{"as_of":"2026-08-14T19:16:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:850deea6e4fb388b4c6b7b7dfc9ec4a8176bfccc4bf1145bba5da57636985efe","coverage":[{"denominator":47,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":47,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-01T05:43:57.067781Z","state":"measured"},{"denominator":47,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":47,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-14T06:32:32.682623+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2607.22140/citation-record","integrity":"/paper/2607.22140/integrity","json":"/paper/2607.22140/citation-record.json","paper":"/paper/2607.22140"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:53.117446Z","title":"The minimum elements for a software bill of materials (SBOM),","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:53.117446Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:6cddd2fb88974e6f8fe78e08c1d0e0c02cf5d61c9bff4389228e736c6b968037","observation_id":"18bfc2aa-7f04-471c-8a4d-d7b82c7003d3","resolution":{"observed_at":"2026-08-01T05:43:53.117446Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:53.196857Z","title":"A large scale empirical analysis on the adherence gap between standards and tools in SBOM,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:53.196857Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:8eb7d34f663c6a3275657189df78babd0bd49bc5f3dd48be3b6529c7f5725ab4","observation_id":"1b6c2eac-934d-404f-934a-7d4b2d5634b7","resolution":{"observed_at":"2026-08-01T05:43:53.196857Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:53.286268Z","title":"Software dark mat- ter: Gazing at uncharted files to navigate SBOM integrations,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:53.286268Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:c4e03b3d2a053ddcde262418bb0f3267f77fbd04bc4cc895406510b96f783711","observation_id":"d250ef59-4d2b-44ee-8ed8-76585d963079","resolution":{"observed_at":"2026-08-01T05:43:53.286268Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:53.386235Z","title":"Wild SBOMs: a large-scale dataset of software bills of materials from public code,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:53.386235Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:30bf78cc265de81b281ba18f7acda6e054647843f0716cacf13b77a09febe9a9","observation_id":"9b02ca80-81cc-4ce8-87cc-e5364113491b","resolution":{"observed_at":"2026-08-01T05:43:53.386235Z","resolver_source":null,"status":"malformed_identifier"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:53.488183Z","title":"In defense of soundiness: A manifesto,","venue":null,"work_id":null,"year":2015},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:53.488183Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:a4fc5a706bbe71616c5627b9474dfc2faaba07c5ea9b4c65a003cd0bcec1cfba","observation_id":"1b0997db-33b7-4390-bd85-419b68c6a7c7","resolution":{"observed_at":"2026-08-01T05:43:53.488183Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:53.580886Z","title":"On closed world data bases,","venue":null,"work_id":null,"year":1978},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:53.580886Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:d09de1997e9bc14596ec9920c7d0c9b5f95170ec4c53738ca788fcae212e5ec9","observation_id":"a486e688-d3e9-4284-b11f-bb104b1414bd","resolution":{"observed_at":"2026-08-01T05:43:53.580886Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:53.680300Z","title":"CycloneDX bill of materials specification, version 1.6 — compositions,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:53.680300Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:2fb683060f7c5f800505e7d2caf2083e2d6e59ae2a0e2b6c46d5367a2ac73988","observation_id":"1b49fb71-14cc-4038-8d76-73abb857e3cf","resolution":{"observed_at":"2026-08-01T05:43:53.680300Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:53.763257Z","title":"Executive order 14028: Improving the nation’s cybersecurity,","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:53.763257Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:b96ff307f141b17799174d9e822ae1f95e629319c4fe48cb563d92d5038ce68d","observation_id":"a927fa04-9f1b-4617-a92d-b1dbe0b99d65","resolution":{"observed_at":"2026-08-01T05:43:53.763257Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:53.839283Z","title":"Regulation (eu) 2024/2847 on hor- izontal cybersecurity requirements for products with digital elements (cyber resilience act),","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:53.839283Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:2a42fd8221ef73aeafc84641093138fcb2ec94fa984406e429e68607ef515f78","observation_id":"079adb1e-6fc8-47de-8523-fa2a12fe0952","resolution":{"observed_at":"2026-08-01T05:43:53.839283Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:53.905296Z","title":"Framing software component transparency: Establishing a com- mon software bill of materials (SBOM),","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:53.905296Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:e4900cad8c0e48abf7a2faed947a036b08ae3ee06d41f9e6178dc784c8a43361","observation_id":"f30bd26c-458d-40d6-8134-b51df0855e74","resolution":{"observed_at":"2026-08-01T05:43:53.905296Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:53.970099Z","title":"Automated SBOM-driven vulnerability triage for IoT firmware: A lightweight pipeline for risk prioritization,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:53.970099Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:0f406bc2e22a482b4c38bd35a45cf14d029fda8605fbe5dc08117659c62083ab","observation_id":"46aeaee3-9bd2-4efa-8a02-45c34b221e96","resolution":{"observed_at":"2026-08-01T05:43:53.970099Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:54.060817Z","title":"Exploit prediction scoring system (EPSS),","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:54.060817Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:936efde1f2a351dd318064e2b8784947025711a945e97033d4aaa7b3db269ece","observation_id":"509225ab-9cb8-43d4-9533-e949e7fe8deb","resolution":{"observed_at":"2026-08-01T05:43:54.060817Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:54.169595Z","title":"Con- flicting scores, confusing signals: An empirical study of vulnerability scoring systems,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:54.169595Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:08d0012ad369bdc4659b8958769a047646c778d271c18a09bae2afcb3c2e238e","observation_id":"24535412-89ad-418e-b8fd-e0874a274881","resolution":{"observed_at":"2026-08-01T05:43:54.169595Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:54.256027Z","title":"Efficacy of EPSS in high severity CVEs found in KEV,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:54.256027Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:f201c1debfedea0ab98b817dd19ab4630a5099c2a14b4498ec682dde14203b5b","observation_id":"3e4ee2af-b4e6-4583-b5ff-3345160786fe","resolution":{"observed_at":"2026-08-01T05:43:54.256027Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:54.360972Z","title":"Towards predicting multi-vulnerability attack chains in software supply chains from software bill of materials graphs,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:54.360972Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:34c737fb0a57538c0d056dfdb69691ec2e3ad895a4c2e6019c29fd983acc267f","observation_id":"b1a83ab0-484c-4264-84ff-432f7b79e830","resolution":{"observed_at":"2026-08-01T05:43:54.360972Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:54.462811Z","title":"The ripple effect of vul- nerabilities in Maven Central: Prevalence, propagation, and mitigation challenges,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:54.462811Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:7f0685577d1a74820666abda71dd000af693d2200e780b30ad33a7786abf4852","observation_id":"f8f518d5-2d65-4297-8eaf-a661428440a3","resolution":{"observed_at":"2026-08-01T05:43:54.462811Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:54.520854Z","title":"Out of sight, still at risk: The lifecycle of transitive vulnerabilities in Maven,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:54.520854Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:6119026e5751cbae03a99ec83c0e4128d6b88b33348b7bde3596901eaabe4013","observation_id":"cfe1b183-d8bc-48ed-9ab2-8d7fdfd15da7","resolution":{"observed_at":"2026-08-01T05:43:54.520854Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:54.588401Z","title":"Tracing vulnerabilities in Maven: A study of CVE lifecycles and dependency networks,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:54.588401Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:b7b939c2e0d6fab288619e5447dce97a55967b4c2ee65e01de72b64f727f0ad1","observation_id":"4ac7a2b1-c7f3-433f-af32-17a8ab699843","resolution":{"observed_at":"2026-08-01T05:43:54.588401Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:54.636429Z","title":"Propagation- based vulnerability impact assessment for software supply chains,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:54.636429Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:d21f4feb918c9ba0dc24d611c1b198ffe13e256e28f0b3afd76b59da9a0b0c44","observation_id":"c6a2e04f-643a-4e09-a5c1-f1abe70cd435","resolution":{"observed_at":"2026-08-01T05:43:54.636429Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:54.735408Z","title":"Vulnerable open source dependencies: Counting those that matter,","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:54.735408Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:d8eb3c84a5273685faf2fb1e0c045f856912f7787c35e96a3327cb859837f076","observation_id":"3fffc540-a711-4e80-8572-4eb73b4c50aa","resolution":{"observed_at":"2026-08-01T05:43:54.735408Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:54.830513Z","title":"Vuln4Real: A methodology for counting actually vulnerable dependencies,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:54.830513Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:a2c189ee48e5559e07f479631e94f9b52d36bbe8b8bfa9f0dbe3699587a500f2","observation_id":"f648ddb6-d84d-41cf-8c57-72aa11d66141","resolution":{"observed_at":"2026-08-01T05:43:54.830513Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:54.926478Z","title":"Backstabber’s knife collection: A review of open source software supply chain attacks,","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:54.926478Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:29e00aca699e6a9c95491b53562ef5deef2475031d301b299ecdf8c08b3dd57a","observation_id":"b6e8a34e-7c13-4aa9-9c61-cf2069d2efe7","resolution":{"observed_at":"2026-08-01T05:43:54.926478Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2204.04008","last_updated":"2022-04-19T19:02:15Z","snapshot_observed_at":"2026-08-14T08:18:19.610402Z","submitted_at":"2022-04-08T11:37:24Z","title":"Taxonomy of Attacks on Open-Source Software Supply Chains","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2204.04008","snapshot_observed_at":"2026-08-01T05:43:55.005464Z","title":"SoK: Taxonomy of attacks on open-source software supply chains,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:55.005464Z"},"links":{"cited_paper":"/paper/2204.04008","citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:27cd757d8840d7899997430477d5b5c3c37a6d7e3b9dd366bc91e3c4ecbb449b","observation_id":"b66db5e6-e34a-4fec-9c8d-da0ebd4f3474","resolution":{"observed_at":"2026-08-01T05:43:55.005464Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1902.09217","last_updated":"2019-06-07T09:49:11Z","snapshot_observed_at":"2026-08-14T17:11:49.178680Z","submitted_at":"2019-02-25T12:07:25Z","title":"Small World with High Risks: A Study of Security Threats in the npm Ecosystem","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1902.09217","snapshot_observed_at":"2026-08-01T05:43:55.093591Z","title":"Small world with high risks: A study of security threats in the npm ecosystem,","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:55.093591Z"},"links":{"cited_paper":"/paper/1902.09217","citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:07a35384050e9eea22f5d58db6bf60037262722fb49eaee7f6a01a10a1cdd96a","observation_id":"ff1538cf-e1b1-40ce-b1da-8e034130f1ec","resolution":{"observed_at":"2026-08-01T05:43:55.093591Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:55.164824Z","title":"Syft: CLI tool and library for generating a software bill of materials from container images and filesystems,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:55.164824Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:1487951fd58e6156434af204adc7ad18b34a73f5812d665d0bd4eba6b7620648","observation_id":"a477b02d-18fb-4ce4-b30b-1fe6fb33fa3a","resolution":{"observed_at":"2026-08-01T05:43:55.164824Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:55.260962Z","title":"sbomqs: Quality metrics for SBOMs,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:55.260962Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:7be585756a3bbee916ce05ddd3b39a6004aebf3d1b6977722fea142b2e4aca16","observation_id":"bc5f7918-51f3-4332-9dd6-14a204b1d59c","resolution":{"observed_at":"2026-08-01T05:43:55.260962Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:55.357396Z","title":"A study of security vulnerabilities on Docker Hub,","venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:55.357396Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:7901b5135cdb7b54e4cef5e6931c9d4a28f4c98d41f1b6885235d7915d4a9d5b","observation_id":"79c9543e-d3dc-4014-8766-dd409239610f","resolution":{"observed_at":"2026-08-01T05:43:55.357396Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:55.455119Z","title":"On the relation between outdated docker containers, severity vulnerabilities, and bugs,","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:55.455119Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:3f61b1f38faf68d0f1de2846c7c428f119537379bf531e567383d74b737f41f0","observation_id":"ac13e551-d454-44c7-9db6-e91c8194c4e4","resolution":{"observed_at":"2026-08-01T05:43:55.455119Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:55.557939Z","title":"A faster algorithm for betweenness centrality,","venue":null,"work_id":null,"year":2001},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:55.557939Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:cd44116d215d845977872b9e047b3fc1a03bedc0153b128ac2b91c2ca620647f","observation_id":"ac530844-414c-457d-a0b1-484e1088a075","resolution":{"observed_at":"2026-08-01T05:43:55.557939Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:55.659094Z","title":"SBOMproof: Beyond alleged SBOM compliance for supply chain security of container images,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:55.659094Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:fac55060db82e89d2535fdab38bce304cf123935dfb5f181a94a56f354d3b8f5","observation_id":"cc2a03fe-ccc7-464f-9403-61d50ea13d6f","resolution":{"observed_at":"2026-08-01T05:43:55.659094Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:55.760171Z","title":"The impact of SBOM generators on vulnerability assessment in Python: A comparison and a novel approach,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:55.760171Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:bff48db319904ea28f4f65ead1896063f4e7c05d79d516c14a200d19cdcf5821","observation_id":"4d52b0bb-48d6-4196-ab33-ef7156469c25","resolution":{"observed_at":"2026-08-01T05:43:55.760171Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:55.858961Z","title":"Accuracy evaluation of SBOM tools for web applications and system-level software,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:55.858961Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:f73fb1fd51647a9c3fb98650c61c9de1692621759f2569e70e1d6811f78fbc4d","observation_id":"f97d5b21-c9ac-4c6f-bf9b-b5836ee82b6e","resolution":{"observed_at":"2026-08-01T05:43:55.858961Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:55.951929Z","title":"The state of the SBOM tool ecosystems: A comparative analysis of SPDX and CycloneDX,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:55.951929Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:7c21ed40f5e8dc4f257660256d70e4e39e750fc85ba58f896bdc5c62676d921d","observation_id":"ff9d2013-bbe4-4471-9ada-08197239c905","resolution":{"observed_at":"2026-08-01T05:43:55.951929Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:56.025522Z","title":"A landscape study of open source and proprietary tools for software bill of materials (SBOM),","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:56.025522Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:32f2b3b5c25ecf6ec26cb89d370caa6c962aca497ef0cd22b0de22df1e160b6a","observation_id":"ac638fe8-43cd-4548-94ef-b35427ef986e","resolution":{"observed_at":"2026-08-01T05:43:56.025522Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:56.120337Z","title":"Supply chain insecurity: The lack of integrity protection in SBOM solutions,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:56.120337Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:4f7937e6075c96d0b509fb349e2faa747e8511d1caa8f9a30ef9f4367b751969","observation_id":"7a64809e-ccfb-495a-a0c7-f033e21b02d9","resolution":{"observed_at":"2026-08-01T05:43:56.120337Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:56.219290Z","title":"A reality check on SBOM- based vulnerability management: An empirical study and a path for- ward,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:56.219290Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:54cb5ea5505c53a4d64f44542e6a5a4f1956e96bb3688b4290fa8119af44ea66","observation_id":"05fe10d4-239e-42f9-95f2-ec07c6410385","resolution":{"observed_at":"2026-08-01T05:43:56.219290Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:56.320198Z","title":"Software bills of materials in Maven Central,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:56.320198Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:f3cc54ddbe477ad1afebfa8fc20c7990e618bc2ea69e4f6ff82de0aec09d1672","observation_id":"8f76d9a1-3a61-4c11-b5f5-fddffaca5062","resolution":{"observed_at":"2026-08-01T05:43:56.320198Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:56.414702Z","title":"SBOM dataset from 100 000+ public GitHub repositories,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:56.414702Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:679edc2638dcd716801a03acf49fe6b4ac6c35c830eaf83eb28b30ac6ed2d5ac","observation_id":"a6aa901d-e78e-4d0c-8243-d45463818028","resolution":{"observed_at":"2026-08-01T05:43:56.414702Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:56.489524Z","title":"Soft- ware bill of materials in software supply chain security: A systematic literature review,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:56.489524Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:8e6983203ee14c33f6f43e02c2fe1a8b51bf440ae9168e87e25b03ba906192d1","observation_id":"5fe971ab-eca6-42cb-aac4-7a0f3f03583a","resolution":{"observed_at":"2026-08-01T05:43:56.489524Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:56.565115Z","title":"An empirical comparison of dependency network evolution in seven software packaging ecosystems,","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:56.565115Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:8f2c39b7a2b5e6a6959069fc750bd56a78633a0a387a5daee4d79fc8523d0074","observation_id":"2c6bc482-4173-41a6-910a-ac705c1a0fbf","resolution":{"observed_at":"2026-08-01T05:43:56.565115Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:56.637671Z","title":"Structure and evolution of package dependency networks,","venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:56.637671Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:915ff39b79eaa653233c6564e8d59a78c588f03e83e02fd3e18f365dcc076a6b","observation_id":"eac3059c-1185-4216-b9a5-f1912735be97","resolution":{"observed_at":"2026-08-01T05:43:56.637671Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:56.700146Z","title":"Structural and connectiv- ity patterns in the Maven Central dependency network,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:56.700146Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:80e2f7b3535e9d4c5b7d18dcd72aaacb75e1ac9ac195e067fabec8ca838e0a14","observation_id":"a02d2d2d-c137-449c-8e8c-93342bbc42d3","resolution":{"observed_at":"2026-08-01T05:43:56.700146Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:56.779508Z","title":"On the impact of outdated and vulnerable JavaScript pack- ages in Docker images,","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:56.779508Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:50a29a7529ee5e241ec05d5d13d56d4e8d2fd4ec221fc3b9b41bd3731d1d0c11","observation_id":"d9cb6253-862e-4a80-bacd-bca92a215946","resolution":{"observed_at":"2026-08-01T05:43:56.779508Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:56.850967Z","title":"Beyond metadata: Code- centric and usage-based analysis of known vulnerabilities in open-source software,","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:56.850967Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:53239673beb522824dfec33fe91f2dc673fa1b87342d57929e85797adab2562f","observation_id":"68e64c74-44a2-434c-9563-d77f837ee9d8","resolution":{"observed_at":"2026-08-01T05:43:56.850967Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:56.907349Z","title":"A comparative study of vulner- ability reporting by software composition analysis tools,","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:56.907349Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:f2b81e5573043dd314d02a035d14390b44f43eda61fa9339aaee48c3c0bb734d","observation_id":"659fded5-6e3b-4ed4-93b7-10e6d72b9b6c","resolution":{"observed_at":"2026-08-01T05:43:56.907349Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:56.997417Z","title":"Hidden dependencies and component variants in SBOM-based software composition analysis,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:56.997417Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:fa36e1e095d8fd0b983669147802b93de5b384a6d0469674e858811acccbbd31","observation_id":"d5e80286-af1f-4fde-a718-f0c3d2eae4c1","resolution":{"observed_at":"2026-08-01T05:43:56.997417Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T05:43:57.067781Z","title":"Judge: Identifying, understanding, and evaluating sources of unsoundness in call graphs,","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild","version":1},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-08-01T05:43:57.067781Z"},"links":{"citing_paper":"/paper/2607.22140"},"observation_digest":"sha256:fbd8656003f50d29f557a1b85487edf8daf4e032e9f378b57526d0838c658a8d","observation_id":"b91bb2fe-1c73-4fba-8b66-818f88c4dd6a","resolution":{"observed_at":"2026-08-01T05:43:57.067781Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2607.22140","last_updated":"2026-07-24T09:37:00Z","latest_version":1,"primary_category":"cs.SE","snapshot_observed_at":"2026-08-11T01:18:54.413431Z","submitted_at":"2026-07-24T09:37:00Z","title":"No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild"},"reference_resolution":{"displayed":47,"state_counts":{"malformed_identifier":1,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":46,"verified_exact":0,"verified_fuzzy":0},"total_outbound_references":47},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"thesis":"As of 14 August 2026, this Paper Citation Record lists 47 of 47 outbound references and 0 inbound Pith citation observations for arXiv:2607.22140."}