Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Studies LH007

When a widely used library releases, how much of the software built on it installs the new version because an installer resolved an open range, and how much waits for a maintainer to move a pin or lockfile?

The answer so far. In this sample, the images that resolve an open range took the new release within days, and the images built from a lockfile or an exact pin took it only when the pin moved. For most of the lockfile and exact-pin repositories that was a month or more after the release, or had not happened by 15 August: of 12 such image repositories, 9 had no pin on the new release within four weeks of it, and the largest group of pin moves, four of the nine found, came within 28 hours of a security advisory published a month after the release rather than in the days after the release itself.

Study, version 0.2, 26 September 2026 studies/LH007/LH007.md

From studies/LH007/ in the repository, last changed 9 November 2026.