LH010 sources

Every HTTP request and clone the scripts made is in data/read_log.csv with its UTC time, source, endpoint, status and bytes (1,335 rows, 09:53:19 to 10:04:41 UTC on 27 September 2026; data/read_summary.csv totals them by source). Each clone is one row, with its size on disk when it finished (629 MB in all). Blobs that git fetched on demand from the blobless clones, while changelogs were read (09:54 to 09:57, and the history of one file at about 10:00) and while pin and lock files were read at the snapshots and at later commits (10:03 to 10:18, when data/moves.csv was written), are not logged request by request. At most 0.8 GB was on disk at once; every clone was deleted when its reading was written. No key, token or credential was used; every read was anonymous. Neither GitHub's API nor its release pages were requested.

Local source numbers are L1 to L6; S numbers are the root sources.md.

id	source	what it gave	observation window of the record	read (UTC, 27 September 2026)
L1	ClickPy [S21], `https://sql-clickhouse.clickhouse.com/?user=demo`, LH008's query with `LIMIT 500`	the 500 projects most downloaded in August 2026 (data/top500.csv)	downloads in August 2026	09:53:19
L2	OSV [S26], `https://api.osv.dev/v1/query` for each of the 500, and `https://api.osv.dev/v1/vulns/<id>` for each frame's advisory	1,644 records against the 500 (data/osv_advisories.csv), the 227 reviewed GHSA records in the window with a fix (data/qualifying_advisories.csv), and the affected ranges of the 48 frames' advisories (data/event_advisory_ranges.csv)	OSV's records as modified up to the read day; `published` is when the record entered GitHub's database	09:53:20 to 10:02:21
L3	PyPI JSON API, `https://pypi.org/pypi/<package>/json` and `/<package>/<version>/json`	release lists and first uploads of the 43 libraries (data/releases.csv); the description and project URLs of each of the 94 fixed releases read here; project URLs of dependents that Open Source Insights named no repository for	releases as published; upload times are the earliest `upload_time_iso_8601` of any file	09:53:31 to 10:04:40
L4	git over HTTPS: blobless bare clones of 35 library repositories on github.com (the libraries in data/fix_reads.csv, column repo; nbconvert named none)	tags, annotations and tagger times; changelog files and the entry for each fixed release at its tag and at the head; the committer time of each tag's commit; the history of fastmcp's changelog	repositories as served on the read day; git records commit and tagger times, not when anything was pushed	09:54:24 to 09:56:39 (clones); read to about 10:00
L5	Open Source Insights [S11], `https://deps.dev/_/s/pypi/p/<library>/v/<version>/dependents` and `https://api.deps.dev/v3/systems/pypi/packages/<name>/versions/<version>`	the dependents counts and listed direct dependents of the release before each of the 36 fixes read fresh (data/frame_counts.csv, data/frame.csv); each screened package's source repository	Open Source Insights' state on the read day; how it chooses the listed sample was not read	10:03:13 to 10:04:40
L6	git over HTTPS: blobless clones without checkout of dependents' repositories on github.com and gitlab.com (186 attempts, 161 cloned, 25 refused or failed)	each repository's default branch; the pin and lock files at the snapshot; every first-parent commit after it that touched one, to the first move or the head; the moving commit's author, committer, times, parents, message and Co-authored-by lines	repositories' histories as served on the read day	clones 10:03:24 to 10:04:41; files and commits read from the clones to 10:18 (data/moves.csv's file time)

Earlier Lighthouse records used

studies/LH008 and studies/LH009 at commit 15bd521: for the twelve events that are the same release as LH008's, the class of the fix (studies/LH009/data/fix_classes.csv, with the flaw-named judgements in flaw_judgements.csv), and each frame's first 20 packages in hash order with their screening, snapshot files, kept pairs, moves, authorship and trailers (frame.csv, screen.csv, snapshot_files.csv, moves.csv, trailers.csv) and clone times (read_log.csv). LH008 read urllib3's and pyjwt's frames at 07:24 to 07:26 UTC and LH009 the other ten at 08:49 to 08:51 UTC on 27 September 2026; both were reviewed (notes/R-0008.md, notes/R-0009.md). They are used as they stand and not read again.
studies/LH009/scripts at commit 15bd521 (themselves copied from LH008's), copied into scripts/ and changed as each file's docstring says; select_libraries.py is copied from LH008's.