Replication Package for "Same Dependency, Different Decision: Cross-Source and Temporal Reproducibility of Open-Source Vulnerability Intelligence"

Replication package for the study “Same Dependency, Different Decision: Cross-Source and Temporal Reproducibility of Open-Source Vulnerability Intelligence.” The package contains the acquisition, normalisation, decision-evaluation and analysis code; provenance manifests; registry-derived version lists; cross-source and temporal analysis exports; root-cause classifications; audit materials for 110 sampled cases; unit tests; and scripts required to regenerate the reported tables and figures. Vulnerability advisory source data are retrieved from their original public sources using the immutable identifiers recorded in the package.