PatchRisk: Forecasting Future Vulnerability Exposure in Open-Source Dependency Networks

Open-source software ecosystems are web-scale dependency networks. A downstream package can become exposed to security risk not because its own source code changes, but because one of its transitive dependencies later receives a vulnerability advisory. Existing vulnerability-detection work often...