{"as_of":"2026-08-10T06:01:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:e194851d29451f0e4eef6c975625ec6b64806f8d57443e0ea955f8ecfb91760a","coverage":[{"denominator":28,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":28,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-02T02:11:24.932094Z","state":"measured"},{"denominator":28,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":28,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-09T06:31:02.800959+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2607.15315/citation-record","integrity":"/paper/2607.15315/integrity","json":"/paper/2607.15315/citation-record.json","paper":"/paper/2607.15315"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T02:11:21.577520Z","title":"https://github.com/advisories","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.15315","last_updated":"2026-07-15T23:02:20Z","snapshot_observed_at":"2026-08-03T06:29:10.407276Z","submitted_at":"2026-07-15T23:02:20Z","title":"CHRONO-RESOLUTION: A Dependency Resolution Dataset at Release Points for npm, PyPI, and crates.io Packages","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-02T02:11:21.577520Z"},"links":{"citing_paper":"/paper/2607.15315"},"observation_digest":"sha256:bf2a7fc2fba2492de9302b79bae24efac0d29a4985a396894dee481a818eb811","observation_id":"f9816f4e-0d4c-4168-9bd6-1c3b89695b4f","resolution":{"observed_at":"2026-08-02T02:11:21.577520Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T02:11:21.651536Z","title":"https://deps.dev/","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.15315","last_updated":"2026-07-15T23:02:20Z","snapshot_observed_at":"2026-08-03T06:29:10.407276Z","submitted_at":"2026-07-15T23:02:20Z","title":"CHRONO-RESOLUTION: A Dependency Resolution Dataset at Release Points for npm, PyPI, and crates.io Packages","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-02T02:11:21.651536Z"},"links":{"citing_paper":"/paper/2607.15315"},"observation_digest":"sha256:c15abdb1eac217e9c9d619f018dcdb90a8d0efae3b3c1c45a993f3c7869d4fc2","observation_id":"6fe8f6c3-b997-4835-bac7-7443ddb006dd","resolution":{"observed_at":"2026-08-02T02:11:21.651536Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T02:11:21.715992Z","title":"https://ecosyste.ms/","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.15315","last_updated":"2026-07-15T23:02:20Z","snapshot_observed_at":"2026-08-03T06:29:10.407276Z","submitted_at":"2026-07-15T23:02:20Z","title":"CHRONO-RESOLUTION: A Dependency Resolution Dataset at Release Points for npm, PyPI, and crates.io Packages","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-02T02:11:21.715992Z"},"links":{"citing_paper":"/paper/2607.15315"},"observation_digest":"sha256:d4705c7cd659b9eb6c3095f25b77a42e1398ab9a6368256dba300f2b200cda58","observation_id":"54e5e677-c799-4cf8-8d73-fe6184305418","resolution":{"observed_at":"2026-08-02T02:11:21.715992Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T02:11:21.798098Z","title":"https: //osv.dev","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.15315","last_updated":"2026-07-15T23:02:20Z","snapshot_observed_at":"2026-08-03T06:29:10.407276Z","submitted_at":"2026-07-15T23:02:20Z","title":"CHRONO-RESOLUTION: A Dependency Resolution Dataset at Release Points for npm, PyPI, and crates.io Packages","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-02T02:11:21.798098Z"},"links":{"citing_paper":"/paper/2607.15315"},"observation_digest":"sha256:9381a1057e5dde397940f29a13c885cf82f5c0979b7831504df56c3be729f1ce","observation_id":"104410da-a5c0-4d23-85a3-b94e817e250d","resolution":{"observed_at":"2026-08-02T02:11:21.798098Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T02:11:21.950664Z","title":"https://semver.org/","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.15315","last_updated":"2026-07-15T23:02:20Z","snapshot_observed_at":"2026-08-03T06:29:10.407276Z","submitted_at":"2026-07-15T23:02:20Z","title":"CHRONO-RESOLUTION: A Dependency Resolution Dataset at Release Points for npm, PyPI, and crates.io Packages","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-02T02:11:21.950664Z"},"links":{"citing_paper":"/paper/2607.15315"},"observation_digest":"sha256:d531e0a6eedd85918b36ab93fd75da49fbc00acc4ca44990779b33d3ea77c161","observation_id":"c7b0f3f6-1001-4cbb-8363-a909060ea642","resolution":{"observed_at":"2026-08-02T02:11:21.950664Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T02:11:22.072894Z","title":"Why do developers use trivial packages? an empirical case study on npm","venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2607.15315","last_updated":"2026-07-15T23:02:20Z","snapshot_observed_at":"2026-08-03T06:29:10.407276Z","submitted_at":"2026-07-15T23:02:20Z","title":"CHRONO-RESOLUTION: A Dependency Resolution Dataset at Release Points for npm, PyPI, and crates.io Packages","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-02T02:11:22.072894Z"},"links":{"citing_paper":"/paper/2607.15315"},"observation_digest":"sha256:a14e45654d2e19a93294be988dc230aa0b43df49d75699b68980cec252a6e839","observation_id":"50dc52f3-5144-4b0f-bab7-2e9cf042a4d0","resolution":{"observed_at":"2026-08-02T02:11:22.072894Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T02:11:22.212441Z","title":"R., RIETVELD, K.,ANDGADYATSKAYA, O","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.15315","last_updated":"2026-07-15T23:02:20Z","snapshot_observed_at":"2026-08-03T06:29:10.407276Z","submitted_at":"2026-07-15T23:02:20Z","title":"CHRONO-RESOLUTION: A Dependency Resolution Dataset at Release Points for npm, PyPI, and crates.io Packages","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-02T02:11:22.212441Z"},"links":{"citing_paper":"/paper/2607.15315"},"observation_digest":"sha256:91d3974985ad079deeac7f32558ed0412e3c764d8d1b4363f3105e1f24e5e666","observation_id":"85500987-fa6c-4629-a2a4-4b8c4cb5259d","resolution":{"observed_at":"2026-08-02T02:11:22.212441Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T02:11:22.374575Z","title":null,"venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2607.15315","last_updated":"2026-07-15T23:02:20Z","snapshot_observed_at":"2026-08-03T06:29:10.407276Z","submitted_at":"2026-07-15T23:02:20Z","title":"CHRONO-RESOLUTION: A Dependency Resolution Dataset at Release Points for npm, PyPI, and crates.io Packages","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-02T02:11:22.374575Z"},"links":{"citing_paper":"/paper/2607.15315"},"observation_digest":"sha256:08379bb9a090696b9fa8aa8c2562c1d9f364b8e669b68d70952e5e14a6ed85b1","observation_id":"9cf7edb0-bbfa-4f9a-97cc-6e81461ff717","resolution":{"observed_at":"2026-08-02T02:11:22.374575Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T02:11:22.531966Z","title":"Measur- ing Dependency Freshness in Software Systems","venue":null,"work_id":null,"year":2015},"citing_paper":{"arxiv_id":"2607.15315","last_updated":"2026-07-15T23:02:20Z","snapshot_observed_at":"2026-08-03T06:29:10.407276Z","submitted_at":"2026-07-15T23:02:20Z","title":"CHRONO-RESOLUTION: A Dependency Resolution Dataset at Release Points for npm, PyPI, and crates.io Packages","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-02T02:11:22.531966Z"},"links":{"citing_paper":"/paper/2607.15315"},"observation_digest":"sha256:9c244d6139ed57990005f4392d401cde2af7dff501bd5ddfbd15cba2ffe816ff","observation_id":"141d1edf-06f2-44a9-b1dd-a3b7d1a34202","resolution":{"observed_at":"2026-08-02T02:11:22.531966Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T02:11:22.646242Z","title":"A.,ANDKHOLOOSI, M","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.15315","last_updated":"2026-07-15T23:02:20Z","snapshot_observed_at":"2026-08-03T06:29:10.407276Z","submitted_at":"2026-07-15T23:02:20Z","title":"CHRONO-RESOLUTION: A Dependency Resolution Dataset at Release Points for npm, PyPI, and crates.io Packages","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-02T02:11:22.646242Z"},"links":{"citing_paper":"/paper/2607.15315"},"observation_digest":"sha256:b07564d2262ab8f006620865c94a537f4e9953f908b1f5792b13cbd64e34d831","observation_id":"a5986b20-b1f6-4668-bb92-8f32c5b20c58","resolution":{"observed_at":"2026-08-02T02:11:22.646242Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T02:11:22.821962Z","title":"OSV: Current data sources","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.15315","last_updated":"2026-07-15T23:02:20Z","snapshot_observed_at":"2026-08-03T06:29:10.407276Z","submitted_at":"2026-07-15T23:02:20Z","title":"CHRONO-RESOLUTION: A Dependency Resolution Dataset at Release Points for npm, PyPI, and crates.io Packages","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-02T02:11:22.821962Z"},"links":{"citing_paper":"/paper/2607.15315"},"observation_digest":"sha256:12a6782132bfdfb7e3683178ad8e2fd86484735c36cb17edecdb5219473fd66e","observation_id":"b701b239-a1ad-4b94-b23e-b21057314dd6","resolution":{"observed_at":"2026-08-02T02:11:22.821962Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.06662","last_updated":"2025-02-10T16:50:48Z","snapshot_observed_at":"2026-08-08T14:42:59.061613Z","submitted_at":"2025-02-10T16:50:48Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.06662","snapshot_observed_at":"2026-08-02T02:11:22.936754Z","title":"Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.15315","last_updated":"2026-07-15T23:02:20Z","snapshot_observed_at":"2026-08-03T06:29:10.407276Z","submitted_at":"2026-07-15T23:02:20Z","title":"CHRONO-RESOLUTION: A Dependency Resolution Dataset at Release Points for npm, PyPI, and crates.io Packages","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-02T02:11:22.936754Z"},"links":{"cited_paper":"/paper/2502.06662","citing_paper":"/paper/2607.15315"},"observation_digest":"sha256:1e0a8d7eee664acadec6fc9d375f6d419efdeea9bbfe88a5bda95127dd7276e5","observation_id":"770379e0-39b4-4c5e-b3d7-42268f607f22","resolution":{"observed_at":"2026-08-02T02:11:22.936754Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T02:11:23.101583Z","title":"Empirical Analysis of Vulnerabilities Life Cycle in Golang Ecosystem","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.15315","last_updated":"2026-07-15T23:02:20Z","snapshot_observed_at":"2026-08-03T06:29:10.407276Z","submitted_at":"2026-07-15T23:02:20Z","title":"CHRONO-RESOLUTION: A Dependency Resolution Dataset at Release Points for npm, PyPI, and crates.io Packages","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-02T02:11:23.101583Z"},"links":{"citing_paper":"/paper/2607.15315"},"observation_digest":"sha256:d886c95036de80a907f7e3622f33ca084c2c6aaaebc2443019c61cad5db375f6","observation_id":"4805729f-3208-4b98-8cce-2ddf79efe59b","resolution":{"observed_at":"2026-08-02T02:11:23.101583Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T02:11:23.268629Z","title":"A Preliminary Study of Rhythm and Speed in the Maven Ecosystem","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2607.15315","last_updated":"2026-07-15T23:02:20Z","snapshot_observed_at":"2026-08-03T06:29:10.407276Z","submitted_at":"2026-07-15T23:02:20Z","title":"CHRONO-RESOLUTION: A Dependency Resolution Dataset at Release Points for npm, PyPI, and crates.io Packages","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-02T02:11:23.268629Z"},"links":{"citing_paper":"/paper/2607.15315"},"observation_digest":"sha256:e5038dc07394aee7c6352e655b2f49f210f9c17484f5f3cb7a1f1b7e7946dcf8","observation_id":"02d0c603-2e1f-4d12-b004-ef357dce8769","resolution":{"observed_at":"2026-08-02T02:11:23.268629Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T02:11:23.380624Z","title":"E.,ANDPOIZAT, P","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.15315","last_updated":"2026-07-15T23:02:20Z","snapshot_observed_at":"2026-08-03T06:29:10.407276Z","submitted_at":"2026-07-15T23:02:20Z","title":"CHRONO-RESOLUTION: A Dependency Resolution Dataset at Release Points for npm, PyPI, and crates.io Packages","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-02T02:11:23.380624Z"},"links":{"citing_paper":"/paper/2607.15315"},"observation_digest":"sha256:98f98fad188aaf2bcfe1d14e0488288d7f04e232819a16775753a9446eb71f48","observation_id":"c09261f1-2194-4296-ab23-896938349bd6","resolution":{"observed_at":"2026-08-02T02:11:23.380624Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T02:11:23.515868Z","title":"Comparison and Evaluation on Static Application Security Testing (SAST) Tools for Java","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.15315","last_updated":"2026-07-15T23:02:20Z","snapshot_observed_at":"2026-08-03T06:29:10.407276Z","submitted_at":"2026-07-15T23:02:20Z","title":"CHRONO-RESOLUTION: A Dependency Resolution Dataset at Release Points for npm, PyPI, and crates.io Packages","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-02T02:11:23.515868Z"},"links":{"citing_paper":"/paper/2607.15315"},"observation_digest":"sha256:95f114ba36551dd4b6cccf6c865ef2a98a6e1c0f7265fb87281193de182eb7a2","observation_id":"f0ac6cf9-ca89-4e26-990f-3bc111abdb08","resolution":{"observed_at":"2026-08-02T02:11:23.515868Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T02:11:23.681842Z","title":"Demystifying the Vulnerability Propagation and Its Evolution via De- pendency Trees in the NPM Ecosystem","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2607.15315","last_updated":"2026-07-15T23:02:20Z","snapshot_observed_at":"2026-08-03T06:29:10.407276Z","submitted_at":"2026-07-15T23:02:20Z","title":"CHRONO-RESOLUTION: A Dependency Resolution Dataset at Release Points for npm, PyPI, and crates.io Packages","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-02T02:11:23.681842Z"},"links":{"citing_paper":"/paper/2607.15315"},"observation_digest":"sha256:4e5c60fde5d500c5e4cb4c21dd2efaeda93932383aa10c8023b924663997a57f","observation_id":"27fc2371-e794-4254-9dee-c2109a6b9ae1","resolution":{"observed_at":"2026-08-02T02:11:23.681842Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T02:11:23.948621Z","title":"World of code: Enabling a research workflow for mining and analyzing the universe of open source vcs data.Empirical Software Engineering 26, 2 (2021), 1–42","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2607.15315","last_updated":"2026-07-15T23:02:20Z","snapshot_observed_at":"2026-08-03T06:29:10.407276Z","submitted_at":"2026-07-15T23:02:20Z","title":"CHRONO-RESOLUTION: A Dependency Resolution Dataset at Release Points for npm, PyPI, and crates.io Packages","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-02T02:11:23.948621Z"},"links":{"citing_paper":"/paper/2607.15315"},"observation_digest":"sha256:aec220384671b98b1d52dae1865cfd9f2bb8ed9c1aaa365f43693c976e615ac5","observation_id":"e44f80a1-687a-4684-bf80-cf33cb68c40c","resolution":{"observed_at":"2026-08-02T02:11:23.948621Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T02:11:24.072893Z","title":"Understanding the Response to Open-Source Dependency Abandonment in the npm Ecosystem","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.15315","last_updated":"2026-07-15T23:02:20Z","snapshot_observed_at":"2026-08-03T06:29:10.407276Z","submitted_at":"2026-07-15T23:02:20Z","title":"CHRONO-RESOLUTION: A Dependency Resolution Dataset at Release Points for npm, PyPI, and crates.io Packages","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-02T02:11:24.072893Z"},"links":{"citing_paper":"/paper/2607.15315"},"observation_digest":"sha256:b356802b6195017af51ce2967fcd87e7facbc4c80a8018897a9933be8dbb483f","observation_id":"876c5fa4-344a-4634-b8c4-daab11697d49","resolution":{"observed_at":"2026-08-02T02:11:24.072893Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T02:11:24.221413Z","title":"A Large Scale Analysis of Semantic Versioning in NPM","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.15315","last_updated":"2026-07-15T23:02:20Z","snapshot_observed_at":"2026-08-03T06:29:10.407276Z","submitted_at":"2026-07-15T23:02:20Z","title":"CHRONO-RESOLUTION: A Dependency Resolution Dataset at Release Points for npm, PyPI, and crates.io Packages","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-02T02:11:24.221413Z"},"links":{"citing_paper":"/paper/2607.15315"},"observation_digest":"sha256:b4aa3a95a589cb2a5a60e4899544fe4db2d6f8dc5b437c552ec1e26801161531","observation_id":"3adf2f43-4e03-4b0f-855e-59785b3de7c7","resolution":{"observed_at":"2026-08-02T02:11:24.221413Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T02:11:24.391727Z","title":"npm-follower: A Complete Dataset Tracking the NPM Ecosystem","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.15315","last_updated":"2026-07-15T23:02:20Z","snapshot_observed_at":"2026-08-03T06:29:10.407276Z","submitted_at":"2026-07-15T23:02:20Z","title":"CHRONO-RESOLUTION: A Dependency Resolution Dataset at Release Points for npm, PyPI, and crates.io Packages","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-02T02:11:24.391727Z"},"links":{"citing_paper":"/paper/2607.15315"},"observation_digest":"sha256:f2f243dcb46b5b35d2c8542bf6b108fb67ea83c1130f389799a97c98fcdc2cef","observation_id":"4154f64b-eaa4-4cac-9b37-89d7ea46dcfa","resolution":{"observed_at":"2026-08-02T02:11:24.391727Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T02:11:24.507711Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.15315","last_updated":"2026-07-15T23:02:20Z","snapshot_observed_at":"2026-08-03T06:29:10.407276Z","submitted_at":"2026-07-15T23:02:20Z","title":"CHRONO-RESOLUTION: A Dependency Resolution Dataset at Release Points for npm, PyPI, and crates.io Packages","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-02T02:11:24.507711Z"},"links":{"citing_paper":"/paper/2607.15315"},"observation_digest":"sha256:6d6df4fe5665f7af8c150439592b065f213be412f91e498e9597df6dd526cb86","observation_id":"6e21596c-35ff-422d-af3b-5abc2a1db70b","resolution":{"observed_at":"2026-08-02T02:11:24.507711Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":"10.5281/zenodo.17576373","metadata_source":"doi_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T02:14:03.872261Z","title":"CHRONO-RESOLUTION: A dependency resolution dataset at release points for npm, pypi, and crates.io packages","venue":null,"work_id":"3432ac40-457f-444e-9e13-1eb55403a68e","year":null},"citing_paper":{"arxiv_id":"2607.15315","last_updated":"2026-07-15T23:02:20Z","snapshot_observed_at":"2026-08-03T06:29:10.407276Z","submitted_at":"2026-07-15T23:02:20Z","title":"CHRONO-RESOLUTION: A Dependency Resolution Dataset at Release Points for npm, PyPI, and crates.io Packages","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-02T02:11:24.623952Z"},"links":{"citing_paper":"/paper/2607.15315"},"observation_digest":"sha256:9537e8d4cae5d7e4d3f6f97163b4232ffab5cc8592bd8717c50f61431c4ca121","observation_id":"69b7c778-f5bf-4782-8ef6-be988378d1b0","resolution":{"observed_at":"2026-08-02T02:14:03.976809Z","resolver_source":"doi","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T02:11:24.715195Z","title":"What’s in a package? getting visibility into dependencies using security-sensitive api calls, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.15315","last_updated":"2026-07-15T23:02:20Z","snapshot_observed_at":"2026-08-03T06:29:10.407276Z","submitted_at":"2026-07-15T23:02:20Z","title":"CHRONO-RESOLUTION: A Dependency Resolution Dataset at Release Points for npm, PyPI, and crates.io Packages","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-02T02:11:24.715195Z"},"links":{"citing_paper":"/paper/2607.15315"},"observation_digest":"sha256:92c2ccbfd3df1ce2310d45e9e868698b941a91a3bac57153a56297132240b299","observation_id":"80055a14-5f39-4f30-9288-b6df84d26932","resolution":{"observed_at":"2026-08-02T02:11:24.715195Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T02:11:24.718051Z","title":"How quickly do development teams update their vulnerable dependencies?, 2026","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.15315","last_updated":"2026-07-15T23:02:20Z","snapshot_observed_at":"2026-08-03T06:29:10.407276Z","submitted_at":"2026-07-15T23:02:20Z","title":"CHRONO-RESOLUTION: A Dependency Resolution Dataset at Release Points for npm, PyPI, and crates.io Packages","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-02T02:11:24.718051Z"},"links":{"citing_paper":"/paper/2607.15315"},"observation_digest":"sha256:57a19a64148e6d00be7a4bbf4a41543c7fff9bbe8d129e78215c8b5b3e5e22b3","observation_id":"5c1fb9a7-ced4-4701-b6f1-815c674e1eef","resolution":{"observed_at":"2026-08-02T02:11:24.718051Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T02:11:24.794900Z","title":"Libraries.io – The Open Source Discovery Service","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.15315","last_updated":"2026-07-15T23:02:20Z","snapshot_observed_at":"2026-08-03T06:29:10.407276Z","submitted_at":"2026-07-15T23:02:20Z","title":"CHRONO-RESOLUTION: A Dependency Resolution Dataset at Release Points for npm, PyPI, and crates.io Packages","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-02T02:11:24.794900Z"},"links":{"citing_paper":"/paper/2607.15315"},"observation_digest":"sha256:2438b635381efd92bc2eb80f06e2758eedbda9054be13330c0ed73b0f4aa61c2","observation_id":"31e3a8a2-a3c9-4ccf-a14a-ce5c96d9057e","resolution":{"observed_at":"2026-08-02T02:11:24.794900Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T02:11:24.932094Z","title":"Research directions in software supply chain security.ACM Trans","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.15315","last_updated":"2026-07-15T23:02:20Z","snapshot_observed_at":"2026-08-03T06:29:10.407276Z","submitted_at":"2026-07-15T23:02:20Z","title":"CHRONO-RESOLUTION: A Dependency Resolution Dataset at Release Points for npm, PyPI, and crates.io Packages","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-02T02:11:24.932094Z"},"links":{"citing_paper":"/paper/2607.15315"},"observation_digest":"sha256:462fd67ca3194c6b7b9b482cfd1ddd5a38d9f3ff63505fe45b2d4e746fda3097","observation_id":"b47db3a4-04e5-42e5-b6fd-de2c3de12592","resolution":{"observed_at":"2026-08-02T02:11:24.932094Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2201.03981","last_updated":"2022-02-09T13:52:58Z","snapshot_observed_at":"2026-08-04T06:57:42.082490Z","submitted_at":"2022-01-11T14:51:46Z","title":"Demystifying the Vulnerability Propagation and Its Evolution via Dependency Trees in the NPM Ecosystem","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2201.03981","snapshot_observed_at":"2026-08-02T02:11:23.800340Z","title":null,"venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.15315","last_updated":"2026-07-15T23:02:20Z","snapshot_observed_at":"2026-08-03T06:29:10.407276Z","submitted_at":"2026-07-15T23:02:20Z","title":"CHRONO-RESOLUTION: A Dependency Resolution Dataset at Release Points for npm, PyPI, and crates.io Packages","version":1},"reference_index":684,"source":"pdf_text","source_observed_at":"2026-08-02T02:11:23.800340Z"},"links":{"cited_paper":"/paper/2201.03981","citing_paper":"/paper/2607.15315"},"observation_digest":"sha256:cd26357c17510236e013ec38fa50d226c26485bcae555d770cfd9597fb6480f1","observation_id":"73460dd0-776c-4079-98bb-aacab996c81d","resolution":{"observed_at":"2026-08-02T02:11:23.800340Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2607.15315","last_updated":"2026-07-15T23:02:20Z","latest_version":1,"primary_category":"cs.SE","snapshot_observed_at":"2026-08-03T06:29:10.407276Z","submitted_at":"2026-07-15T23:02:20Z","title":"CHRONO-RESOLUTION: A Dependency Resolution Dataset at Release Points for npm, PyPI, and crates.io Packages"},"reference_resolution":{"displayed":28,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":27,"verified_exact":1,"verified_fuzzy":0},"total_outbound_references":28},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"thesis":"As of 10 August 2026, this Paper Citation Record lists 28 of 28 outbound references and 0 inbound Pith citation observations for arXiv:2607.15315."}