{"as_of":"2026-08-10T10:37:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:baf8a8d8e4ed82b6a06ee8e7cc6c0ba6f6208374c9bc8507c000d85ab7afcbe1","coverage":[{"denominator":47,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":47,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-01T05:43:57.067781Z","state":"measured"},{"denominator":47,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":47,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-10T06:31:04.303077+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2607.22140/citation-record","integrity":"/paper/2607.22140/integrity","json":"/paper/2607.22140/citation-record.json","paper":"/paper/2607.22140"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:53.117446Z","title":"The minimum elements for a software bill of materials (SBOM),","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:53.117446Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:994060ab52e57a2719f3d2621b7a288f3639eecfb7f50be9f167e52c51546212","observation_id":"18bfc2aa-7f04-471c-8a4d-d7b82c7003d3","resolution":{"observed_at":"2026-08-01T05:43:53.117446Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:53.196857Z","title":"A large scale empirical analysis on the adherence gap between standards and tools in SBOM,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:53.196857Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:b34e2176c1984aa54ab502b1d0088700bb1bdb22960ecdb42631b848fefcc6a4","observation_id":"1b6c2eac-934d-404f-934a-7d4b2d5634b7","resolution":{"observed_at":"2026-08-01T05:43:53.196857Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:53.286268Z","title":"Software dark mat- ter: Gazing at uncharted files to navigate SBOM integrations,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:53.286268Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:d67124c1c1a30d02a87d829a2041c21f4691d2c347228c4bbc588c6fa2e7afb9","observation_id":"d250ef59-4d2b-44ee-8ed8-76585d963079","resolution":{"observed_at":"2026-08-01T05:43:53.286268Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:53.386235Z","title":"Wild SBOMs: a large-scale dataset of software bills of materials from public code,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:53.386235Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:ebdb2424509c052f481b3ed7d73a6ba76dea05e92202bd9d6b803b127c3e4f34","observation_id":"9b02ca80-81cc-4ce8-87cc-e5364113491b","resolution":{"observed_at":"2026-08-01T05:43:53.386235Z","resolver_source":null,"status":"malformed_identifier"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:53.488183Z","title":"In defense of soundiness: A manifesto,","venue":null,"work_id":null,"year":2015},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:53.488183Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:5e687853edf81847f68d30a91236d190c293396a97ef5dd40ea66ebbea0bdb7a","observation_id":"1b0997db-33b7-4390-bd85-419b68c6a7c7","resolution":{"observed_at":"2026-08-01T05:43:53.488183Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:53.580886Z","title":"On closed world data bases,","venue":null,"work_id":null,"year":1978},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:53.580886Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:dccb0b56625715887f30bb78a477dd77e397369a8301f9c22ac7faa36e3be22c","observation_id":"a486e688-d3e9-4284-b11f-bb104b1414bd","resolution":{"observed_at":"2026-08-01T05:43:53.580886Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:53.680300Z","title":"CycloneDX bill of materials specification, version 1.6 — compositions,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:53.680300Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:b37cf1399e10891d976adc5f62ceb91796494339308bade76bbe56cdf21e6ac5","observation_id":"1b49fb71-14cc-4038-8d76-73abb857e3cf","resolution":{"observed_at":"2026-08-01T05:43:53.680300Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:53.763257Z","title":"Executive order 14028: Improving the nation’s cybersecurity,","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:53.763257Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:64a294ad622ae7fc9dfbb88670619f1aaa6ac8f287420a28438df0b7dac59945","observation_id":"a927fa04-9f1b-4617-a92d-b1dbe0b99d65","resolution":{"observed_at":"2026-08-01T05:43:53.763257Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:53.839283Z","title":"Regulation (eu) 2024/2847 on hor- izontal cybersecurity requirements for products with digital elements (cyber resilience act),","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:53.839283Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:f888119b0365aa37c9d22c68426c33449a172a76b5367072c08dfd0eea25fb04","observation_id":"079adb1e-6fc8-47de-8523-fa2a12fe0952","resolution":{"observed_at":"2026-08-01T05:43:53.839283Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:53.905296Z","title":"Framing software component transparency: Establishing a com- mon software bill of materials (SBOM),","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:53.905296Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:1ccf65fe47470ba16edde45c94b3d39ec163c9ba1731290d3241af2cc69b6ae1","observation_id":"f30bd26c-458d-40d6-8134-b51df0855e74","resolution":{"observed_at":"2026-08-01T05:43:53.905296Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:53.970099Z","title":"Automated SBOM-driven vulnerability triage for IoT firmware: A lightweight pipeline for risk prioritization,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:53.970099Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:632cb44f1e35986c138712d84a34dbe1ed95d838155b088478ede23bcc43884e","observation_id":"46aeaee3-9bd2-4efa-8a02-45c34b221e96","resolution":{"observed_at":"2026-08-01T05:43:53.970099Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:54.060817Z","title":"Exploit prediction scoring system (EPSS),","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:54.060817Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:26da2ac2e37497baa9895638a1cee47de3a41399119b3f6478f484d208be9d2d","observation_id":"509225ab-9cb8-43d4-9533-e949e7fe8deb","resolution":{"observed_at":"2026-08-01T05:43:54.060817Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:54.169595Z","title":"Con- flicting scores, confusing signals: An empirical study of vulnerability scoring systems,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:54.169595Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:0da736579fe888f3dc310f1b847879e680c86a5e63783b171bdb04b0d796b594","observation_id":"24535412-89ad-418e-b8fd-e0874a274881","resolution":{"observed_at":"2026-08-01T05:43:54.169595Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:54.256027Z","title":"Efficacy of EPSS in high severity CVEs found in KEV,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:54.256027Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:17cac70fafeb1b9b75ee6395c75d619c49d64cbd9b66e4d1705e38eddc942799","observation_id":"3e4ee2af-b4e6-4583-b5ff-3345160786fe","resolution":{"observed_at":"2026-08-01T05:43:54.256027Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:54.360972Z","title":"Towards predicting multi-vulnerability attack chains in software supply chains from software bill of materials graphs,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:54.360972Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:823594fbca45178bbad11ce21e530ceda746b74da8b8f70df3255f2c64d96e5f","observation_id":"b1a83ab0-484c-4264-84ff-432f7b79e830","resolution":{"observed_at":"2026-08-01T05:43:54.360972Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:54.462811Z","title":"The ripple effect of vul- nerabilities in Maven Central: Prevalence, propagation, and mitigation challenges,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:54.462811Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:557def73ac3c4499790b90c94840323a0e50353c88b2e78927c9726caba737ec","observation_id":"f8f518d5-2d65-4297-8eaf-a661428440a3","resolution":{"observed_at":"2026-08-01T05:43:54.462811Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:54.520854Z","title":"Out of sight, still at risk: The lifecycle of transitive vulnerabilities in Maven,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:54.520854Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:87a433fdf246bfa6b099f20fd6a1b42b894f4b71e644fe4fede6344224d48c0a","observation_id":"cfe1b183-d8bc-48ed-9ab2-8d7fdfd15da7","resolution":{"observed_at":"2026-08-01T05:43:54.520854Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:54.588401Z","title":"Tracing vulnerabilities in Maven: A study of CVE lifecycles and dependency networks,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:54.588401Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:4eeb3badc04d263e9a09b07c118f5989181f9f9cb0449c0d3f25fbc0f9eff0a6","observation_id":"4ac7a2b1-c7f3-433f-af32-17a8ab699843","resolution":{"observed_at":"2026-08-01T05:43:54.588401Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:54.636429Z","title":"Propagation- based vulnerability impact assessment for software supply chains,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:54.636429Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:54b5c674f94f91bc054c0eccb7a8788b08d4bfef7092a1ded2e4d3a3797d88a1","observation_id":"c6a2e04f-643a-4e09-a5c1-f1abe70cd435","resolution":{"observed_at":"2026-08-01T05:43:54.636429Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:54.735408Z","title":"Vulnerable open source dependencies: Counting those that matter,","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:54.735408Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:9c5d574c1f1ce90cf600cc1b9f0951c7b946503ac70e7233374184910242c2e9","observation_id":"3fffc540-a711-4e80-8572-4eb73b4c50aa","resolution":{"observed_at":"2026-08-01T05:43:54.735408Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:54.830513Z","title":"Vuln4Real: A methodology for counting actually vulnerable dependencies,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:54.830513Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:6b2e5c53dd44e2c9d86e635084f1021a1fcc20c69b5db896e1bf0faa1cc36c5c","observation_id":"f648ddb6-d84d-41cf-8c57-72aa11d66141","resolution":{"observed_at":"2026-08-01T05:43:54.830513Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:54.926478Z","title":"Backstabber’s knife collection: A review of open source software supply chain attacks,","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:54.926478Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:b30006721db6fc529add290d5b2f349fa2ad881965ebbf31a9142a889810702f","observation_id":"b6e8a34e-7c13-4aa9-9c61-cf2069d2efe7","resolution":{"observed_at":"2026-08-01T05:43:54.926478Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2204.04008","last_updated":"2022-04-19T19:02:15Z","snapshot_observed_at":"2026-08-01T16:00:11.100562Z","submitted_at":"2022-04-08T11:37:24Z","title":"Taxonomy of Attacks on Open-Source Software Supply Chains","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2204.04008","snapshot_observed_at":"2026-08-01T05:43:55.005464Z","title":"SoK: Taxonomy of attacks on open-source software supply chains,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:55.005464Z"},"links":{"cited_paper":"/paper/2204.04008","citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:2e517a75bd28da7efff0c4160658f488a5dd044a4792cee81e8545a2e1b99b8d","observation_id":"b66db5e6-e34a-4fec-9c8d-da0ebd4f3474","resolution":{"observed_at":"2026-08-01T05:43:55.005464Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1902.09217","last_updated":"2019-06-07T09:49:11Z","snapshot_observed_at":"2026-07-06T07:35:10.357526Z","submitted_at":"2019-02-25T12:07:25Z","title":"Small World with High Risks: A Study of Security Threats in the npm Ecosystem","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1902.09217","snapshot_observed_at":"2026-08-01T05:43:55.093591Z","title":"Small world with high risks: A study of security threats in the npm ecosystem,","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:55.093591Z"},"links":{"cited_paper":"/paper/1902.09217","citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:6ea37630d2f58c6a15d8016198360b845253bf8fbe40b25784383040d9fc9070","observation_id":"ff1538cf-e1b1-40ce-b1da-8e034130f1ec","resolution":{"observed_at":"2026-08-01T05:43:55.093591Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:55.164824Z","title":"Syft: CLI tool and library for generating a software bill of materials from container images and filesystems,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:55.164824Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:cb15471863c367cfcfb18a10337aa4782d544e3e44a75fea453970d2475d22a9","observation_id":"a477b02d-18fb-4ce4-b30b-1fe6fb33fa3a","resolution":{"observed_at":"2026-08-01T05:43:55.164824Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:55.260962Z","title":"sbomqs: Quality metrics for SBOMs,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:55.260962Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:45a4fa484ce6df989332522177e27077991c10eafb21386c963b5b0b9d09f251","observation_id":"bc5f7918-51f3-4332-9dd6-14a204b1d59c","resolution":{"observed_at":"2026-08-01T05:43:55.260962Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:55.357396Z","title":"A study of security vulnerabilities on Docker Hub,","venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:55.357396Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:25cf1f80dc6383f2f626203fff5a15bb07aae0d9068c007dc7f254ee87a67e35","observation_id":"79c9543e-d3dc-4014-8766-dd409239610f","resolution":{"observed_at":"2026-08-01T05:43:55.357396Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:55.455119Z","title":"On the relation between outdated docker containers, severity vulnerabilities, and bugs,","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:55.455119Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:b6b9ada210808f99c1542cc671412f0070b5e75f3a4fd2aa1b92d1aa54d10ee0","observation_id":"ac13e551-d454-44c7-9db6-e91c8194c4e4","resolution":{"observed_at":"2026-08-01T05:43:55.455119Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:55.557939Z","title":"A faster algorithm for betweenness centrality,","venue":null,"work_id":null,"year":2001},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:55.557939Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:d9cf20154f0feb3f4dba48ca965d6f0f05de974a41a528983ae8758d4173f500","observation_id":"ac530844-414c-457d-a0b1-484e1088a075","resolution":{"observed_at":"2026-08-01T05:43:55.557939Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:55.659094Z","title":"SBOMproof: Beyond alleged SBOM compliance for supply chain security of container images,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:55.659094Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:01632b9fb2dae60d58ace20fa56c7cfcaa06eb04d9d3af814e976dddcc1ab408","observation_id":"cc2a03fe-ccc7-464f-9403-61d50ea13d6f","resolution":{"observed_at":"2026-08-01T05:43:55.659094Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:55.760171Z","title":"The impact of SBOM generators on vulnerability assessment in Python: A comparison and a novel approach,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:55.760171Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:efd79b34adb3e404975c3f4196883d4dcab365dee10712d20c9301fc856179da","observation_id":"4d52b0bb-48d6-4196-ab33-ef7156469c25","resolution":{"observed_at":"2026-08-01T05:43:55.760171Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:55.858961Z","title":"Accuracy evaluation of SBOM tools for web applications and system-level software,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:55.858961Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:95367bfa579a1a3c75c38d47d2bdc4dc7bd9e79445cf6d689cbf6b82b1a23a64","observation_id":"f97d5b21-c9ac-4c6f-bf9b-b5836ee82b6e","resolution":{"observed_at":"2026-08-01T05:43:55.858961Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:55.951929Z","title":"The state of the SBOM tool ecosystems: A comparative analysis of SPDX and CycloneDX,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:55.951929Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:9f2090a2322b02a701351a9ea6aa41849aca949f32d8ce37c62f83ac36734f39","observation_id":"ff9d2013-bbe4-4471-9ada-08197239c905","resolution":{"observed_at":"2026-08-01T05:43:55.951929Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:56.025522Z","title":"A landscape study of open source and proprietary tools for software bill of materials (SBOM),","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:56.025522Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:151d0152ff0c420b0b11a8f3009581e56399d783f3384992439e03f713783132","observation_id":"ac638fe8-43cd-4548-94ef-b35427ef986e","resolution":{"observed_at":"2026-08-01T05:43:56.025522Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:56.120337Z","title":"Supply chain insecurity: The lack of integrity protection in SBOM solutions,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:56.120337Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:8ea7f64897142b38b79ae4d9d62072b9beeea7f470434c819809808d7670328a","observation_id":"7a64809e-ccfb-495a-a0c7-f033e21b02d9","resolution":{"observed_at":"2026-08-01T05:43:56.120337Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:56.219290Z","title":"A reality check on SBOM- based vulnerability management: An empirical study and a path for- ward,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:56.219290Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:63ee850fec85970d44867cafc545b4eb763d86906c9d675451d6419a749924a4","observation_id":"05fe10d4-239e-42f9-95f2-ec07c6410385","resolution":{"observed_at":"2026-08-01T05:43:56.219290Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:56.320198Z","title":"Software bills of materials in Maven Central,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:56.320198Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:fc831e829e389efdb625a9db4aee251a38648045180155b05b93bfe8ae840d9d","observation_id":"8f76d9a1-3a61-4c11-b5f5-fddffaca5062","resolution":{"observed_at":"2026-08-01T05:43:56.320198Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:56.414702Z","title":"SBOM dataset from 100 000+ public GitHub repositories,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:56.414702Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:6d748091e1d1b8489cd4232d15b435015d207d6ae1a8c863f290933a74c826c6","observation_id":"a6aa901d-e78e-4d0c-8243-d45463818028","resolution":{"observed_at":"2026-08-01T05:43:56.414702Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:56.489524Z","title":"Soft- ware bill of materials in software supply chain security: A systematic literature review,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:56.489524Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:d89a3bc21c491caf130d03689c73c48f6e269fcb4bd7030c0a7176617cf19346","observation_id":"5fe971ab-eca6-42cb-aac4-7a0f3f03583a","resolution":{"observed_at":"2026-08-01T05:43:56.489524Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:56.565115Z","title":"An empirical comparison of dependency network evolution in seven software packaging ecosystems,","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:56.565115Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:00a2ac9014897f0b18b9ee6f255b407bf3e61696b1022f8c914ed87cb095ff5a","observation_id":"2c6bc482-4173-41a6-910a-ac705c1a0fbf","resolution":{"observed_at":"2026-08-01T05:43:56.565115Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:56.637671Z","title":"Structure and evolution of package dependency networks,","venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:56.637671Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:76989d7683d3f51d84862f413348b6ae6d90722a9a4a8254d741cfcf05fb2436","observation_id":"eac3059c-1185-4216-b9a5-f1912735be97","resolution":{"observed_at":"2026-08-01T05:43:56.637671Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:56.700146Z","title":"Structural and connectiv- ity patterns in the Maven Central dependency network,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:56.700146Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:045429a099ff7c9bcd135ac21e0305542b9ae6d43627b5f556bf1da8382d775b","observation_id":"a02d2d2d-c137-449c-8e8c-93342bbc42d3","resolution":{"observed_at":"2026-08-01T05:43:56.700146Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:56.779508Z","title":"On the impact of outdated and vulnerable JavaScript pack- ages in Docker images,","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:56.779508Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:2c3754a91de2ce192ea498f70eea5ebb7dccd7772850c778535b1d7c26b54a32","observation_id":"d9cb6253-862e-4a80-bacd-bca92a215946","resolution":{"observed_at":"2026-08-01T05:43:56.779508Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:56.850967Z","title":"Beyond metadata: Code- centric and usage-based analysis of known vulnerabilities in open-source software,","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:56.850967Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:1258ab27de8202f4f5e04af3a03adce20ded8143dfbcf6c1a09cb955178f5484","observation_id":"68e64c74-44a2-434c-9563-d77f837ee9d8","resolution":{"observed_at":"2026-08-01T05:43:56.850967Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:56.907349Z","title":"A comparative study of vulner- ability reporting by software composition analysis tools,","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:56.907349Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:39370b1316a5155907248c31f86be7fce7f48bb0d25aba08af22a5f22952dcda","observation_id":"659fded5-6e3b-4ed4-93b7-10e6d72b9b6c","resolution":{"observed_at":"2026-08-01T05:43:56.907349Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:56.997417Z","title":"Hidden dependencies and component variants in SBOM-based software composition analysis,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:56.997417Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:0ac3fc654f67d9936b19796e9f9ec4098f768c3d4465ff1803ddfb54f0917e7c","observation_id":"d5e80286-af1f-4fde-a718-f0c3d2eae4c1","resolution":{"observed_at":"2026-08-01T05:43:56.997417Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:57.067781Z","title":"Judge: Identifying, understanding, and evaluating sources of unsoundness in call graphs,","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:57.067781Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:09948d04129e1754bd6cab311edd60fe9dcf67ce5dbed86345a6bb1decc34d40","observation_id":"b91bb2fe-1c73-4fba-8b66-818f88c4dd6a","resolution":{"observed_at":"2026-08-01T05:43:57.067781Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","latest_version":1,"primary_category":"cs.SE","snapshot_observed_at":"2026-08-06T09:47:55.228227Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild"},"reference_resolution":{"displayed":47,"state_counts":{"malformed_identifier":1,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":46,"verified_exact":0,"verified_fuzzy":0},"total_outbound_references":47},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"thesis":"As of 10 August 2026, this Paper Citation Record lists 47 of 47 outbound references and 0 inbound Pith citation observations for arXiv:2607.22140."}