{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2024:YAJFCWU7EANVUMBRDBTOJ5CRRO","short_pith_number":"pith:YAJFCWU7","canonical_record":{"source":{"id":"2405.09074","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.SE","submitted_at":"2024-05-15T03:57:27Z","cross_cats_sorted":[],"title_canon_sha256":"6892715d72cd8308b288caf532e9090925f1c9c15a3d88e0ec5acff3000a37ee","abstract_canon_sha256":"220333966607dc9ff3b8cec4d5210ce48da1d0ccede51481e3d5612961798e31"},"schema_version":"1.0"},"canonical_sha256":"c012515a9f201b5a30311866e4f4518bb3c0506bff7f01beb81c0e3bc2ea1e3a","source":{"kind":"arxiv","id":"2405.09074","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2405.09074","created_at":"2026-07-05T08:19:13Z"},{"alias_kind":"arxiv_version","alias_value":"2405.09074v1","created_at":"2026-07-05T08:19:13Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2405.09074","created_at":"2026-07-05T08:19:13Z"},{"alias_kind":"pith_short_12","alias_value":"YAJFCWU7EANV","created_at":"2026-07-05T08:19:13Z"},{"alias_kind":"pith_short_16","alias_value":"YAJFCWU7EANVUMBR","created_at":"2026-07-05T08:19:13Z"},{"alias_kind":"pith_short_8","alias_value":"YAJFCWU7","created_at":"2026-07-05T08:19:13Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2024:YAJFCWU7EANVUMBRDBTOJ5CRRO","target":"record","payload":{"canonical_record":{"source":{"id":"2405.09074","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.SE","submitted_at":"2024-05-15T03:57:27Z","cross_cats_sorted":[],"title_canon_sha256":"6892715d72cd8308b288caf532e9090925f1c9c15a3d88e0ec5acff3000a37ee","abstract_canon_sha256":"220333966607dc9ff3b8cec4d5210ce48da1d0ccede51481e3d5612961798e31"},"schema_version":"1.0"},"canonical_sha256":"c012515a9f201b5a30311866e4f4518bb3c0506bff7f01beb81c0e3bc2ea1e3a","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T08:19:13.005511Z","signature_b64":"ufGEDZh8A8vjTOeYvRiTkpvKP5uRJe+qYIE2XrzgoEXL4BnQftfjq/1ygdiYHuVAyqyH5vNWVAlEse0Fj2bpAQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"c012515a9f201b5a30311866e4f4518bb3c0506bff7f01beb81c0e3bc2ea1e3a","last_reissued_at":"2026-07-05T08:19:13.004182Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T08:19:13.004182Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2405.09074","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T08:19:13Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"fLyY55mg3Hqv3bo+gALYITo7IV9Mn7Pr/IGj/va1yJ4xoKkweLeV8ndfRGbZvmeFRf0VI8Bf6s2bH5wnrF5HDA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-07T08:23:15.826990Z"},"content_sha256":"1b46023f60d8bccd9caae7f6208f58855741c2f1a005bf3ad623343f3e22f727","schema_version":"1.0","event_id":"sha256:1b46023f60d8bccd9caae7f6208f58855741c2f1a005bf3ad623343f3e22f727"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2024:YAJFCWU7EANVUMBRDBTOJ5CRRO","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"See to Believe: Using Visualization To Motivate Updating Third-party Dependencies","license":"http://creativecommons.org/licenses/by-sa/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.SE","authors_text":"Chaiyong Ragkhitwetsagul, Klinton Chhun, Morakot Choetkiertikul, Raula Gaikovina Kula, Thanwadee Sunetnanta, Vipawan Jarukitpipat, Wachirayana Wanprasert","submitted_at":"2024-05-15T03:57:27Z","abstract_excerpt":"Security vulnerabilities introduced by applications using third-party dependencies are on the increase, caused by the emergence of large ecosystems of libraries such as the NPM packages for JavaScript. Nowadays, libraries depend on each other. Relying on these large ecosystems thus means that vulnerable dependencies are not only direct but also indirect (transitive) dependencies. There are automated tool supports to manage these complex dependencies but recent work still shows that developers are wary of library updates, even to fix vulnerabilities, citing that being unaware, or that the migra"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2405.09074","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2405.09074/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T08:19:13Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"nsnx8NZ6IqI2wamXVEED7KGQqZbsB0Y4wdVZf3JfcL0siaVmQB8uxHVFovZt178Ooszsw4gkgOZM3OESufxzBg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-07T08:23:15.827372Z"},"content_sha256":"fc2dd3b770b03c56707844fab4ee6ef9fe40adbc748a13f199dd08cc3a5f36b9","schema_version":"1.0","event_id":"sha256:fc2dd3b770b03c56707844fab4ee6ef9fe40adbc748a13f199dd08cc3a5f36b9"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/YAJFCWU7EANVUMBRDBTOJ5CRRO/bundle.json","state_url":"https://pith.science/pith/YAJFCWU7EANVUMBRDBTOJ5CRRO/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/YAJFCWU7EANVUMBRDBTOJ5CRRO/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-07T08:23:15Z","links":{"resolver":"https://pith.science/pith/YAJFCWU7EANVUMBRDBTOJ5CRRO","bundle":"https://pith.science/pith/YAJFCWU7EANVUMBRDBTOJ5CRRO/bundle.json","state":"https://pith.science/pith/YAJFCWU7EANVUMBRDBTOJ5CRRO/state.json","well_known_bundle":"https://pith.science/.well-known/pith/YAJFCWU7EANVUMBRDBTOJ5CRRO/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:YAJFCWU7EANVUMBRDBTOJ5CRRO","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"220333966607dc9ff3b8cec4d5210ce48da1d0ccede51481e3d5612961798e31","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.SE","submitted_at":"2024-05-15T03:57:27Z","title_canon_sha256":"6892715d72cd8308b288caf532e9090925f1c9c15a3d88e0ec5acff3000a37ee"},"schema_version":"1.0","source":{"id":"2405.09074","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2405.09074","created_at":"2026-07-05T08:19:13Z"},{"alias_kind":"arxiv_version","alias_value":"2405.09074v1","created_at":"2026-07-05T08:19:13Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2405.09074","created_at":"2026-07-05T08:19:13Z"},{"alias_kind":"pith_short_12","alias_value":"YAJFCWU7EANV","created_at":"2026-07-05T08:19:13Z"},{"alias_kind":"pith_short_16","alias_value":"YAJFCWU7EANVUMBR","created_at":"2026-07-05T08:19:13Z"},{"alias_kind":"pith_short_8","alias_value":"YAJFCWU7","created_at":"2026-07-05T08:19:13Z"}],"graph_snapshots":[{"event_id":"sha256:fc2dd3b770b03c56707844fab4ee6ef9fe40adbc748a13f199dd08cc3a5f36b9","target":"graph","created_at":"2026-07-05T08:19:13Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2405.09074/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Security vulnerabilities introduced by applications using third-party dependencies are on the increase, caused by the emergence of large ecosystems of libraries such as the NPM packages for JavaScript. Nowadays, libraries depend on each other. Relying on these large ecosystems thus means that vulnerable dependencies are not only direct but also indirect (transitive) dependencies. There are automated tool supports to manage these complex dependencies but recent work still shows that developers are wary of library updates, even to fix vulnerabilities, citing that being unaware, or that the migra","authors_text":"Chaiyong Ragkhitwetsagul, Klinton Chhun, Morakot Choetkiertikul, Raula Gaikovina Kula, Thanwadee Sunetnanta, Vipawan Jarukitpipat, Wachirayana Wanprasert","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.SE","submitted_at":"2024-05-15T03:57:27Z","title":"See to Believe: Using Visualization To Motivate Updating Third-party Dependencies"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2405.09074","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:1b46023f60d8bccd9caae7f6208f58855741c2f1a005bf3ad623343f3e22f727","target":"record","created_at":"2026-07-05T08:19:13Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"220333966607dc9ff3b8cec4d5210ce48da1d0ccede51481e3d5612961798e31","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.SE","submitted_at":"2024-05-15T03:57:27Z","title_canon_sha256":"6892715d72cd8308b288caf532e9090925f1c9c15a3d88e0ec5acff3000a37ee"},"schema_version":"1.0","source":{"id":"2405.09074","kind":"arxiv","version":1}},"canonical_sha256":"c012515a9f201b5a30311866e4f4518bb3c0506bff7f01beb81c0e3bc2ea1e3a","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"c012515a9f201b5a30311866e4f4518bb3c0506bff7f01beb81c0e3bc2ea1e3a","first_computed_at":"2026-07-05T08:19:13.004182Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T08:19:13.004182Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"ufGEDZh8A8vjTOeYvRiTkpvKP5uRJe+qYIE2XrzgoEXL4BnQftfjq/1ygdiYHuVAyqyH5vNWVAlEse0Fj2bpAQ==","signature_status":"signed_v1","signed_at":"2026-07-05T08:19:13.005511Z","signed_message":"canonical_sha256_bytes"},"source_id":"2405.09074","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:1b46023f60d8bccd9caae7f6208f58855741c2f1a005bf3ad623343f3e22f727","sha256:fc2dd3b770b03c56707844fab4ee6ef9fe40adbc748a13f199dd08cc3a5f36b9"],"state_sha256":"6c16c2a339802e1e551b5bb8eaef3919d41b83a057c3c1a0370ad965a91bfa0d"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"UVE8GAzdy/xr2Wj5iDGTvX/4EVuZl5Bgrtb0Zp+lff0rDYl+j1D90Zvut/hKkyIF94XL7dakxEUeEo1Dt6GpAA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-07T08:23:15.829303Z","bundle_sha256":"613a16569943ce14d3f4cbc7cd1902ddbd95e681fed43b2d11e98e367070d12e"}}