{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,8]],"date-time":"2026-10-08T20:47:58Z","timestamp":1791492478098,"version":"4.3.4"},"publisher-location":"New York, NY, USA","reference-count":37,"publisher":"ACM","license":[{"start":{"date-parts":[[2026,3,23]],"date-time":"2026-03-23T00:00:00Z","timestamp":1774224000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2026,3,23]]},"DOI":"10.1145\/3748522.3779872","type":"proceedings-article","created":{"date-parts":[[2026,6,9]],"date-time":"2026-06-09T14:17:49Z","timestamp":1781014669000},"page":"2001-2008","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":1,"title":["A Large-Scale Study of Vulnerable Dependency Remediation in Java Projects"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0002-1554-9066","authenticated-orcid":false,"given":"Francisco Igor de Lima","family":"Mendes","sequence":"first","affiliation":[{"name":"Federal University of Campina Grande, Campina Grande, Para\u00edba, Brazil"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-4462-8188","authenticated-orcid":false,"given":"Cristov\u00e3o Pessoa C\u00e2ndido","family":"Neto","sequence":"additional","affiliation":[{"name":"Federal University of Campina Grande, Campina Grande, Para\u00edba, Brazil"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-7940-1311","authenticated-orcid":false,"given":"Sabrina Carlos","family":"Costa","sequence":"additional","affiliation":[{"name":"Federal Institute of Para\u00edba, Esperan\u00e7a, Para\u00edba, Brazil"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-9050-6467","authenticated-orcid":false,"given":"Thayane Stheffany Silva","family":"Barros","sequence":"additional","affiliation":[{"name":"Federal University of Campina Grande, Campina Grande, Para\u00edba, Brazil"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0007-1927-8378","authenticated-orcid":false,"given":"Thiago Santos de","family":"Moura","sequence":"additional","affiliation":[{"name":"Ruhr University Bochum, Bochum, Rhine\u2013Westphalia Land, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-7573-6933","authenticated-orcid":false,"given":"Gabriel Marreco Batista de","family":"Souto","sequence":"additional","affiliation":[{"name":"Federal University of Campina Grande, Campina Grande, Paraiba, Brazil"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-9277-486X","authenticated-orcid":false,"given":"Hugo Feitosa de","family":"Figueir\u00eado","sequence":"additional","affiliation":[{"name":"Federal Institute of Para\u00edba, Esperan\u00e7a, Para\u00edba, Brazil"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2200-1405","authenticated-orcid":false,"given":"Cl\u00e1udio de Souza","family":"Baptista","sequence":"additional","affiliation":[{"name":"Federal University of Campina Grande, Campina Grande, Para\u00edba, Brazil"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2026,6,9]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1109\/IC3I59117.2023.10397701"},{"key":"e_1_3_2_1_2_1","volume-title":"UPCY: Safely Updating Outdated Dependencies. https:\/\/ieeexplore.ieee.org\/document\/10172511","author":"Andreas Dann Eric Bodden","year":"2023","unstructured":"Eric Bodden Andreas Dann, Ben Hermann. 2023. UPCY: Safely Updating Outdated Dependencies. https:\/\/ieeexplore.ieee.org\/document\/10172511"},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1002\/stvr.1486"},{"key":"e_1_3_2_1_4_1","unstructured":"Nathalie Borglund. 2024. Security and Application Deployment using Docker."},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-021-09951-x"},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1109\/VizSec53666.2021.00014"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSR.2019.00061"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2023.3278129"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2021.111097"},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/3491263"},{"key":"e_1_3_2_1_11_1","volume-title":"Ahmad Abdellatif, and Emad Shihab.","author":"Jafari Abbas Javan","year":"2023","unstructured":"Abbas Javan Jafari, Diego Elias Costa, Ahmad Abdellatif, and Emad Shihab. 2023. Dependency Practices for Vulnerability Mitigation. arXiv preprint arXiv:2310.07847 (2023)."},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1145\/3691620.3695595"},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1145\/3597926.3598147"},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.5220\/0012710800003753"},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1109\/DSN48987.2021.00031"},{"key":"e_1_3_2_1_16_1","volume-title":"SAVANT: Vulnerability Detection in Application Dependencies through Semantic-Guided Reachability Analysis. arXiv preprint arXiv:2506.17798","author":"Lingxiang Wang","year":"2025","unstructured":"Wang Lingxiang, Quanzhi Fu, Wenjia Song, Gelei Deng, Yi Liu, Dan Williams, and Ying Zhang. 2025. SAVANT: Vulnerability Detection in Application Dependencies through Semantic-Guided Reachability Analysis. arXiv preprint arXiv:2506.17798 (2025)."},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1145\/3510003.3510142"},{"key":"e_1_3_2_1_18_1","volume-title":"Minimizing Breaking Changes and Redundancy in Mitigating Technical Lag for Java Projects. arXiv preprint arXiv:2511.06762","author":"Lu Rui","year":"2025","unstructured":"Rui Lu, Lyuye Zhang, Kaixuan Li, Min Zhang, and Yixiang Chen. 2025. Minimizing Breaking Changes and Redundancy in Mitigating Technical Lag for Java Projects. arXiv preprint arXiv:2511.06762 (2025)."},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.21608\/ijppe.2024.389252"},{"key":"e_1_3_2_1_20_1","volume-title":"An Overview and Catalogue of Dependency Challenges in Open Source Software Package Registries. arXiv preprint arXiv:2409.18884","author":"Mens Tom","year":"2024","unstructured":"Tom Mens and Alexandre Decan. 2024. An Overview and Catalogue of Dependency Challenges in Open Source Software Package Registries. arXiv preprint arXiv:2409.18884 (2024)."},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-025-10638-w"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/3613372.3613408"},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/3379597.3387476"},{"key":"e_1_3_2_1_24_1","unstructured":"Donald Pinckney Federico Cassano Arjun Guha and Jonathan Bell. 2023. A Large Scale Analysis of Semantic Versioning in NPM. arXiv:2304.00394 [cs.SE] https:\/\/arxiv.org\/abs\/2304.00394"},{"key":"e_1_3_2_1_25_1","unstructured":"Imranur Rahman Nusrat Zahan Stephen Magill William Enck and Laurie Williams. 2024. Characterizing Dependency Update Practice of NPM PyPI and Cargo Packages. arXiv:2403.17382 [cs.SE] https:\/\/arxiv.org\/abs\/2403.17382"},{"key":"e_1_3_2_1_26_1","volume-title":"Leveraging the Crowd for Dependency Management: An Empirical Study on the Dependabot Compatibility Score. arXiv preprint arXiv:2403.09012","author":"Rombaut Benjamin","year":"2024","unstructured":"Benjamin Rombaut, Filipe R Cogo, and Ahmed E Hassan. 2024. Leveraging the Crowd for Dependency Management: An Empirical Study on the Dependabot Compatibility Score. arXiv preprint arXiv:2403.09012 (2024)."},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1109\/ESEM.2009.5314220"},{"key":"e_1_3_2_1_28_1","volume-title":"Understanding Similarities and Differences Between Software Composition Analysis Tools","author":"Sharma Pranet","year":"2024","unstructured":"Pranet Sharma, Zhenpeng Shi, \u015eevval \u015eim\u015fek, David Starobinski, and David Sastre Medina. 2024. Understanding Similarities and Differences Between Software Composition Analysis Tools. IEEE Security & Privacy (2024)."},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-020-09914-8"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/3551349.3560432"},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1109\/MINES.2011.27"},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"crossref","unstructured":"Julia Wunder Andreas Kurtz Christian Eichenm\u00fcller Freya Gassmann and Zinaida Benenson. 2024. Shedding Light on CVSS Scoring Inconsistencies: A User-Centric Study on Evaluating Widespread Security Vulnerabilities. arXiv:2308.15259 [cs.CR] https:\/\/arxiv.org\/abs\/2308.15259","DOI":"10.1109\/SP54263.2024.00058"},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1145\/3609437.3609447"},{"key":"e_1_3_2_1_34_1","volume-title":"A Survey of Third-Party Library Security Research in Application Software. arXiv preprint arXiv:2404.17955","author":"Zeng Jia","year":"2024","unstructured":"Jia Zeng, Dan Han, Yaling Zhu, Yangzhong Wang, and Fangchen Weng. 2024. A Survey of Third-Party Library Security Research in Application Software. arXiv preprint arXiv:2404.17955 (2024)."},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"crossref","unstructured":"Lyuye Zhang Chengwei Liu Zhengzi Xu Sen Chen Lingling Fan Lida Zhao Jiahui Wu and Yang Liu. 2023. Compatible Remediation on Vulnerabilities from Third-Party Libraries for Java Projects. https:\/\/arxiv.org\/abs\/2301.08434","DOI":"10.1109\/ICSE48619.2023.00212"},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1145\/3611643.3616299"},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSME58944.2024.00014"}],"event":{"name":"SAC '26: 41st ACM\/SIGAPP Symposium on Applied Computing","location":"Grand Hotel Palace Thessaloniki Greece","acronym":"SAC '26","sponsor":["SIGAPP ACM Special Interest Group on Applied Computing"]},"container-title":["Proceedings of the 41st ACM\/SIGAPP Symposium on Applied Computing"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3748522.3779872","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,9]],"date-time":"2026-06-09T14:18:15Z","timestamp":1781014695000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3748522.3779872"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,3,23]]},"references-count":37,"alternative-id":["10.1145\/3748522.3779872","10.1145\/3748522"],"URL":"https:\/\/doi.org\/10.1145\/3748522.3779872","relation":{},"subject":[],"published":{"date-parts":[[2026,3,23]]},"assertion":[{"value":"2026-06-09","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}