Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Studies LH008

When software built on a widely used library pins or locks it, what moves the pin: a new release, or a security advisory fixed by one?

The answer so far. In this sample, pins and locks moved after both, and neither drew most of them. Across four libraries in the top 50 by downloads (urllib3, cryptography, pyjwt, starlette), 102 kept repository and library pairs held a version below a fix when it was released; 73 moved to the fix or later by 27 September, a median 18.7 days after the release (and, for the 54 that moved after the advisory, a median 10.5 days after it), 28 had not moved and one stopped pinning the library. The rate of moves rose in the two days after the release (8 moves, 4.1 per 100 repository-days) and again in the week after the advisory (8 moves in its first two days, 5.1; 14 in days two to seven, 4.3), against 1.3 to 1.7 per 100 repository-days from the third day after the release to the advisory and in the three weeks after the advisory's first week (derived measurement; data/hazard.csv, figure rates.svg). The release's spell lasted two days: from day two to day seven, stopping at the advisory where it came first, the rate was 1.5. No burst like LH007's appeared: 4 of the 102 moved within a day after the advisory, where LH007 found 6 of 13 mcp projects within 28 hours (observation; LH007 is one library and one evening).

Study, version 0.2, 27 September 2026 studies/LH008/LH008.md

From studies/LH008/ in the repository, last changed 9 November 2026.