6e58","year":2024},"citing_paper":{"arxiv_id":"2502.04621","last_updated":"2025-02-16T15:28:24Z","snapshot_observed_at":"2026-08-08T22:03:03.576931Z","submitted_at":"2025-02-07T02:43:35Z","title":"Tracing Vulnerabilities in Maven: A Study of CVE lifecycles and Dependency Networks","version":2},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-08T22:08:42.757327Z"},"links":{"citing_paper":"/paper/2502.04621"},"observation_digest":"sha256:7212662ba62d14c748cc4c4d20a8a20a8b1bd98c35708624dbbb04b51a141ce3","observation_id":"c116e157-ee4e-47d6-b68c-9a19892bcc27","resolution":{"observed_at":"2026-08-08T22:09:28.845010Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T22:09:28.831705Z","title":"Stack overflow developer survey 2024,","venue":null,"work_id":"d1907b56-552b-426b-b119-81d23c964c36","year":2024},"citing_paper":{"arxiv_id":"2502.04621","last_updated":"2025-02-16T15:28:24Z","snapshot_observed_at":"2026-08-08T22:03:03.576931Z","submitted_at":"2025-02-07T02:43:35Z","title":"Tracing Vulnerabilities in Maven: A Study of CVE lifecycles and Dependency Networks","version":2},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-08T22:08:42.760793Z"},"links":{"citing_paper":"/paper/2502.04621"},"observation_digest":"sha256:8d7403d09072f0b16f5a18bc7a94fb7ac5364e78fbdb36e7d0db84eafc18ac5a","observation_id":"0596dfff-895e-4737-a8ce-fadd0e860b8a","resolution":{"observed_at":"2026-08-08T22:09:28.835117Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T22:09:28.822013Z","title":"Maven repository: Central repository search,","venue":null,"work_id":"68454224-f69c-4c7c-9ed1-33bb19346d49","year":2024},"citing_paper":{"arxiv_id":"2502.04621","last_updated":"2025-02-16T15:28:24Z","snapshot_observed_at":"2026-08-08T22:03:03.576931Z","submitted_at":"2025-02-07T02:43:35Z","title":"Tracing Vulnerabilities in Maven: A Study of CVE lifecycles and Dependency Networks","version":2},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-08T22:08:42.765398Z"},"links":{"citing_paper":"/paper/2502.04621"},"observation_digest":"sha256:4ee1c22a1a79766b06a05051d4406fcc309873362db76ae5bec958b76612ffb6","observation_id":"f138defe-e7b3-497f-9a5b-a39a4d337147","resolution":{"observed_at":"2026-08-08T22:09:28.825843Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T22:09:28.812072Z","title":"Empirical analysis of security vulnerabilities in python packages,","venue":null,"work_id":"8fb8d61c-5599-4e29-aeb8-70a63dbc87f6","year":2023},"citing_paper":{"arxiv_id":"2502.04621","last_updated":"2025-02-16T15:28:24Z","snapshot_observed_at":"2026-08-08T22:03:03.576931Z","submitted_at":"2025-02-07T02:43:35Z","title":"Tracing Vulnerabilities in Maven: A Study of CVE lifecycles and Dependency Networks","version":2},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-08T22:08:42.769031Z"},"links":{"citing_paper":"/paper/2502.04621"},"observation_digest":"sha256:9bb9d083a05dea68966c9d248b88b75d1dc37475c14dab69dd6931dda6270724","observation_id":"eef6b30f-fb31-43ec-991f-19888dfa3b91","resolution":{"observed_at":"2026-08-08T22:09:28.815709Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T22:09:28.802920Z","title":"On the discoverability of npm vulnerabilities in node.js projects,","venue":null,"work_id":"eac8240a-b48f-4817-8b22-9b521809ec7f","year":2022},"citing_paper":{"arxiv_id":"2502.04621","last_updated":"2025-02-16T15:28:24Z","snapshot_observed_at":"2026-08-08T22:03:03.576931Z","submitted_at":"2025-02-07T02:43:35Z","title":"Tracing Vulnerabilities in Maven: A Study of CVE lifecycles and Dependency Networks","version":2},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-08T22:08:42.773202Z"},"links":{"citing_paper":"/paper/2502.04621"},"observation_digest":"sha256:396b52b6e25417003bab7402547c2a6b297e6604b4554893b720b9e5e54d2eca","observation_id":"418f6c4d-f19e-44f6-bece-3cbb488a5bf9","resolution":{"observed_at":"2026-08-08T22:09:28.806199Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T22:09:28.793430Z","title":"Vulnerability of package dependency networks,","venue":null,"work_id":"d5af0bcd-bbc9-4c99-a995-0f8584dbe319","year":2023},"citing_paper":{"arxiv_id":"2502.04621","last_updated":"2025-02-16T15:28:24Z","snapshot_observed_at":"2026-08-08T22:03:03.576931Z","submitted_at":"2025-02-07T02:43:35Z","title":"Tracing Vulnerabilities in Maven: A Study of CVE lifecycles and Dependency Networks","version":2},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-08T22:08:42.777188Z"},"links":{"citing_paper":"/paper/2502.04621"},"observation_digest":"sha256:5d8d514053055a8aed12b1075363f1d7b45cdc6dac8ada132020b91a400b0407","observation_id":"1804784c-d65f-465c-9195-8d780a97729f","resolution":{"observed_at":"2026-08-08T22:09:28.796893Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T22:09:28.781536Z","title":"Understanding the threats of upstream vulnerabilities to downstream projects in the maven ecosystem,","venue":null,"work_id":"8725ef4b-2966-4691-aca8-bfb405db5cbb","year":2023},"citing_paper":{"arxiv_id":"2502.04621","last_updated":"2025-02-16T15:28:24Z","snapshot_observed_at":"2026-08-08T22:03:03.576931Z","submitted_at":"2025-02-07T02:43:35Z","title":"Tracing Vulnerabilities in Maven: A Study of CVE lifecycles and Dependency Networks","version":2},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-08T22:08:42.780830Z"},"links":{"citing_paper":"/paper/2502.04621"},"observation_digest":"sha256:e206a5f66fbf4a8817286c8818cf20746c71f05f52ea4694fd45d1e0f397cfeb","observation_id":"7a4ed11c-9268-4e4d-a324-c3c5bdfc9ef5","resolution":{"observed_at":"2026-08-08T22:09:28.786098Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2411.07480","last_updated":"2024-11-19T17:02:02Z","snapshot_observed_at":"2026-08-06T03:36:12.501093Z","submitted_at":"2024-11-12T01:55:51Z","title":"Discovery of Timeline and Crowd Reaction of Software Vulnerability Disclosures","version":3},"cited_work":{"arxiv_id":"2411.07480","doi":null,"metadata_source":"pith","pith_arxiv_id":"2411.07480","snapshot_observed_at":"2026-08-08T22:09:28.591510Z","title":"Discovery of Timeline and Crowd Reaction of Software Vulnerability Disclosures","venue":"cs.SE","work_id":"3da20081-ba5a-4fc7-9fc3-f0d71607e81a","year":2024},"citing_paper":{"arxiv_id":"2502.04621","last_updated":"2025-02-16T15:28:24Z","snapshot_observed_at":"2026-08-08T22:03:03.576931Z","submitted_at":"2025-02-07T02:43:35Z","title":"Tracing Vulnerabilities in Maven: A Study of CVE lifecycles and Dependency Networks","version":2},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-08T22:08:42.784680Z"},"links":{"cited_paper":"/paper/2411.07480","citing_paper":"/paper/2502.04621"},"observation_digest":"sha256:f2a1cfcd49fe7e607db64210e1c4ddd25c89a1201f3be56a4b735248acc934cf","observation_id":"57783831-4ead-4947-921a-622e8c431d16","resolution":{"observed_at":"2026-08-08T22:09:28.596024Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T22:09:28.771707Z","title":"Navigating and exploring software dependency graphs using goblin,","venue":null,"work_id":"2361923d-b02f-449f-94d9-eb76c87c4952","year":2025},"citing_paper":{"arxiv_id":"2502.04621","last_updated":"2025-02-16T15:28:24Z","snapshot_observed_at":"2026-08-08T22:03:03.576931Z","submitted_at":"2025-02-07T02:43:35Z","title":"Tracing Vulnerabilities in Maven: A Study of CVE lifecycles and Dependency Networks","version":2},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-08T22:08:42.788622Z"},"links":{"citing_paper":"/paper/2502.04621"},"observation_digest":"sha256:f746bb6b7613c44b2dd951427646bc4ef89f1f56a1d7be2b6a8c1d59fcfa69f5","observation_id":"72f2676a-4eba-4f64-97a1-cda8e6af9490","resolution":{"observed_at":"2026-08-08T22:09:28.775641Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2403.17382","doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T22:09:28.574658Z","title":"Charac- terizing dependency update practice of npm, pypi and cargo packages,","venue":null,"work_id":"320a16f0-ea98-4153-81a8-a6a0af868004","year":2024},"citing_paper":{"arxiv_id":"2502.04621","last_updated":"2025-02-16T15:28:24Z","snapshot_observed_at":"2026-08-08T22:03:03.576931Z","submitted_at":"2025-02-07T02:43:35Z","title":"Tracing Vulnerabilities in Maven: A Study of CVE lifecycles and Dependency Networks","version":2},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-08T22:08:42.857157Z"},"links":{"citing_paper":"/paper/2502.04621"},"observation_digest":"sha256:6a7dadd6f0dd52d6db5d5f02738123eb78e548427c75c8f757aa4e526635eff8","observation_id":"2ab73402-78e0-475d-835e-17c5e96c75a3","resolution":{"observed_at":"2026-08-08T22:09:28.579772Z","resolver_source":"raw_fallback","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2208.03412","last_updated":"2023-06-15T14:23:22Z","snapshot_observed_at":"2026-08-10T08:01:45.004768Z","submitted_at":"2022-08-06T00:18:04Z","title":"OpenSSF Scorecard: On the Path Toward Ecosystem-wide Automated Security Metrics","version":4},"cited_work":{"arxiv_id":"2208.03412","doi":null,"metadata_source":"pith","pith_arxiv_id":"2208.03412","snapshot_observed_at":"2026-08-08T22:09:13.538390Z","title":"OpenSSF Scorecard: On the Path Toward Ecosystem-wide Automated Security Metrics","venue":"cs.CR","work_id":"4c51f28a-1c44-4fac-b2ca-65c998e30e5c","year":2022},"citing_paper":{"arxiv_id":"2502.04621","last_updated":"2025-02-16T15:28:24Z","snapshot_observed_at":"2026-08-08T22:03:03.576931Z","submitted_at":"2025-02-07T02:43:35Z","title":"Tracing Vulnerabilities in Maven: A Study of CVE lifecycles and Dependency Networks","version":2},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-08T22:08:42.928874Z"},"links":{"cited_paper":"/paper/2208.03412","citing_paper":"/paper/2502.04621"},"observation_digest":"sha256:7cc5c0109bbdff35d6a44a05838ead4a45057e11772ca0bb042af1c8c8d7c537","observation_id":"2b857491-9ddc-4c4d-929f-04655d3392d1","resolution":{"observed_at":"2026-08-08T22:09:13.542251Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T22:09:28.761558Z","title":"Sonatype central search rest api guide,","venue":null,"work_id":"4db84ffc-b396-48dd-a4af-a7c2f74e397c","year":2024},"citing_paper":{"arxiv_id":"2502.04621","last_updated":"2025-02-16T15:28:24Z","snapshot_observed_at":"2026-08-08T22:03:03.576931Z","submitted_at":"2025-02-07T02:43:35Z","title":"Tracing Vulnerabilities in Maven: A Study of CVE lifecycles and Dependency Networks","version":2},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-08T22:08:42.934402Z"},"links":{"citing_paper":"/paper/2502.04621"},"observation_digest":"sha256:1171cdc0b6cab7fb43a5922148588515e744c0fddda9eba9462fae72a9defa25","observation_id":"96b5b430-b867-45fd-afd5-c0fe0b0e051e","resolution":{"observed_at":"2026-08-08T22:09:28.765065Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T22:09:28.751139Z","title":"OpenDigger,","venue":null,"work_id":"723d8188-5ee0-4b9b-89db-e8fc775dbca5","year":2021},"citing_paper":{"arxiv_id":"2502.04621","last_updated":"2025-02-16T15:28:24Z","snapshot_observed_at":"2026-08-08T22:03:03.576931Z","submitted_at":"2025-02-07T02:43:35Z","title":"Tracing Vulnerabilities in Maven: A Study of CVE lifecycles and Dependency Networks","version":2},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-08T22:08:42.938386Z"},"links":{"citing_paper":"/paper/2502.04621"},"observation_digest":"sha256:43aa0fed924929727c076eda9ebbd38af576a216b0b2d285310f4dd59d1bd868","observation_id":"6e02a9c7-211a-4853-b1b5-a430ba6e4b8f","resolution":{"observed_at":"2026-08-08T22:09:28.754889Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T22:09:28.740550Z","title":"GH Archive,","venue":null,"work_id":"aa15b4e2-a94c-4e3a-ab96-e386a74d75b5","year":2024},"citing_paper":{"arxiv_id":"2502.04621","last_updated":"2025-02-16T15:28:24Z","snapshot_observed_at":"2026-08-08T22:03:03.576931Z","submitted_at":"2025-02-07T02:43:35Z","title":"Tracing Vulnerabilities in Maven: A Study of CVE lifecycles and Dependency Networks","version":2},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-08T22:08:42.941886Z"},"links":{"citing_paper":"/paper/2502.04621"},"observation_digest":"sha256:da8df8abc7697c723c4ae859f6fa33cbb9ac138fa2787c9137bd6c158fdce339","observation_id":"71cdf54c-09d4-4a19-991e-30e85339d559","resolution":{"observed_at":"2026-08-08T22:09:28.744233Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T22:09:28.729963Z","title":"CHAOSS: Community Health Analytics Open Source Software,","venue":null,"work_id":"fc7f8929-9e99-481f-bb9f-1245d1d5d284","year":2025},"citing_paper":{"arxiv_id":"2502.04621","last_updated":"2025-02-16T15:28:24Z","snapshot_observed_at":"2026-08-08T22:03:03.576931Z","submitted_at":"2025-02-07T02:43:35Z","title":"Tracing Vulnerabilities in Maven: A Study of CVE lifecycles and Dependency Networks","version":2},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-08T22:08:42.945173Z"},"links":{"citing_paper":"/paper/2502.04621"},"observation_digest":"sha256:f117dfdf2cbc28ba02f6f48b794d342675395ae374aabd83e544f06f8f689007","observation_id":"0630d7dc-2596-4021-b528-fdc7950da990","resolution":{"observed_at":"2026-08-08T22:09:28.733696Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T22:09:28.719264Z","title":"X-Lab: Unlocking Innovation,","venue":null,"work_id":"b00a92bd-5607-4306-989c-a435f1949fd7","year":2025},"citing_paper":{"arxiv_id":"2502.04621","last_updated":"2025-02-16T15:28:24Z","snapshot_observed_at":"2026-08-08T22:03:03.576931Z","submitted_at":"2025-02-07T02:43:35Z","title":"Tracing Vulnerabilities in Maven: A Study of CVE lifecycles and Dependency Networks","version":2},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-08T22:08:42.949018Z"},"links":{"citing_paper":"/paper/2502.04621"},"observation_digest":"sha256:b29b5bc738638d43f2e4a4afc9922a956ceafde2362e56b16cfa9f1f5b83c85a","observation_id":"426ba058-ca31-48ac-a6e7-3421f899d75c","resolution":{"observed_at":"2026-08-08T22:09:28.722559Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T22:09:28.708520Z","title":"On a test of whether one of two random variables is stochastically larger than the other,","venue":null,"work_id":"d252ac3c-ac9d-4951-aa57-05b4c7aa66fa","year":1947},"citing_paper":{"arxiv_id":"2502.04621","last_updated":"2025-02-16T15:28:24Z","snapshot_observed_at":"2026-08-08T22:03:03.576931Z","submitted_at":"2025-02-07T02:43:35Z","title":"Tracing Vulnerabilities in Maven: A Study of CVE lifecycles and Dependency Networks","version":2},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-08T22:08:42.952802Z"},"links":{"citing_paper":"/paper/2502.04621"},"observation_digest":"sha256:0b3b8fb8e7a0f0ae5d63834ceb6370e32e9d102ff489a7ca624fc67de15353bf","observation_id":"f9df8d41-f5c9-499e-8d4e-941e5d238d2c","resolution":{"observed_at":"2026-08-08T22:09:28.712356Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"0019.35353","doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T22:09:13.522577Z","title":"On the use of refactoring in security vulnerability fixes: An exploratory study on maven libraries,","venue":null,"work_id":"8dae6d61-1c58-40fe-8071-43d7c693ad94","year":2022},"citing_paper":{"arxiv_id":"2502.04621","last_updated":"2025-02-16T15:28:24Z","snapshot_observed_at":"2026-08-08T22:03:03.576931Z","submitted_at":"2025-02-07T02:43:35Z","title":"Tracing Vulnerabilities in Maven: A Study of CVE lifecycles and Dependency Networks","version":2},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-08T22:08:42.956428Z"},"links":{"citing_paper":"/paper/2502.04621"},"observation_digest":"sha256:73337c167e23e732770cc05b0391c97e8ba3bce2c343e8468d37ab2dae8c273a","observation_id":"bf2cafdb-f9c1-4c81-abb6-ef73879f71bd","resolution":{"observed_at":"2026-08-08T22:09:13.527405Z","resolver_source":"raw_fallback","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T22:09:28.696918Z","title":"Contributor absence factor,","venue":null,"work_id":"c5a6614e-1732-4311-9f6c-90f8774ae127","year":2025},"citing_paper":{"arxiv_id":"2502.04621","last_updated":"2025-02-16T15:28:24Z","snapshot_observed_at":"2026-08-08T22:03:03.576931Z","submitted_at":"2025-02-07T02:43:35Z","title":"Tracing Vulnerabilities in Maven: A Study of CVE lifecycles and Dependency Networks","version":2},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-08T22:08:43.042541Z"},"links":{"citing_paper":"/paper/2502.04621"},"observation_digest":"sha256:ce95c9fa228ef534b316fe5146566603eebeeda36dc76117fb5d0bc754ee4e65","observation_id":"1dc23f0b-ba68-4fce-9b92-c74827d1327a","resolution":{"observed_at":"2026-08-08T22:09:28.701766Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T22:09:28.686149Z","title":"Empirical findings on team size and productivity in software development,","venue":null,"work_id":"cab0d95a-e69f-499b-865f-1d4b38c90b4e","year":2012},"citing_paper":{"arxiv_id":"2502.04621","last_updated":"2025-02-16T15:28:24Z","snapshot_observed_at":"2026-08-08T22:03:03.576931Z","submitted_at":"2025-02-07T02:43:35Z","title":"Tracing Vulnerabilities in Maven: A Study of CVE lifecycles and Dependency Networks","version":2},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-08T22:08:43.138470Z"},"links":{"citing_paper":"/paper/2502.04621"},"observation_digest":"sha256:1ac65a373711870f3d528c56741063f360b2ff6d881d8c5cbb397ac9cd6a32d4","observation_id":"ebb0499c-e524-44b1-84eb-d4be87166db6","resolution":{"observed_at":"2026-08-08T22:09:28.689965Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T22:08:43.181569Z","title":"Evaluating complexity, code churn, and developer activity metrics as indicators of software vulnerabilities,","venue":null,"work_id":null,"year":2011},"citing_paper":{"arxiv_id":"2502.04621","last_updated":"2025-02-16T15:28:24Z","snapshot_observed_at":"2026-08-08T22:03:03.576931Z","submitted_at":"2025-02-07T02:43:35Z","title":"Tracing Vulnerabilities in Maven: A Study of CVE lifecycles and Dependency Networks","version":2},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-08T22:08:43.181569Z"},"links":{"citing_paper":"/paper/2502.04621"},"observation_digest":"sha256:d28158353119da8ce2872f1d7b228dccd4cafd66fcbacdf5b97805a2187760ff","observation_id":"4a7b13d6-e489-49d9-a8cd-70b2f7b33c11","resolution":{"observed_at":"2026-08-08T22:08:43.181569Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T22:08:43.185026Z","title":"An empirical investigation of the security weaknesses in open-source projects,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.04621","last_updated":"2025-02-16T15:28:24Z","snapshot_observed_at":"2026-08-08T22:03:03.576931Z","submitted_at":"2025-02-07T02:43:35Z","title":"Tracing Vulnerabilities in Maven: A Study of CVE lifecycles and Dependency Networks","version":2},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-08T22:08:43.185026Z"},"links":{"citing_paper":"/paper/2502.04621"},"observation_digest":"sha256:1a9b6fef418e12d4154b845c8f211c3a9caae982dc7bac5c7f09bb717e98e803","observation_id":"8ad1d48f-fd6c-4acd-9a46-e54ae1d84824","resolution":{"observed_at":"2026-08-08T22:08:43.185026Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T22:09:28.668788Z","title":"Correlation between github stars and code vulnerabilities,","venue":null,"work_id":"56f4fd9b-21a3-401d-95ee-c141af254272","year":2022},"citing_paper":{"arxiv_id":"2502.04621","last_updated":"2025-02-16T15:28:24Z","snapshot_observed_at":"2026-08-08T22:03:03.576931Z","submitted_at":"2025-02-07T02:43:35Z","title":"Tracing Vulnerabilities in Maven: A Study of CVE lifecycles and Dependency Networks","version":2},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-08T22:08:43.188761Z"},"links":{"citing_paper":"/paper/2502.04621"},"observation_digest":"sha256:5f58782b8cc41ee79f6a7eba639fcaf08904b1e256e96c2818d5c5171c5f12f2","observation_id":"35d98d5a-7370-4ddc-ba31-46817753cf2d","resolution":{"observed_at":"2026-08-08T22:09:28.672532Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T22:09:28.658722Z","title":"Mitigating persistence of open-source vulnerabilities in maven ecosystem,","venue":null,"work_id":"6820a751-bdbf-4271-aa47-c5b24bed094b","year":2023},"citing_paper":{"arxiv_id":"2502.04621","last_updated":"2025-02-16T15:28:24Z","snapshot_observed_at":"2026-08-08T22:03:03.576931Z","submitted_at":"2025-02-07T02:43:35Z","title":"Tracing Vulnerabilities in Maven: A Study of CVE lifecycles and Dependency Networks","version":2},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-08T22:08:43.192779Z"},"links":{"citing_paper":"/paper/2502.04621"},"observation_digest":"sha256:5b882850b671453934e123b243c90b7807b51a201872097c052ba4be767473b6","observation_id":"81641e09-93f2-4ca9-89bb-511bb19084d5","resolution":{"observed_at":"2026-08-08T22:09:28.662501Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T22:09:28.648541Z","title":"Tracking known security vulnerabilities in proprietary software systems,","venue":null,"work_id":"c2aa1a09-0941-4ce3-9322-85c6f407b661","year":2015},"citing_paper":{"arxiv_id":"2502.04621","last_updated":"2025-02-16T15:28:24Z","snapshot_observed_at":"2026-08-08T22:03:03.576931Z","submitted_at":"2025-02-07T02:43:35Z","title":"Tracing Vulnerabilities in Maven: A Study of CVE lifecycles and Dependency Networks","version":2},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-08T22:08:43.197031Z"},"links":{"citing_paper":"/paper/2502.04621"},"observation_digest":"sha256:d78c3bd7541ddfeae87fb47539807df5347b7b7111e6eb2eb87b28feba2da55f","observation_id":"6076efe5-b23d-4a7a-b89a-14824b07a4d2","resolution":{"observed_at":"2026-08-08T22:09:28.652242Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T22:09:28.637700Z","title":"On the security blind spots of software composition analysis,","venue":null,"work_id":"a5c9cad5-8712-45c5-804a-ecd198cba8f9","year":2024},"citing_paper":{"arxiv_id":"2502.04621","last_updated":"2025-02-16T15:28:24Z","snapshot_observed_at":"2026-08-08T22:03:03.576931Z","submitted_at":"2025-02-07T02:43:35Z","title":"Tracing Vulnerabilities in Maven: A Study of CVE lifecycles and Dependency Networks","version":2},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-08T22:08:43.200845Z"},"links":{"citing_paper":"/paper/2502.04621"},"observation_digest":"sha256:4f569392c0e852e8e66f86bba057f2c8ab16419123eea437fbf902e4c166496c","observation_id":"cf90f9b3-5f1e-403d-8b9a-d09f76616925","resolution":{"observed_at":"2026-08-08T22:09:28.641308Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T22:09:28.626569Z","title":"A large-scale security- oriented static analysis of python packages in pypi,","venue":null,"work_id":"81ac851e-233e-4125-b920-fcc273c48e06","year":2021},"citing_paper":{"arxiv_id":"2502.04621","last_updated":"2025-02-16T15:28:24Z","snapshot_observed_at":"2026-08-08T22:03:03.576931Z","submitted_at":"2025-02-07T02:43:35Z","title":"Tracing Vulnerabilities in Maven: A Study of CVE lifecycles and Dependency Networks","version":2},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-08T22:08:43.205312Z"},"links":{"citing_paper":"/paper/2502.04621"},"observation_digest":"sha256:e42b0646ba9e48c96b95f6e5e4d54c3990230cda90cddbe0544149aef7d7c3aa","observation_id":"5b0df98f-c93d-4337-905d-bf27707fc01b","resolution":{"observed_at":"2026-08-08T22:09:28.630447Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T22:08:43.208708Z","title":"On the impact of security vulnerabilities in the npm and rubygems dependency networks,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2502.04621","last_updated":"2025-02-16T15:28:24Z","snapshot_observed_at":"2026-08-08T22:03:03.576931Z","submitted_at":"2025-02-07T02:43:35Z","title":"Tracing Vulnerabilities in Maven: A Study of CVE lifecycles and Dependency Networks","version":2},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-08T22:08:43.208708Z"},"links":{"citing_paper":"/paper/2502.04621"},"observation_digest":"sha256:ca95dddb3c68a040d486ae7791d5df0e6047b60171c194f68762b1b71dd766c5","observation_id":"c0e7bfd2-3dea-4024-9c68-7743c23ea3f3","resolution":{"observed_at":"2026-08-08T22:08:43.208708Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T22:09:28.615169Z","title":"Small world with high risks: A study of security threats in the npm ecosystem,","venue":null,"work_id":"55c9ca66-ee98-4e20-a8c3-a8c7081d5e23","year":2019},"citing_paper":{"arxiv_id":"2502.04621","last_updated":"2025-02-16T15:28:24Z","snapshot_observed_at":"2026-08-08T22:03:03.576931Z","submitted_at":"2025-02-07T02:43:35Z","title":"Tracing Vulnerabilities in Maven: A Study of CVE lifecycles and Dependency Networks","version":2},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-08T22:08:43.291541Z"},"links":{"citing_paper":"/paper/2502.04621"},"observation_digest":"sha256:93948c2b8014cdf07871fe2203fbbf247486903dc73705b759d55272a2983345","observation_id":"4510ab2c-2dcb-4773-bc8f-c8e6e3d4b214","resolution":{"observed_at":"2026-08-08T22:09:28.619513Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T22:09:28.603616Z","title":"On the effect of transitivity and granularity on vulnerability propagation in the maven ecosystem,","venue":null,"work_id":"c7b118f7-b525-449d-804f-d6c7de2b6146","year":null},"citing_paper":{"arxiv_id":"2502.04621","last_updated":"2025-02-16T15:28:24Z","snapshot_observed_at":"2026-08-08T22:03:03.576931Z","submitted_at":"2025-02-07T02:43:35Z","title":"Tracing Vulnerabilities in Maven: A Study of CVE lifecycles and Dependency Networks","version":2},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-08T22:08:43.347451Z"},"links":{"citing_paper":"/paper/2502.04621"},"observation_digest":"sha256:8e12bddae4e4a4963efb3428f3cb4098941d51026965fbc7e74cf406653777bd","observation_id":"8450d9f1-0bdf-4845-900c-53c40599818d","resolution":{"observed_at":"2026-08-08T22:09:28.607365Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":"10.1007/s10664-021-10057-7","metadata_source":"openalex","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T00:03:40.895421Z","title":"Ethics in the mining of software repositories,","venue":"Empirical Software Engineering","work_id":"2e68fb0d-3959-48b2-9332-8e362777565f","year":2021},"citing_paper":{"arxiv_id":"2502.04621","last_updated":"2025-02-16T15:28:24Z","snapshot_observed_at":"2026-08-08T22:03:03.576931Z","submitted_at":"2025-02-07T02:43:35Z","title":"Tracing Vulnerabilities in Maven: A Study of CVE lifecycles and Dependency Networks","version":2},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-08T22:08:43.355975Z"},"links":{"citing_paper":"/paper/2502.04621"},"observation_digest":"sha256:1b762ae27f7270f9c6e3ebb4d910a5cfa5be7e8a8e1ced8e7d90339ad327915e","observation_id":"95b02c0b-bdd5-4c0b-a921-3e6245165767","resolution":{"observed_at":"2026-08-08T22:08:43.393083Z","resolver_source":"doi","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2301.07972","last_updated":"2023-01-19T09:58:49Z","snapshot_observed_at":"2026-07-06T14:42:46.550859Z","submitted_at":"2023-01-19T09:58:49Z","title":"On the Effect of Transitivity and Granularity on Vulnerability Propagation in the Maven Ecosystem","version":1},"cited_work":{"arxiv_id":"2301.07972","doi":null,"metadata_source":"pith","pith_arxiv_id":"2301.07972","snapshot_observed_at":"2026-08-08T22:08:43.410300Z","title":"On the Effect of Transitivity and Granularity on Vulnerability Propagation in the Maven Ecosystem","venue":"cs.SE","work_id":"7e1d3ec2-76eb-4c12-8afe-c4274c20a668","year":2023},"citing_paper":{"arxiv_id":"2502.04621","last_updated":"2025-02-16T15:28:24Z","snapshot_observed_at":"2026-08-08T22:03:03.576931Z","submitted_at":"2025-02-07T02:43:35Z","title":"Tracing Vulnerabilities in Maven: A Study of CVE lifecycles and Dependency Networks","version":2},"reference_index":2023,"source":"pdf_text","source_observed_at":"2026-08-08T22:08:43.350791Z"},"links":{"cited_paper":"/paper/2301.07972","citing_paper":"/paper/2502.04621"},"observation_digest":"sha256:682012e1c33826b6d5ff4e776e0cadd75cbec699fb4b3035c53d3d1862fa85b4","observation_id":"794a62a9-ed3e-40d8-9f6a-c34a13871f17","resolution":{"observed_at":"2026-08-08T22:08:43.435888Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2502.04621","last_updated":"2025-02-16T15:28:24Z","latest_version":2,"primary_category":"cs.SE","snapshot_observed_at":"2026-08-08T22:03:03.576931Z","submitted_at":"2025-02-07T02:43:35Z","title":"Tracing Vulnerabilities in Maven: A Study of CVE lifecycles and Dependency Networks"},"reference_resolution":{"displayed":36,"state_counts":{"malformed_identifier":0,"metadata_mismatch":2,"parse_uncertain":0,"unresolved":3,"verified_exact":4,"verified_fuzzy":27},"total_outbound_references":36},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"thesis":"As of 10 August 2026, this Paper Citation Record lists 36 of 36 outbound references and 0 inbound Pith citation observations for arXiv:2502.04621."}