{"record_type":"pith_number_record","schema_url":"https://pith.science/schemas/pith-number/v1.json","pith_number":"pith:2025:7XFNJUYWFL573D5LLRYDKK5CDO","short_pith_number":"pith:7XFNJUYW","schema_version":"1.0","canonical_sha256":"fdcad4d3162afbfd8fab5c70352ba21ba9bd22b4067b448a8affd0ba04b9def9","source":{"kind":"arxiv","id":"2504.03167","version":1},"attestation_state":"computed","paper":{"title":"Do Developers Depend on Deprecated Library Versions? A Mining Study of Log4j","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.SE","authors_text":"Haruhiko Yoshioka, Kazumasa Shimari, Kenichi Matsumoto, Masayuki Inaba, Raula Gaikovina Kula, Sila Lertbanjongngam, Takashi Nakano, Youmei Fan","submitted_at":"2025-04-04T04:49:36Z","abstract_excerpt":"Log4j has become a widely adopted logging library for Java programs due to its long history and high reliability. Its widespread use is notable not only because of its maturity but also due to the complexity and depth of its features, which have made it an essential tool for many developers. However, Log4j 1.x, which reached its end of support (deprecated), poses significant security risks and has numerous deprecated features that can be exploited by attackers. Despite this, some clients may still rely on this library. We aim to understand whether clients are still using Log4j 1.x despite its "},"verification_status":{"content_addressed":true,"pith_receipt":true,"author_attested":false,"weak_author_claims":0,"strong_author_claims":0,"externally_anchored":false,"storage_verified":false,"citation_signatures":0,"replication_records":0,"graph_snapshot":true,"references_resolved":false,"formal_links_present":false},"canonical_record":{"source":{"id":"2504.03167","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2025-04-04T04:49:36Z","cross_cats_sorted":[],"title_canon_sha256":"d14dd490bd285a42688ebff9c797ea5d6b463eccb4a46654cd69f74e8b696e07","abstract_canon_sha256":"3adc0f19b6322fc9e96d3dea839c125f8bed9d1bb7e26628a5fc913639e9abab"},"schema_version":"1.0"},"receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T10:44:27.473972Z","signature_b64":"dJ1IcniTpM36dCxSqO3GJYu+6Q+E1Eegj5k7hzoy8IvZu4RJK6vRMGQXVVIZl6Wy44eVukPE7pF2ymQWWY5vCA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"fdcad4d3162afbfd8fab5c70352ba21ba9bd22b4067b448a8affd0ba04b9def9","last_reissued_at":"2026-07-05T10:44:27.473501Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T10:44:27.473501Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"graph_snapshot":{"paper":{"title":"Do Developers Depend on Deprecated Library Versions? A Mining Study of Log4j","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.SE","authors_text":"Haruhiko Yoshioka, Kazumasa Shimari, Kenichi Matsumoto, Masayuki Inaba, Raula Gaikovina Kula, Sila Lertbanjongngam, Takashi Nakano, Youmei Fan","submitted_at":"2025-04-04T04:49:36Z","abstract_excerpt":"Log4j has become a widely adopted logging library for Java programs due to its long history and high reliability. Its widespread use is notable not only because of its maturity but also due to the complexity and depth of its features, which have made it an essential tool for many developers. However, Log4j 1.x, which reached its end of support (deprecated), poses significant security risks and has numerous deprecated features that can be exploited by attackers. Despite this, some clients may still rely on this library. We aim to understand whether clients are still using Log4j 1.x despite its "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2504.03167","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2504.03167/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"aliases":[{"alias_kind":"arxiv","alias_value":"2504.03167","created_at":"2026-07-05T10:44:27.473557+00:00"},{"alias_kind":"arxiv_version","alias_value":"2504.03167v1","created_at":"2026-07-05T10:44:27.473557+00:00"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2504.03167","created_at":"2026-07-05T10:44:27.473557+00:00"},{"alias_kind":"pith_short_12","alias_value":"7XFNJUYWFL57","created_at":"2026-07-05T10:44:27.473557+00:00"},{"alias_kind":"pith_short_16","alias_value":"7XFNJUYWFL573D5L","created_at":"2026-07-05T10:44:27.473557+00:00"},{"alias_kind":"pith_short_8","alias_value":"7XFNJUYW","created_at":"2026-07-05T10:44:27.473557+00:00"}],"events":[],"event_summary":{},"paper_claims":[],"inbound_citations":{"count":0,"internal_anchor_count":0,"sample":[]},"formal_canon":{"evidence_count":0,"sample":[],"anchors":[]},"links":{"html":"https://pith.science/pith/7XFNJUYWFL573D5LLRYDKK5CDO","json":"https://pith.science/pith/7XFNJUYWFL573D5LLRYDKK5CDO.json","graph_json":"https://pith.science/api/pith-number/7XFNJUYWFL573D5LLRYDKK5CDO/graph.json","events_json":"https://pith.science/api/pith-number/7XFNJUYWFL573D5LLRYDKK5CDO/events.json","paper":"https://pith.science/paper/7XFNJUYW"},"agent_actions":{"view_html":"https://pith.science/pith/7XFNJUYWFL573D5LLRYDKK5CDO","download_json":"https://pith.science/pith/7XFNJUYWFL573D5LLRYDKK5CDO.json","view_paper":"https://pith.science/paper/7XFNJUYW","resolve_alias":"https://pith.science/api/pith-number/resolve?arxiv=2504.03167&json=true","fetch_graph":"https://pith.science/api/pith-number/7XFNJUYWFL573D5LLRYDKK5CDO/graph.json","fetch_events":"https://pith.science/api/pith-number/7XFNJUYWFL573D5LLRYDKK5CDO/events.json","actions":{"anchor_timestamp":"https://pith.science/pith/7XFNJUYWFL573D5LLRYDKK5CDO/action/timestamp_anchor","attest_storage":"https://pith.science/pith/7XFNJUYWFL573D5LLRYDKK5CDO/action/storage_attestation","attest_author":"https://pith.science/pith/7XFNJUYWFL573D5LLRYDKK5CDO/action/author_attestation","sign_citation":"https://pith.science/pith/7XFNJUYWFL573D5LLRYDKK5CDO/action/citation_signature","submit_replication":"https://pith.science/pith/7XFNJUYWFL573D5LLRYDKK5CDO/action/replication_record"}},"created_at":"2026-07-05T10:44:27.473557+00:00","updated_at":"2026-07-05T10:44:27.473557+00:00"}