{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,16]],"date-time":"2026-10-16T02:58:29Z","timestamp":1792119509106,"version":"4.4.0"},"publisher-location":"New York, NY, USA","reference-count":55,"publisher":"ACM","license":[{"start":{"date-parts":[[2024,4,12]],"date-time":"2024-04-12T00:00:00Z","timestamp":1712880000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"RIE2020 Industry Alignment Fund Industry Collaboration Projects (IAF-ICP)"},{"name":"DSO National Laboratories under the AI Singapore Programme","award":["AISG2-GC-2023-008"],"award-info":[{"award-number":["AISG2-GC-2023-008"]}]},{"name":"Cyber Security Agency under its National Cybersecurity R&D Programme","award":["NCRP25-P04-TAICeN"],"award-info":[{"award-number":["NCRP25-P04-TAICeN"]}]},{"name":"NRF Investigatorship","award":["NRF-NRFI06-2020-0001"],"award-info":[{"award-number":["NRF-NRFI06-2020-0001"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2024,4,12]]},"DOI":"10.1145\/3597503.3639230","type":"proceedings-article","created":{"date-parts":[[2024,4,12]],"date-time":"2024-04-12T16:43:26Z","timestamp":1712940206000},"page":"1-13","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":24,"title":["Empirical Analysis of Vulnerabilities Life Cycle in Golang Ecosystem"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-1483-8854","authenticated-orcid":false,"given":"Jinchang","family":"Hu","sequence":"first","affiliation":[{"name":"Army Engineering University of PLA, Nanjing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3087-9645","authenticated-orcid":false,"given":"Lyuye","family":"Zhang","sequence":"additional","affiliation":[{"name":"Nanyang Technological University, Singapore, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1175-2753","authenticated-orcid":false,"given":"Chengwei","family":"Liu","sequence":"additional","affiliation":[{"name":"Nanyang Technological University, Singapore, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2263-8000","authenticated-orcid":false,"given":"Sen","family":"Yang","sequence":"additional","affiliation":[{"name":"Academy of Military Science, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6894-3916","authenticated-orcid":false,"given":"Song","family":"Huang","sequence":"additional","affiliation":[{"name":"Army Engineering University of PLA, Nanjing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7300-9215","authenticated-orcid":false,"given":"Yang","family":"Liu","sequence":"additional","affiliation":[{"name":"Nanyang Technological University, Singapore, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2024,4,12]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"2021. Semantic Versioning. https:\/\/semver.org"},{"key":"e_1_3_2_1_2_1","unstructured":"2023. About - Git. https:\/\/git-scm.com\/about\/info-assurance (Accessed on 03\/29\/2023)."},{"key":"e_1_3_2_1_3_1","unstructured":"2023. About Dependabot version updates - GitHub Docs. https:\/\/docs.github.com\/en\/code-security\/dependabot\/dependabot-version-updates\/about-dependabot-version-updates (Accessed on 11\/08\/2023)."},{"key":"e_1_3_2_1_4_1","unstructured":"2023. BigQuery dataset | Open Source Insights. https:\/\/docs.deps.dev\/bigquery\/v1\/. (Accessed on 11\/17\/2023)."},{"key":"e_1_3_2_1_5_1","unstructured":"2023. CVE Record | CVE. https:\/\/www.cve.org\/CVERecord?id=CVE-2022-41723 (Accessed on 11\/17\/2023)."},{"key":"e_1_3_2_1_6_1","unstructured":"2023. Dataset. https:\/\/sites.google.com\/view\/vulnerabilities-life-cycle\/ (Accessed on 07\/29\/2023)."},{"key":"e_1_3_2_1_7_1","unstructured":"2023. Dependabot. https:\/\/github.com\/dependabot"},{"key":"e_1_3_2_1_8_1","unstructured":"2023. dependabot-core\/go_modules\/lib\/dependabot\/go_modules\/update _checker\/latest_version_finder.rb at main \u00b7 dependabot\/dependabot-core. https:\/\/github.com\/dependabot\/dependabot-core\/blob\/main\/go_modules\/lib\/dependabot\/go_modules\/update_checker\/latest_version_finder.rb#L67 (Accessed on 11\/08\/2023)."},{"key":"e_1_3_2_1_9_1","unstructured":"2023. dependabot-core\/go_modules\/lib\/dependabot\/go_modules\/update _checker\/latest_version_finder.rb at main \u00b7 dependabot\/dependabot-core. https:\/\/github.com\/dependabot\/dependabot-core\/blob\/main\/go_modules\/lib\/dependabot\/go_modules\/update_checker\/latest_version_finder.rb#L96 (Accessed on 11\/09\/2023)."},{"key":"e_1_3_2_1_10_1","unstructured":"2023. GitHub Advisory Database. https:\/\/github.com\/advisories"},{"key":"e_1_3_2_1_11_1","unstructured":"2023. GO-2023-1571 | osv | Open Source Insights. https:\/\/deps.dev\/advisory\/osv\/GO-2023-1571 (Accessed on 03\/25\/2023)."},{"key":"e_1_3_2_1_12_1","unstructured":"2023. Go Modules Reference - Module-Proxy. https:\/\/go.dev\/ref\/mod#module-proxy (Accessed on 03\/25\/2023)."},{"key":"e_1_3_2_1_13_1","unstructured":"2023. Go Modules Reference - Modules. https:\/\/go.dev\/ref\/mod#modules-overview (Accessed on 03\/25\/2023)."},{"key":"e_1_3_2_1_14_1","unstructured":"2023. Go Modules Reference - Pseudo-Versions. https:\/\/go.dev\/ref\/mod#pseudo-versions (Accessed on 03\/24\/2023)."},{"key":"e_1_3_2_1_15_1","unstructured":"2023. Go Modules Reference - Versions. https:\/\/go.dev\/ref\/mod#versions (Accessed on 07\/29\/2023)."},{"key":"e_1_3_2_1_16_1","unstructured":"2023. Go modules services. https:\/\/proxy.golang.org\/ (Accessed on 03\/27\/2023)."},{"key":"e_1_3_2_1_17_1","unstructured":"2023. https:\/\/index.golang.org\/index?since=. https:\/\/index.golang.org\/index?since= (Accessed on 03\/29\/2023)."},{"key":"e_1_3_2_1_18_1","unstructured":"2023. Libraries.io. https:\/\/libraries.io\/"},{"key":"e_1_3_2_1_19_1","unstructured":"2023. NVD - Home. https:\/\/nvd.nist.gov\/ (Accessed on 03\/29\/2023)."},{"key":"e_1_3_2_1_20_1","unstructured":"2023. OSV. https:\/\/osv.dev\/ (Accessed on 03\/25\/2023)."},{"key":"e_1_3_2_1_21_1","unstructured":"2023. Quartiles & Quantiles | Calculation Definition & Interpretation. https:\/\/www.scribbr.com\/statistics\/quartiles-quantiles\/ (Accessed on 11\/11\/2023)."},{"key":"e_1_3_2_1_22_1","unstructured":"2023. Semantic Version Tags in go.mod File | by Shivam Rathore | The Startup | Medium. https:\/\/medium.com\/swlh\/semantic-version-tags-in-go-mod-file-f6ad903a972d. (Accessed on 11\/17\/2023)."},{"key":"e_1_3_2_1_23_1","unstructured":"2023. Snyk | Developer security | Develop fast. Stay secure. | Snyk. https:\/\/snyk.io\/ (Accessed on 03\/29\/2023)."},{"key":"e_1_3_2_1_24_1","unstructured":"2023. Software Composition Analysis. https:\/\/snyk.io\/series\/open-source-security\/software-composition-analysis-sca\/"},{"key":"e_1_3_2_1_25_1","unstructured":"2023. Understanding Dependency Management in Go. https:\/\/lucasfcosta.com\/2017\/02\/07\/Understanding-Go-Dependency-Management.html. (Accessed on 11\/17\/2023)."},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-022-10278-4"},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSR52588.2021.00037"},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-021-09951-x"},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1109\/MS.2022.3179484"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-021-09980-6"},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSME.2018.00050"},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1145\/3196398.3196401"},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.5555\/3364306"},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1145\/3387940.3392202"},{"key":"e_1_3_2_1_35_1","volume-title":"Open or Sneaky? Fast or Slow? Light or Heavy?: Investigating Security Releases of Open Source Packages","author":"Imtiaz Nasif","year":"2022","unstructured":"Nasif Imtiaz, Aniqa Khanom, and Laurie Williams. 2022. Open or Sneaky? Fast or Slow? Light or Heavy?: Investigating Security Releases of Open Source Packages. IEEE Transactions on Software Engineering (2022)."},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-017-9521-5"},{"key":"e_1_3_2_1_37_1","unstructured":"Chenghao Li Yifei Wu Wenbo Shen Zichen Zhao Rui Chang Chengwei Liu Yang Liu and Kui Ren. 2023. Demystifying Compiler Unstable Feature Usage and Impacts in the Rust Ecosystem. arXiv:2310.17186 [cs.SE]"},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1145\/3510003.3510142"},{"key":"e_1_3_2_1_39_1","first-page":"1","article-title":"Out of sight, out of mind? How vulnerable dependencies affect open-source projects","volume":"26","author":"Azriadi Prana Gede Artha","year":"2021","unstructured":"Gede Artha Azriadi Prana, Abhishek Sharma, Lwin Khin Shar, Darius Foo, Andrew E Santosa, Asankhaya Sharma, and David Lo. 2021. Out of sight, out of mind? How vulnerable dependencies affect open-source projects. Empirical Software Engineering 26 (2021), 1--34.","journal-title":"Empirical Software Engineering"},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1145\/3510003.3510216"},{"key":"e_1_3_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2019.2893950"},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1109\/APSEC51365.2020.00031"},{"key":"e_1_3_2_1_43_1","doi-asserted-by":"publisher","unstructured":"Kairan Sun Zhengzi Xu Chengwei Liu Kaixuan Li and Yang Liu. 2023. Demystifying the Composition and Code Reuse in Solidity Smart Contracts. In Proceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (<conf-loc> <city>San Francisco<\/city> <state>CA<\/state> <country>USA<\/country> <\/conf-loc>) (ESEC\/FSE 2023). Association for Computing Machinery New York NY USA 796--807. 10.1145\/3611643.3616270","DOI":"10.1145\/3611643.3616270"},{"key":"e_1_3_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1145\/3485447.3512236"},{"key":"e_1_3_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1145\/3551349.3560432"},{"key":"e_1_3_2_1_46_1","volume-title":"Hero: On the Chaos When PATH Meets Modules. In 2021 IEEE\/ACM 43rd International Conference on Software Engineering (ICSE). IEEE, 99--111","author":"Wang Ying","year":"2021","unstructured":"Ying Wang, Liang Qiao, Chang Xu, Yepang Liu, Shing-Chi Cheung, Na Meng, Hai Yu, and Zhiliang Zhu. 2021. Hero: On the Chaos When PATH Meets Modules. In 2021 IEEE\/ACM 43rd International Conference on Software Engineering (ICSE). IEEE, 99--111."},{"key":"e_1_3_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE48619.2023.00034"},{"key":"e_1_3_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE48619.2023.00095"},{"key":"e_1_3_2_1_49_1","volume-title":"Insight: Exploring Cross-Ecosystem Vulnerability Impacts. In 37th IEEE\/ACM International Conference on Automated Software Engineering. 1--13","author":"Xu Meiqiu","year":"2022","unstructured":"Meiqiu Xu, Ying Wang, Shing-Chi Cheung, Hai Yu, and Zhiliang Zhu. 2022. Insight: Exploring Cross-Ecosystem Vulnerability Impacts. In 37th IEEE\/ACM International Conference on Automated Software Engineering. 1--13."},{"key":"e_1_3_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1002\/smr.2157"},{"key":"e_1_3_2_1_51_1","volume-title":"Mitigating persistence of open-source vulnerabilities in maven ecosystem. arXiv preprint arXiv:2308.03419","author":"Zhang Lyuye","year":"2023","unstructured":"Lyuye Zhang, Chengwei Liu, Sen Chen, Zhengzi Xu, Lingling Fan, Lida Zhao, Yiran Zhang, and Yang Liu. 2023. Mitigating persistence of open-source vulnerabilities in maven ecosystem. arXiv preprint arXiv:2308.03419 (2023)."},{"key":"e_1_3_2_1_52_1","volume-title":"Static Detection Based on Semantic Differencing. In 37th IEEE\/ACM International Conference on Automated Software Engineering. 1--12","author":"Zhang Lyuye","year":"2022","unstructured":"Lyuye Zhang, Chengwei Liu, Zhengzi Xu, Sen Chen, Lingling Fan, Bihuan Chen, and Yang Liu. 2022. Has My Release Disobeyed Semantic Versioning? Static Detection Based on Semantic Differencing. In 37th IEEE\/ACM International Conference on Automated Software Engineering. 1--12."},{"key":"e_1_3_2_1_53_1","volume-title":"Compatible Remediation on Vulnerabilities from Third-Party Libraries for Java Projects. arXiv preprint arXiv:2301.08434","author":"Zhang Lyuye","year":"2023","unstructured":"Lyuye Zhang, Chengwei Liu, Zhengzi Xu, Sen Chen, Lingling Fan, Lida Zhao, Jiahui Wu, and Yang Liu. 2023. Compatible Remediation on Vulnerabilities from Third-Party Libraries for Java Projects. arXiv preprint arXiv:2301.08434 (2023)."},{"key":"e_1_3_2_1_54_1","doi-asserted-by":"publisher","DOI":"10.1145\/3611643.3616299"},{"key":"e_1_3_2_1_55_1","volume-title":"USENIX security symposium","author":"Zimmermann Markus","unstructured":"Markus Zimmermann, Cristian-Alexandru Staicu, Cam Tenny, and Michael Pradel. 2019. Small World with High Risks: A Study of Security Threats in the npm Ecosystem.. In USENIX security symposium, Vol. 17."}],"event":{"name":"ICSE '24: IEEE\/ACM 46th International Conference on Software Engineering","location":"Lisbon Portugal","acronym":"ICSE '24","sponsor":["SIGSOFT ACM Special Interest Group on Software Engineering","IEEE CS","Faculty of Engineering of University of Porto"]},"container-title":["Proceedings of the IEEE\/ACM 46th International Conference on Software Engineering"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3597503.3639230","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3597503.3639230","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T22:50:12Z","timestamp":1750287012000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3597503.3639230"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,4,12]]},"references-count":55,"alternative-id":["10.1145\/3597503.3639230","10.1145\/3597503"],"URL":"https:\/\/doi.org\/10.1145\/3597503.3639230","relation":{},"subject":[],"published":{"date-parts":[[2024,4,12]]},"assertion":[{"value":"2024-04-12","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}