Replication package for: How advisory feed choice changes budget constrained dependency upgrades

Replication package for the study "How advisory feed choice changes budget constrained dependency upgrades". The study compares paired vulnerability advisory feeds on the same GitHub repositories while holding the dependency state, registry releases, cutoff and a deterministic upgrade planner (budget k = 3) fixed. For npm it compares GitHub Advisory Database records with OSV npm records. For PyPI it compares the PyPA Advisory Database with OSV PyPI records. A secondary PyPI contrast compares GitHub Advisory Database PyPI records with PyPA. Selected upgrades differed in 25 of 189 npm repositories and 80 of 179 PyPI repositories. Contents: - Study code and test suite (Python 3.13.7). - Frozen study protocol, analysis plans and amendments. - Sampling frame, formal sample and reserve. - Sealed inputs for 376 repositories, collected in the 72-hour window starting 2026-10-20T17:16:56Z, with SHA-256 checksums. - Formal comparison results, mechanism traces and semantic field audits. - Mechanism, statistics and sensitivity outputs, tables and figures. README.md describes the layout, environment, data verification and how to run the tests. MODIFIED_FILES.md lists the six files that differ from the study repository and why. Third-party content (advisory records, package-registry metadata, and lockfiles and manifests from the sampled public repositories) remains under its original licences.