LH009 sources
Every HTTP request and clone the scripts made is in data/read_log.csv with its UTC time, source, endpoint, status and bytes (844 rows, 08:43:31 to 08:51:13 UTC on 27 September 2026; data/read_summary.csv totals them by source). Each clone is one row, with its size on disk when it finished. Blobs that git fetched on demand from the blobless clones, while changelogs were read (08:43 to 08:48) and while pin and lock files were read at the snapshots and at later commits (08:49:48 to 08:54:43), are not logged request by request; the clones held 0.78 GB when made and 1.7 GB on disk at the end (0.6 GB of it the sixteen libraries' own repositories). No key, token or credential was used; every read was anonymous. GitHub's API was not used.
Local source numbers are L1 to L6; S numbers are the root sources.md.
| id | source | what it gave | observation window of the record | read (UTC, 27 September 2026) |
|---|---|---|---|---|
| L1 | PyPI JSON API, https://pypi.org/pypi/<package>/<version>/json and /<package>/json | for each of the 37 fixed releases, its info.description (fixed at upload) and project URLs; the release lists of the twelve new libraries (data/releases_<library>.csv); for dependents with no repository in Open Source Insights, their project URLs |
releases as published; upload times are the earliest upload_time_iso_8601 of any file |
08:43:31 to 08:51:12 |
| L2 | git over HTTPS: blobless bare clones of the sixteen libraries' repositories on github.com (urllib3, pyca/cryptography, jpadilla/pyjwt, Kludex/starlette, BerriAI/litellm, aio-libs/aiohttp, pyasn1/pyasn1, python-pillow/Pillow, Kludex/python-multipart, facelessuser/soupsieve, lxml/lxml, modelcontextprotocol/python-sdk, msgpack/msgpack-python, gitpython-developers/GitPython, langchain-ai/langchain, sqlalchemy/mako) | the tags, tag annotations and tagger times; the changelog files and the entry for each fixed release at its tag and at the head; the committer time of each tag's commit; the history of litellm's release-notes directory | the repositories as served on the read day; git records commit and tagger times, not when anything was pushed | 08:43:32 to 08:44:40 (clones); read to 08:48 |
| L3 | GitHub's release pages, https://github.com/<owner>/<repo>/releases/tag/<tag>, as HTML (sensitivity source) | nothing: every page asked for was refused with HTTP 403 through this environment's proxy (72 requests: 35 in the first run of classify.py, which found no tag for mako's two releases, and 37 in the second) | 08:43:35 to 08:47:21 | |
| L4 | OSV [S26], https://api.osv.dev/v1/vulns/<id> | the affected ranges and aliases of the twelve new events' advisories (data/event_advisory_ranges.csv); LH008's data holds the rest (studies/LH008/data/osv_advisories.csv, qualifying_advisories.csv, events.csv, event_advisory_ranges.csv) | OSV's records as modified up to the read day | 08:48:23 to 08:48:25 |
| L5 | Open Source Insights [S11], https://deps.dev/_/s/pypi/p/<library>/v/<version>/dependents and https://api.deps.dev/v3/systems/pypi/packages/<name>/versions/<version> | dependents counts and the listed direct dependents of the release before each of the twelve new fixes (data/frame_counts.csv, data/frame.csv); each screened package's source repository | Open Source Insights' state on the read day; how it chooses the listed sample was not read | 08:49:39 to 08:51:13 |
| L6 | git over HTTPS: blobless clones without checkout of 195 dependents' repositories on github.com and gitlab.com (27 further attempts refused, the server asking for credentials) | each repository's default branch; the pin and lock files at the snapshot; every first-parent commit after it that touched one, to the first move or the head; the moving commit's author, committer, times, parents and message | the repositories' histories as served on the read day | clones 08:49:48 to 08:51:13; files and commits read to 08:54:43 |
Earlier Lighthouse records used
- studies/LH008 at commit 76043cb: its 68 qualifying advisories and 16 events (data/qualifying_advisories.csv, data/events.csv, data/osv_advisories.csv), and its four fix frames' kept repositories, moves, times, authorship and trailers (data/moves.csv rows of kind
fix, data/trailers.csv, data/read_log.csv for the clone times), read by LH008 on 27 September 2026 between 07:24 and 07:47 UTC and reviewed in notes/R-0008.md. They are used as they stand and not read again. - studies/LH008/scripts at commit 76043cb, copied into scripts/ and changed as each file's docstring says.
From studies/LH009/sources.md in the repository, last changed 27 September 2026.