{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:6RZHJD7DHLJ7Z6PAOYLZ5WA663","short_pith_number":"pith:6RZHJD7D","canonical_record":{"source":{"id":"2502.06662","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2025-02-10T16:50:48Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"437be73031b209dc281072eddef0b5cfb7e9f843b02f067a75e4e514af43c85f","abstract_canon_sha256":"b2dd4b2331124b2d5c4a15be11e221e44c9674cbd136bbe0abbc261475677083"},"schema_version":"1.0"},"canonical_sha256":"f472748fe33ad3fcf9e076179ed81ef6de7aba4d8008697f757fb4479c5bad63","source":{"kind":"arxiv","id":"2502.06662","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2502.06662","created_at":"2026-07-05T10:12:10Z"},{"alias_kind":"arxiv_version","alias_value":"2502.06662v1","created_at":"2026-07-05T10:12:10Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2502.06662","created_at":"2026-07-05T10:12:10Z"},{"alias_kind":"pith_short_12","alias_value":"6RZHJD7DHLJ7","created_at":"2026-07-05T10:12:10Z"},{"alias_kind":"pith_short_16","alias_value":"6RZHJD7DHLJ7Z6PA","created_at":"2026-07-05T10:12:10Z"},{"alias_kind":"pith_short_8","alias_value":"6RZHJD7D","created_at":"2026-07-05T10:12:10Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:6RZHJD7DHLJ7Z6PAOYLZ5WA663","target":"record","payload":{"canonical_record":{"source":{"id":"2502.06662","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2025-02-10T16:50:48Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"437be73031b209dc281072eddef0b5cfb7e9f843b02f067a75e4e514af43c85f","abstract_canon_sha256":"b2dd4b2331124b2d5c4a15be11e221e44c9674cbd136bbe0abbc261475677083"},"schema_version":"1.0"},"canonical_sha256":"f472748fe33ad3fcf9e076179ed81ef6de7aba4d8008697f757fb4479c5bad63","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T10:12:10.228776Z","signature_b64":"YzjHrVP1gI9EABT2bkMi6kiO+5L0JoN90qr6cF68JWAyPNPH3rw6rkrm4WXt1wG7WoCDtKs7Xk+T5HtXne4dCA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"f472748fe33ad3fcf9e076179ed81ef6de7aba4d8008697f757fb4479c5bad63","last_reissued_at":"2026-07-05T10:12:10.228369Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T10:12:10.228369Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2502.06662","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:12:10Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"9mepltkMsNK1mJs5v8P6ypbXg+nCXgexHfkri90q3Yn2D9QEMvA8jxcVY+HcYqt8AiZ/yhrXpE3RkIeFZpuUAA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-03T16:43:32.924811Z"},"content_sha256":"037802447b0dc51a29c67928f93d2d374a6541a202f2d8d04c5b78129cf3d865","schema_version":"1.0","event_id":"sha256:037802447b0dc51a29c67928f93d2d374a6541a202f2d8d04c5b78129cf3d865"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:6RZHJD7DHLJ7Z6PAOYLZ5WA663","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.CR"],"primary_cat":"cs.SE","authors_text":"Bogdan Vasilescu, Christian K\\\"astner, Hao He","submitted_at":"2025-02-10T16:50:48Z","abstract_excerpt":"Recent high-profile incidents in open-source software have greatly raised practitioner attention on software supply chain attacks. To guard against potential malicious package updates, security practitioners advocate pinning dependency to specific versions rather than floating in version ranges. However, it remains controversial whether pinning carries a meaningful security benefit that outweighs the cost of maintaining outdated and possibly vulnerable dependencies. In this paper, we quantify, through counterfactual analysis and simulations, the security and maintenance impact of version const"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2502.06662","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2502.06662/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:12:10Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"ROlCqTu03j0t9gqDaGYruxWTTz1w48eG69tDVWN1qAmPxlanQsIecwxlTgOu8vwxDqp0ZlvU1fV6n+SEGWQYCQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-03T16:43:32.925352Z"},"content_sha256":"9603d9f8d88be861007d048b75695f76a95e6e8fd312e033283f822927ff544d","schema_version":"1.0","event_id":"sha256:9603d9f8d88be861007d048b75695f76a95e6e8fd312e033283f822927ff544d"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/6RZHJD7DHLJ7Z6PAOYLZ5WA663/bundle.json","state_url":"https://pith.science/pith/6RZHJD7DHLJ7Z6PAOYLZ5WA663/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/6RZHJD7DHLJ7Z6PAOYLZ5WA663/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-03T16:43:32Z","links":{"resolver":"https://pith.science/pith/6RZHJD7DHLJ7Z6PAOYLZ5WA663","bundle":"https://pith.science/pith/6RZHJD7DHLJ7Z6PAOYLZ5WA663/bundle.json","state":"https://pith.science/pith/6RZHJD7DHLJ7Z6PAOYLZ5WA663/state.json","well_known_bundle":"https://pith.science/.well-known/pith/6RZHJD7DHLJ7Z6PAOYLZ5WA663/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:6RZHJD7DHLJ7Z6PAOYLZ5WA663","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"b2dd4b2331124b2d5c4a15be11e221e44c9674cbd136bbe0abbc261475677083","cross_cats_sorted":["cs.CR"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2025-02-10T16:50:48Z","title_canon_sha256":"437be73031b209dc281072eddef0b5cfb7e9f843b02f067a75e4e514af43c85f"},"schema_version":"1.0","source":{"id":"2502.06662","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2502.06662","created_at":"2026-07-05T10:12:10Z"},{"alias_kind":"arxiv_version","alias_value":"2502.06662v1","created_at":"2026-07-05T10:12:10Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2502.06662","created_at":"2026-07-05T10:12:10Z"},{"alias_kind":"pith_short_12","alias_value":"6RZHJD7DHLJ7","created_at":"2026-07-05T10:12:10Z"},{"alias_kind":"pith_short_16","alias_value":"6RZHJD7DHLJ7Z6PA","created_at":"2026-07-05T10:12:10Z"},{"alias_kind":"pith_short_8","alias_value":"6RZHJD7D","created_at":"2026-07-05T10:12:10Z"}],"graph_snapshots":[{"event_id":"sha256:9603d9f8d88be861007d048b75695f76a95e6e8fd312e033283f822927ff544d","target":"graph","created_at":"2026-07-05T10:12:10Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2502.06662/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Recent high-profile incidents in open-source software have greatly raised practitioner attention on software supply chain attacks. To guard against potential malicious package updates, security practitioners advocate pinning dependency to specific versions rather than floating in version ranges. However, it remains controversial whether pinning carries a meaningful security benefit that outweighs the cost of maintaining outdated and possibly vulnerable dependencies. In this paper, we quantify, through counterfactual analysis and simulations, the security and maintenance impact of version const","authors_text":"Bogdan Vasilescu, Christian K\\\"astner, Hao He","cross_cats":["cs.CR"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2502.06662","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:037802447b0dc51a29c67928f93d2d374a6541a202f2d8d04c5b78129cf3d865","target":"record","created_at":"2026-07-05T10:12:10Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"b2dd4b2331124b2d5c4a15be11e221e44c9674cbd136bbe0abbc261475677083","cross_cats_sorted":["cs.CR"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2025-02-10T16:50:48Z","title_canon_sha256":"437be73031b209dc281072eddef0b5cfb7e9f843b02f067a75e4e514af43c85f"},"schema_version":"1.0","source":{"id":"2502.06662","kind":"arxiv","version":1}},"canonical_sha256":"f472748fe33ad3fcf9e076179ed81ef6de7aba4d8008697f757fb4479c5bad63","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"f472748fe33ad3fcf9e076179ed81ef6de7aba4d8008697f757fb4479c5bad63","first_computed_at":"2026-07-05T10:12:10.228369Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T10:12:10.228369Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"YzjHrVP1gI9EABT2bkMi6kiO+5L0JoN90qr6cF68JWAyPNPH3rw6rkrm4WXt1wG7WoCDtKs7Xk+T5HtXne4dCA==","signature_status":"signed_v1","signed_at":"2026-07-05T10:12:10.228776Z","signed_message":"canonical_sha256_bytes"},"source_id":"2502.06662","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:037802447b0dc51a29c67928f93d2d374a6541a202f2d8d04c5b78129cf3d865","sha256:9603d9f8d88be861007d048b75695f76a95e6e8fd312e033283f822927ff544d"],"state_sha256":"f5916760334e99e7e15beee995b1c17838c7a05a4f72cb42ffd4b56ea40837e3"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"F7JQfY5c+iE+PoCOXPe3xgMgUjz71Am1CzcXKw1M7iOa9Z8zDozQ2W34quT2DKH1CfUn3m7jh41qLet/CoxRDw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-03T16:43:32.930284Z","bundle_sha256":"232c0dce427ed933ce334242c4e17744daf44996695bf3f2e6cf2c46f02f8bb5"}}