{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,13]],"date-time":"2026-07-13T21:09:47Z","timestamp":1783976987935,"version":"3.55.0"},"reference-count":45,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"4","license":[{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62472096"],"award-info":[{"award-number":["62472096"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62302101"],"award-info":[{"award-number":["62302101"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62402114"],"award-info":[{"award-number":["62402114"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62402116"],"award-info":[{"award-number":["62402116"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U25A6023"],"award-info":[{"award-number":["U25A6023"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Dependable and Secure Comput."],"published-print":{"date-parts":[[2026,7]]},"DOI":"10.1109\/tdsc.2026.3682678","type":"journal-article","created":{"date-parts":[[2026,4,9]],"date-time":"2026-04-09T19:49:31Z","timestamp":1775764171000},"page":"8334-8348","source":"Crossref","is-referenced-by-count":0,"title":["Fine-Grained Detection of Java Cross-Library Vulnerability Propagation by Extracting Semantic Constraints From Security Patches"],"prefix":"10.1109","volume":"23","author":[{"ORCID":"https:\/\/orcid.org\/0009-0006-5523-1916","authenticated-orcid":false,"given":"Fute","family":"Sun","sequence":"first","affiliation":[{"name":"Fudan University, Shanghai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9298-2536","authenticated-orcid":false,"given":"Lei","family":"Zhang","sequence":"additional","affiliation":[{"name":"Fudan University, Shanghai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhiyu","family":"Wu","sequence":"additional","affiliation":[{"name":"Fudan University, Shanghai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xinyu","family":"Chen","sequence":"additional","affiliation":[{"name":"Fudan University, Shanghai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-7230-0086","authenticated-orcid":false,"given":"Haitao","family":"Yu","sequence":"additional","affiliation":[{"name":"Fudan University, Shanghai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Tianyang","family":"Han","sequence":"additional","affiliation":[{"name":"Fudan University, Shanghai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9714-5545","authenticated-orcid":false,"given":"Min","family":"Yang","sequence":"additional","affiliation":[{"name":"Fudan University, Shanghai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","article-title":"State of software security: Open source edition","year":"2022"},{"key":"ref2","article-title":"2021 open source security and risk analysis report","year":"2021"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE48619.2023.00095"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/ICSM.2015.7332492"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/ICSME.2018.00054"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-020-09830-x"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1145\/3551349.3556921"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1145\/3239235.3268920"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2025.104546"},{"key":"ref10","article-title":"How far have we gone in vulnerability detection using large language models","author":"Gao","year":"2023"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1145\/3639478.3643065"},{"key":"ref12","article-title":"TRIVY: The all-in-one open source security scanner","year":"2022"},{"key":"ref13","article-title":"Osv-scanner","year":"2022"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2024.3454960"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1145\/3377811.3380390"},{"key":"ref16","article-title":"National vulnerability database","year":"2022"},{"key":"ref17","doi-asserted-by":"crossref","DOI":"10.1145\/3236024.3264598","article-title":"PyDriller: Python framework for mining software repositories","author":"Spadini","year":"2018"},{"key":"ref18","article-title":"JDeps - java dependency analysis tool","year":"2023"},{"key":"ref19","article-title":"Joern website","year":"2020"},{"key":"ref20","article-title":"ANTLR (another tool for language recognition)","author":"Parr","year":"2023"},{"key":"ref21","article-title":"The soot framework for java program analysis: A retrospective","volume-title":"Proc. Cetus Users Compiler Infastructure Workshop","author":"Lam"},{"key":"ref22","article-title":"The CGCL dataset","year":"2022"},{"key":"ref23","article-title":"Tracking patches for open source software vulnerabilities","author":"Xu","year":"2023"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1145\/3468264.3473122"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/MSR.2019.00064"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1145\/3524842.3528433"},{"key":"ref27","article-title":"Veracode vulnerability database","author":"Database","year":"2022"},{"key":"ref28","article-title":"Apache maven project","year":"2024"},{"key":"ref29","article-title":"Common vulnerability scoring system v3.1: Specification document","year":"2023"},{"key":"ref30","first-page":"22","article-title":"Boomerang: Demand-driven flow-and context-sensitive pointer analysis for java","volume-title":"Proc. 30th Eur. Conf. Object-Oriented Program.","author":"Johannes"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1145\/2666356.2594299"},{"key":"ref32","article-title":"Guide to software composition analysis: 5 key challenges of SCA","year":"2020"},{"key":"ref33","article-title":"Snyk: Developer security platform","year":"2022"},{"key":"ref34","article-title":"Sourceclear: Software composition analysis for devsecops","year":"2022"},{"key":"ref35","article-title":"Dependabot core","year":"2022"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-39038-8_16"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1007\/11688839_2"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-78791-4_4"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1145\/3381915"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1145\/2351676.2351720"},{"key":"ref41","article-title":"Hybrid inlining: A compositional and context sensitive static analysis framework","author":"Liu","year":"2022"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1145\/3510003.3510046"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1145\/2610384.2628055"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2025.3537102"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179479"}],"container-title":["IEEE Transactions on Dependable and Secure Computing"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/8858\/11603880\/11478627.pdf?arnumber=11478627","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,13]],"date-time":"2026-07-13T20:08:14Z","timestamp":1783973294000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11478627\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,7]]},"references-count":45,"journal-issue":{"issue":"4"},"URL":"https:\/\/doi.org\/10.1109\/tdsc.2026.3682678","relation":{},"ISSN":["1545-5971","1941-0018","2160-9209"],"issn-type":[{"value":"1545-5971","type":"print"},{"value":"1941-0018","type":"electronic"},{"value":"2160-9209","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,7]]}}}