{"record_type":"pith_number_record","schema_url":"https://pith.science/schemas/pith-number/v1.json","pith_number":"pith:2025:5EMVQTMKXTEHORJS7RWFHRFXUG","short_pith_number":"pith:5EMVQTMK","schema_version":"1.0","canonical_sha256":"e919584d8abcc8774532fc6c53c4b7a1a4c383d3ab45365f39b6ea12931ce42a","source":{"kind":"arxiv","id":"2510.08609","version":3},"attestation_state":"computed","paper":{"title":"Which Is Better For Reducing Outdated and Vulnerable Dependencies: Pinning or Floating?","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","headline":"","cross_cats":["cs.CR","cs.LG","cs.PL"],"primary_cat":"cs.SE","authors_text":"Imranur Rahman, Jill Marley, Laurie Williams, William Enck","submitted_at":"2025-10-07T14:37:03Z","abstract_excerpt":"Developers consistently use version constraints to specify acceptable versions of the dependencies for their project. Pinning dependencies can reduce the likelihood of breaking changes, but comes with a cost of manually managing the replacement of outdated and vulnerable dependencies. On the other hand, floating can be used to automatically get bug fixes and security fixes, but comes with the risk of breaking changes. Security practitioners advocate pinning dependencies to prevent against software supply chain attacks, e.g., malicious package updates. However, since pinning is the tightest ver"},"verification_status":{"content_addressed":true,"pith_receipt":true,"author_attested":false,"weak_author_claims":0,"strong_author_claims":0,"externally_anchored":false,"storage_verified":false,"citation_signatures":0,"replication_records":0,"graph_snapshot":true,"references_resolved":false,"formal_links_present":false},"canonical_record":{"source":{"id":"2510.08609","kind":"arxiv","version":3},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.SE","submitted_at":"2025-10-07T14:37:03Z","cross_cats_sorted":["cs.CR","cs.LG","cs.PL"],"title_canon_sha256":"1d3ff6cd2adda87c5eb8b39a69829876a8ec68c26e8e19b6820b885a26208dd7","abstract_canon_sha256":"4f82e37cbc6c3888e18d814e19c7f14689d121fc2cab864131bc16588534fa47"},"schema_version":"1.0"},"receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-26T02:03:57.769304Z","signature_b64":"x2XsF+zSaVGNdhEP3XYb4XX2nCnlTnEt1fmgfzgVNSo+IctM+8f2TjX03STQhdCtM/vOV532SoYvL3nw/IfbCg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"e919584d8abcc8774532fc6c53c4b7a1a4c383d3ab45365f39b6ea12931ce42a","last_reissued_at":"2026-05-26T02:03:57.768189Z","signature_status":"signed_v1","first_computed_at":"2026-05-26T02:03:57.768189Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"graph_snapshot":{"paper":{"title":"Which Is Better For Reducing Outdated and Vulnerable Dependencies: Pinning or Floating?","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","headline":"","cross_cats":["cs.CR","cs.LG","cs.PL"],"primary_cat":"cs.SE","authors_text":"Imranur Rahman, Jill Marley, Laurie Williams, William Enck","submitted_at":"2025-10-07T14:37:03Z","abstract_excerpt":"Developers consistently use version constraints to specify acceptable versions of the dependencies for their project. Pinning dependencies can reduce the likelihood of breaking changes, but comes with a cost of manually managing the replacement of outdated and vulnerable dependencies. On the other hand, floating can be used to automatically get bug fixes and security fixes, but comes with the risk of breaking changes. Security practitioners advocate pinning dependencies to prevent against software supply chain attacks, e.g., malicious package updates. However, since pinning is the tightest ver"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2510.08609","kind":"arxiv","version":3},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2510.08609/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"aliases":[{"alias_kind":"arxiv","alias_value":"2510.08609","created_at":"2026-05-26T02:03:57.768392+00:00"},{"alias_kind":"arxiv_version","alias_value":"2510.08609v3","created_at":"2026-05-26T02:03:57.768392+00:00"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2510.08609","created_at":"2026-05-26T02:03:57.768392+00:00"},{"alias_kind":"pith_short_12","alias_value":"5EMVQTMKXTEH","created_at":"2026-05-26T02:03:57.768392+00:00"},{"alias_kind":"pith_short_16","alias_value":"5EMVQTMKXTEHORJS","created_at":"2026-05-26T02:03:57.768392+00:00"},{"alias_kind":"pith_short_8","alias_value":"5EMVQTMK","created_at":"2026-05-26T02:03:57.768392+00:00"}],"events":[],"event_summary":{},"paper_claims":[],"inbound_citations":{"count":0,"internal_anchor_count":0,"sample":[]},"formal_canon":{"evidence_count":0,"sample":[],"anchors":[]},"links":{"html":"https://pith.science/pith/5EMVQTMKXTEHORJS7RWFHRFXUG","json":"https://pith.science/pith/5EMVQTMKXTEHORJS7RWFHRFXUG.json","graph_json":"https://pith.science/api/pith-number/5EMVQTMKXTEHORJS7RWFHRFXUG/graph.json","events_json":"https://pith.science/api/pith-number/5EMVQTMKXTEHORJS7RWFHRFXUG/events.json","paper":"https://pith.science/paper/5EMVQTMK"},"agent_actions":{"view_html":"https://pith.science/pith/5EMVQTMKXTEHORJS7RWFHRFXUG","download_json":"https://pith.science/pith/5EMVQTMKXTEHORJS7RWFHRFXUG.json","view_paper":"https://pith.science/paper/5EMVQTMK","resolve_alias":"https://pith.science/api/pith-number/resolve?arxiv=2510.08609&json=true","fetch_graph":"https://pith.science/api/pith-number/5EMVQTMKXTEHORJS7RWFHRFXUG/graph.json","fetch_events":"https://pith.science/api/pith-number/5EMVQTMKXTEHORJS7RWFHRFXUG/events.json","actions":{"anchor_timestamp":"https://pith.science/pith/5EMVQTMKXTEHORJS7RWFHRFXUG/action/timestamp_anchor","attest_storage":"https://pith.science/pith/5EMVQTMKXTEHORJS7RWFHRFXUG/action/storage_attestation","attest_author":"https://pith.science/pith/5EMVQTMKXTEHORJS7RWFHRFXUG/action/author_attestation","sign_citation":"https://pith.science/pith/5EMVQTMKXTEHORJS7RWFHRFXUG/action/citation_signature","submit_replication":"https://pith.science/pith/5EMVQTMKXTEHORJS7RWFHRFXUG/action/replication_record"}},"created_at":"2026-05-26T02:03:57.768392+00:00","updated_at":"2026-05-26T02:03:57.768392+00:00"}