{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:N4V3AZDHI6VIDCTTVSDHOMQ5UI","short_pith_number":"pith:N4V3AZDH","canonical_record":{"source":{"id":"2502.04621","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2025-02-07T02:43:35Z","cross_cats_sorted":[],"title_canon_sha256":"d95d8e072eb933577116aec71fc9164f99043ff5d5e4588e25820bccfb6a8dd9","abstract_canon_sha256":"749a71e9cf288a5cd062bab2ea51f8907e806b4fc6986ea430109457eb400b84"},"schema_version":"1.0"},"canonical_sha256":"6f2bb0646747aa818a73ac8677321da237ac97eab78ffb4234326348a7581108","source":{"kind":"arxiv","id":"2502.04621","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2502.04621","created_at":"2026-07-05T10:14:50Z"},{"alias_kind":"arxiv_version","alias_value":"2502.04621v2","created_at":"2026-07-05T10:14:50Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2502.04621","created_at":"2026-07-05T10:14:50Z"},{"alias_kind":"pith_short_12","alias_value":"N4V3AZDHI6VI","created_at":"2026-07-05T10:14:50Z"},{"alias_kind":"pith_short_16","alias_value":"N4V3AZDHI6VIDCTT","created_at":"2026-07-05T10:14:50Z"},{"alias_kind":"pith_short_8","alias_value":"N4V3AZDH","created_at":"2026-07-05T10:14:50Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:N4V3AZDHI6VIDCTTVSDHOMQ5UI","target":"record","payload":{"canonical_record":{"source":{"id":"2502.04621","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2025-02-07T02:43:35Z","cross_cats_sorted":[],"title_canon_sha256":"d95d8e072eb933577116aec71fc9164f99043ff5d5e4588e25820bccfb6a8dd9","abstract_canon_sha256":"749a71e9cf288a5cd062bab2ea51f8907e806b4fc6986ea430109457eb400b84"},"schema_version":"1.0"},"canonical_sha256":"6f2bb0646747aa818a73ac8677321da237ac97eab78ffb4234326348a7581108","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T10:14:50.601128Z","signature_b64":"dFgdg28rBAWTgkjhWUpW0mgLa0C5fjDWSbJeJfEOira97mQ5LZuuSUAoAVpbkMjmgn83ZaFXtmcKMFi/9gyCDg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"6f2bb0646747aa818a73ac8677321da237ac97eab78ffb4234326348a7581108","last_reissued_at":"2026-07-05T10:14:50.600594Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T10:14:50.600594Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2502.04621","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:14:50Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"hN+MLHDExTXNj51wC2g+njO40SqaLINAk4VP0V1ceZ2MvIb5JKBl6uT1FdFaCB6mSHMskv4pyzQMrwISiMbOCw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-10T17:58:07.505703Z"},"content_sha256":"8ac37f736f413afd6bbf6b3fee39edb71bd37460a79350daaa57ef13256e5d3c","schema_version":"1.0","event_id":"sha256:8ac37f736f413afd6bbf6b3fee39edb71bd37460a79350daaa57ef13256e5d3c"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:N4V3AZDHI6VIDCTTVSDHOMQ5UI","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Tracing Vulnerabilities in Maven: A Study of CVE lifecycles and Dependency Networks","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.SE","authors_text":"Ahmad Abdellatif, Corey Yang-Smith","submitted_at":"2025-02-07T02:43:35Z","abstract_excerpt":"Software ecosystems rely on centralized package registries, such as Maven, to enable code reuse and collaboration. However, the interconnected nature of these ecosystems amplifies the risks posed by security vulnerabilities in direct and transitive dependencies. While numerous studies have examined vulnerabilities in Maven and other ecosystems, there remains a gap in understanding the behavior of vulnerabilities across parent and dependent packages, and the response times of maintainers in addressing vulnerabilities. This study analyzes the lifecycle of 3,362 CVEs in Maven to uncover patterns "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2502.04621","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2502.04621/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:14:50Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"BTSHfA0oqmiiuEvVEHWg+SsPZq1S1mo/ZgRukJtm914ikLlVw7FI8EsBbYcojID4u9RxkYJcApg/XJfmgKgcDA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-10T17:58:07.506918Z"},"content_sha256":"bb87f101f2cd0836d803064bc9ed3ab7f526af3d8bd6a7ee50a7f2e6125988b0","schema_version":"1.0","event_id":"sha256:bb87f101f2cd0836d803064bc9ed3ab7f526af3d8bd6a7ee50a7f2e6125988b0"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/N4V3AZDHI6VIDCTTVSDHOMQ5UI/bundle.json","state_url":"https://pith.science/pith/N4V3AZDHI6VIDCTTVSDHOMQ5UI/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/N4V3AZDHI6VIDCTTVSDHOMQ5UI/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-10T17:58:07Z","links":{"resolver":"https://pith.science/pith/N4V3AZDHI6VIDCTTVSDHOMQ5UI","bundle":"https://pith.science/pith/N4V3AZDHI6VIDCTTVSDHOMQ5UI/bundle.json","state":"https://pith.science/pith/N4V3AZDHI6VIDCTTVSDHOMQ5UI/state.json","well_known_bundle":"https://pith.science/.well-known/pith/N4V3AZDHI6VIDCTTVSDHOMQ5UI/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:N4V3AZDHI6VIDCTTVSDHOMQ5UI","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"749a71e9cf288a5cd062bab2ea51f8907e806b4fc6986ea430109457eb400b84","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2025-02-07T02:43:35Z","title_canon_sha256":"d95d8e072eb933577116aec71fc9164f99043ff5d5e4588e25820bccfb6a8dd9"},"schema_version":"1.0","source":{"id":"2502.04621","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2502.04621","created_at":"2026-07-05T10:14:50Z"},{"alias_kind":"arxiv_version","alias_value":"2502.04621v2","created_at":"2026-07-05T10:14:50Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2502.04621","created_at":"2026-07-05T10:14:50Z"},{"alias_kind":"pith_short_12","alias_value":"N4V3AZDHI6VI","created_at":"2026-07-05T10:14:50Z"},{"alias_kind":"pith_short_16","alias_value":"N4V3AZDHI6VIDCTT","created_at":"2026-07-05T10:14:50Z"},{"alias_kind":"pith_short_8","alias_value":"N4V3AZDH","created_at":"2026-07-05T10:14:50Z"}],"graph_snapshots":[{"event_id":"sha256:bb87f101f2cd0836d803064bc9ed3ab7f526af3d8bd6a7ee50a7f2e6125988b0","target":"graph","created_at":"2026-07-05T10:14:50Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2502.04621/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Software ecosystems rely on centralized package registries, such as Maven, to enable code reuse and collaboration. However, the interconnected nature of these ecosystems amplifies the risks posed by security vulnerabilities in direct and transitive dependencies. While numerous studies have examined vulnerabilities in Maven and other ecosystems, there remains a gap in understanding the behavior of vulnerabilities across parent and dependent packages, and the response times of maintainers in addressing vulnerabilities. This study analyzes the lifecycle of 3,362 CVEs in Maven to uncover patterns ","authors_text":"Ahmad Abdellatif, Corey Yang-Smith","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2025-02-07T02:43:35Z","title":"Tracing Vulnerabilities in Maven: A Study of CVE lifecycles and Dependency Networks"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2502.04621","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:8ac37f736f413afd6bbf6b3fee39edb71bd37460a79350daaa57ef13256e5d3c","target":"record","created_at":"2026-07-05T10:14:50Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"749a71e9cf288a5cd062bab2ea51f8907e806b4fc6986ea430109457eb400b84","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2025-02-07T02:43:35Z","title_canon_sha256":"d95d8e072eb933577116aec71fc9164f99043ff5d5e4588e25820bccfb6a8dd9"},"schema_version":"1.0","source":{"id":"2502.04621","kind":"arxiv","version":2}},"canonical_sha256":"6f2bb0646747aa818a73ac8677321da237ac97eab78ffb4234326348a7581108","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"6f2bb0646747aa818a73ac8677321da237ac97eab78ffb4234326348a7581108","first_computed_at":"2026-07-05T10:14:50.600594Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T10:14:50.600594Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"dFgdg28rBAWTgkjhWUpW0mgLa0C5fjDWSbJeJfEOira97mQ5LZuuSUAoAVpbkMjmgn83ZaFXtmcKMFi/9gyCDg==","signature_status":"signed_v1","signed_at":"2026-07-05T10:14:50.601128Z","signed_message":"canonical_sha256_bytes"},"source_id":"2502.04621","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:8ac37f736f413afd6bbf6b3fee39edb71bd37460a79350daaa57ef13256e5d3c","sha256:bb87f101f2cd0836d803064bc9ed3ab7f526af3d8bd6a7ee50a7f2e6125988b0"],"state_sha256":"bff91a5ac55f8d74977f3295776f58b5ee5be56cc0f44dea2611d40cd5173056"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Qcj2gP5yvOUH/GPyu3ZJEk9n6KPluwFzLYv8VOY02hTNOs33525wFEUiuvR38mSbjZIsIiYFhTN0JnUNl+PbDw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-10T17:58:07.515270Z","bundle_sha256":"4c7d66f07a53462cde504fc7c8ad8b1db481f430c39212b422c269425f8e0dff"}}