{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:APSTBXSWJJQZWIW2DCARG43IPN","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"e666b65d5290f95efbd8683bfe13d6a82c4a3cbd416466eca180ab3fbe221ef5","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2025-03-28T04:16:46Z","title_canon_sha256":"f32d0df3555a844dfd062477608928fb1e59332d7b36b665408ebfe5d6d97359"},"schema_version":"1.0","source":{"id":"2503.22134","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2503.22134","created_at":"2026-07-05T10:40:48Z"},{"alias_kind":"arxiv_version","alias_value":"2503.22134v1","created_at":"2026-07-05T10:40:48Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2503.22134","created_at":"2026-07-05T10:40:48Z"},{"alias_kind":"pith_short_12","alias_value":"APSTBXSWJJQZ","created_at":"2026-07-05T10:40:48Z"},{"alias_kind":"pith_short_16","alias_value":"APSTBXSWJJQZWIW2","created_at":"2026-07-05T10:40:48Z"},{"alias_kind":"pith_short_8","alias_value":"APSTBXSW","created_at":"2026-07-05T10:40:48Z"}],"graph_snapshots":[{"event_id":"sha256:a934f88818dfaf0ab8318514e0b02e5ece45787975a72010abfe40e32a1155f2","target":"graph","created_at":"2026-07-05T10:40:48Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2503.22134/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"This study investigates vulnerabilities within the Maven ecosystem by analyzing a comprehensive dataset of 14,459,139 releases. Our analysis reveals the most critical weaknesses that pose significant threats to developers and their projects as they look to streamline their development tasks through code reuse. We show risky weaknesses, those unique to Maven, and emphasize those becoming increasingly dangerous over time. Furthermore, we reveal how vulnerabilities subtly propagate, impacting 31.39% of the 635,003 latest releases through direct dependencies and 62.89% through transitive dependenc","authors_text":"Asif Kamal Turzo, Costain Nachuma, Md Mosharaf Hossan, Minhaz F. Zibran","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2025-03-28T04:16:46Z","title":"Decoding Dependency Risks: A Quantitative Study of Vulnerabilities in the Maven Ecosystem"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2503.22134","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:a94c1bf8503764a2dc17ac30b7a7618f29c089e87fd3515b551d8d786b869dbd","target":"record","created_at":"2026-07-05T10:40:48Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"e666b65d5290f95efbd8683bfe13d6a82c4a3cbd416466eca180ab3fbe221ef5","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2025-03-28T04:16:46Z","title_canon_sha256":"f32d0df3555a844dfd062477608928fb1e59332d7b36b665408ebfe5d6d97359"},"schema_version":"1.0","source":{"id":"2503.22134","kind":"arxiv","version":1}},"canonical_sha256":"03e530de564a619b22da18811373687b4cb7cc0f970ef7cba051317833a44bdb","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"03e530de564a619b22da18811373687b4cb7cc0f970ef7cba051317833a44bdb","first_computed_at":"2026-07-05T10:40:48.130908Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T10:40:48.130908Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"xW/m2BN+IHBTRUk2slgaeYJ0XWwgYbILScs3w9Ly9Qk1mDXREXVSfU3K5eJEdIVdQVA5z62hiBlPltE+icmcCg==","signature_status":"signed_v1","signed_at":"2026-07-05T10:40:48.131301Z","signed_message":"canonical_sha256_bytes"},"source_id":"2503.22134","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:a94c1bf8503764a2dc17ac30b7a7618f29c089e87fd3515b551d8d786b869dbd","sha256:a934f88818dfaf0ab8318514e0b02e5ece45787975a72010abfe40e32a1155f2"],"state_sha256":"02f9afbf454e09cf6436ead88b673b649a2e6e193a9626d3906d3f6e816d9c2a"}