Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Studies LH009

When a fixed release says in its own notes that it fixes a security flaw, do pinned dependents move to it before the advisory is published, more than they move to a fix released silently?

The answer so far. In this sample, pinned dependents moved to an announced fix before its advisory at about 1.7 times the pace they moved to a silent one, but the same share of their moves came before the advisory, and the difference rests on few moves in few libraries. Of the 37 fixed releases behind LH008's 68 advisories, 19 said in their own changelog, tag or PyPI description, at or before the release, that they fixed a security flaw, and 18 did not (observation; data/fix_classes.csv). Taking each of LH008's 16 libraries' one event (eight announced, eight silent; seven of each had pinned dependents to follow), 257 repository and event pairs held an affected version when the fix came out, and 173 moved to it by 27 September (derived; data/summary_by_class.csv).

Study, version 0.2, 27 September 2026 studies/LH009/LH009.md

From studies/LH009/ in the repository, last changed 9 November 2026.