{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2019:ALPDHXS23JXQJNQ27TPU5V5SAW","short_pith_number":"pith:ALPDHXS2","canonical_record":{"source":{"id":"1907.03407","kind":"arxiv","version":5},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2019-07-08T05:22:47Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"b4185d8ead5868a57c53eda8cc75b795bf427694097c296178f6f80b63116831","abstract_canon_sha256":"98815fbe7bd12cc5d12571fb9386a9c71fb2d0df92bfde1fddef1bef814209dd"},"schema_version":"1.0"},"canonical_sha256":"02de33de5ada6f04b61afcdf4ed7b2058a14586e25c37c88e1f6319edba74c6d","source":{"kind":"arxiv","id":"1907.03407","version":5},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1907.03407","created_at":"2026-07-05T02:51:35Z"},{"alias_kind":"arxiv_version","alias_value":"1907.03407v5","created_at":"2026-07-05T02:51:35Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1907.03407","created_at":"2026-07-05T02:51:35Z"},{"alias_kind":"pith_short_12","alias_value":"ALPDHXS23JXQ","created_at":"2026-07-05T02:51:35Z"},{"alias_kind":"pith_short_16","alias_value":"ALPDHXS23JXQJNQ2","created_at":"2026-07-05T02:51:35Z"},{"alias_kind":"pith_short_8","alias_value":"ALPDHXS2","created_at":"2026-07-05T02:51:35Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2019:ALPDHXS23JXQJNQ27TPU5V5SAW","target":"record","payload":{"canonical_record":{"source":{"id":"1907.03407","kind":"arxiv","version":5},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2019-07-08T05:22:47Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"b4185d8ead5868a57c53eda8cc75b795bf427694097c296178f6f80b63116831","abstract_canon_sha256":"98815fbe7bd12cc5d12571fb9386a9c71fb2d0df92bfde1fddef1bef814209dd"},"schema_version":"1.0"},"canonical_sha256":"02de33de5ada6f04b61afcdf4ed7b2058a14586e25c37c88e1f6319edba74c6d","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T02:51:35.257820Z","signature_b64":"1J2GCMw1yDFI69FVtJEqENM894GbZLotKF4y7sggvLpymCNnfSPTIePaXaY0FSqQyOHmjGCfDA7evqAT1/oEAQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"02de33de5ada6f04b61afcdf4ed7b2058a14586e25c37c88e1f6319edba74c6d","last_reissued_at":"2026-07-05T02:51:35.257364Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T02:51:35.257364Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"1907.03407","source_version":5,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T02:51:35Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"GHN6M7qYFVhcv1Pew9PxYB6RsUonHFu2RKjGsHay4m/RUrwnFTSv7+BDDcqA/Qg2GF5nHyLwdFTjBSxDsVoZDA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-06T20:59:46.047348Z"},"content_sha256":"529a884f04395d8061698867bfd4b1791d37bfe7cded1cc15b71d6d08747d2d2","schema_version":"1.0","event_id":"sha256:529a884f04395d8061698867bfd4b1791d37bfe7cded1cc15b71d6d08747d2d2"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2019:ALPDHXS23JXQJNQ27TPU5V5SAW","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Lags in the Release, Adoption, and Propagation of npm Vulnerability Fixes","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.CR"],"primary_cat":"cs.SE","authors_text":"Akinori Ihara, Bodin Chinthanet, Kenichi Matsumoto, Raula Gaikovina Kula, Shane McIntosh, Takashi Ishio","submitted_at":"2019-07-08T05:22:47Z","abstract_excerpt":"Security vulnerability in third-party dependencies is a growing concern not only for developers of the affected software, but for the risks it poses to an entire software ecosystem, e.g., Heartbleed vulnerability. Recent studies show that developers are slow to respond to the threat of vulnerability, sometimes taking four to eleven months to act. To ensure quick adoption and propagation of a release that contains the fix (fixing release), we conduct an empirical investigation to identify lags that may occur between the vulnerable release and its fixing release (package-side fixing release). Th"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1907.03407","kind":"arxiv","version":5},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/1907.03407/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T02:51:35Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"fLwbvAc9LZIsQ5C1lFQo2wwPxi+z1/fQ310l2LrSrNxUkxuXnt6FwOY89fsttQiwr4HxhQ3iUBcIaGMB54O7Dw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-06T20:59:46.047726Z"},"content_sha256":"61b2c42a1b5639e974c4e98bbbb0f37a8842984f78c833370dddda3e624bb389","schema_version":"1.0","event_id":"sha256:61b2c42a1b5639e974c4e98bbbb0f37a8842984f78c833370dddda3e624bb389"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/ALPDHXS23JXQJNQ27TPU5V5SAW/bundle.json","state_url":"https://pith.science/pith/ALPDHXS23JXQJNQ27TPU5V5SAW/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/ALPDHXS23JXQJNQ27TPU5V5SAW/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-06T20:59:46Z","links":{"resolver":"https://pith.science/pith/ALPDHXS23JXQJNQ27TPU5V5SAW","bundle":"https://pith.science/pith/ALPDHXS23JXQJNQ27TPU5V5SAW/bundle.json","state":"https://pith.science/pith/ALPDHXS23JXQJNQ27TPU5V5SAW/state.json","well_known_bundle":"https://pith.science/.well-known/pith/ALPDHXS23JXQJNQ27TPU5V5SAW/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2019:ALPDHXS23JXQJNQ27TPU5V5SAW","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"98815fbe7bd12cc5d12571fb9386a9c71fb2d0df92bfde1fddef1bef814209dd","cross_cats_sorted":["cs.CR"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2019-07-08T05:22:47Z","title_canon_sha256":"b4185d8ead5868a57c53eda8cc75b795bf427694097c296178f6f80b63116831"},"schema_version":"1.0","source":{"id":"1907.03407","kind":"arxiv","version":5}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1907.03407","created_at":"2026-07-05T02:51:35Z"},{"alias_kind":"arxiv_version","alias_value":"1907.03407v5","created_at":"2026-07-05T02:51:35Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1907.03407","created_at":"2026-07-05T02:51:35Z"},{"alias_kind":"pith_short_12","alias_value":"ALPDHXS23JXQ","created_at":"2026-07-05T02:51:35Z"},{"alias_kind":"pith_short_16","alias_value":"ALPDHXS23JXQJNQ2","created_at":"2026-07-05T02:51:35Z"},{"alias_kind":"pith_short_8","alias_value":"ALPDHXS2","created_at":"2026-07-05T02:51:35Z"}],"graph_snapshots":[{"event_id":"sha256:61b2c42a1b5639e974c4e98bbbb0f37a8842984f78c833370dddda3e624bb389","target":"graph","created_at":"2026-07-05T02:51:35Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/1907.03407/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Security vulnerability in third-party dependencies is a growing concern not only for developers of the affected software, but for the risks it poses to an entire software ecosystem, e.g., Heartbleed vulnerability. Recent studies show that developers are slow to respond to the threat of vulnerability, sometimes taking four to eleven months to act. To ensure quick adoption and propagation of a release that contains the fix (fixing release), we conduct an empirical investigation to identify lags that may occur between the vulnerable release and its fixing release (package-side fixing release). Th","authors_text":"Akinori Ihara, Bodin Chinthanet, Kenichi Matsumoto, Raula Gaikovina Kula, Shane McIntosh, Takashi Ishio","cross_cats":["cs.CR"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2019-07-08T05:22:47Z","title":"Lags in the Release, Adoption, and Propagation of npm Vulnerability Fixes"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1907.03407","kind":"arxiv","version":5},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:529a884f04395d8061698867bfd4b1791d37bfe7cded1cc15b71d6d08747d2d2","target":"record","created_at":"2026-07-05T02:51:35Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"98815fbe7bd12cc5d12571fb9386a9c71fb2d0df92bfde1fddef1bef814209dd","cross_cats_sorted":["cs.CR"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2019-07-08T05:22:47Z","title_canon_sha256":"b4185d8ead5868a57c53eda8cc75b795bf427694097c296178f6f80b63116831"},"schema_version":"1.0","source":{"id":"1907.03407","kind":"arxiv","version":5}},"canonical_sha256":"02de33de5ada6f04b61afcdf4ed7b2058a14586e25c37c88e1f6319edba74c6d","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"02de33de5ada6f04b61afcdf4ed7b2058a14586e25c37c88e1f6319edba74c6d","first_computed_at":"2026-07-05T02:51:35.257364Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T02:51:35.257364Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"1J2GCMw1yDFI69FVtJEqENM894GbZLotKF4y7sggvLpymCNnfSPTIePaXaY0FSqQyOHmjGCfDA7evqAT1/oEAQ==","signature_status":"signed_v1","signed_at":"2026-07-05T02:51:35.257820Z","signed_message":"canonical_sha256_bytes"},"source_id":"1907.03407","source_kind":"arxiv","source_version":5}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:529a884f04395d8061698867bfd4b1791d37bfe7cded1cc15b71d6d08747d2d2","sha256:61b2c42a1b5639e974c4e98bbbb0f37a8842984f78c833370dddda3e624bb389"],"state_sha256":"e6b7c746294c220c61551115109c70fecc6d223a351223c710c1ad4c466a6ba9"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"be5qlK7i0AEqyifx5z9KJUKv4A7EUKCuywTCNBt50A1E+HWM7cHj/x+E7MPgjnnuEKI3T6T8WkmGK01DB8duAg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-06T20:59:46.049719Z","bundle_sha256":"503089e86b1c9a3bfbfa16e4fbe90d99e8a87fb231227e7e157a89e5c748579e"}}