Replication package for "Just Pin It: Can Coding Agents Be Trusted to Choose Dependency Versions?"

Replication package for the study "Just Pin It: Can Coding Agents Be Trusted to Choose Dependency Versions?".The study reconstructs 50 dependency-introducing commits from 29 open-source Python repositories at their parent state, asks six Claude coding agents to add the same dependency under tool and network isolation, and scores each choice on a time-bounded, multidimensional correctness vector. Each pin is then challenged in a second conversational turn with a neutral prompt, a true defect, or a false alarm to separate genuine repair from sycophantic capitulation.This package contains the fifty-anchor source set in its frozen order, the per-run records for all 1,200 planned runs, the frozen analysis outputs behind every table and figure, the contamination-audit and double-coding material, the measurement and critique harness, the corpus miner, and the figure generation scripts.Every reported number regenerates from the deposited records with make verify-analysis. The analysis has exactly one third-party dependency (packaging==26.2); all statistics are implemented in pure Python. See README.md for the reproduction procedure and MANIFEST.md for the mapping from each paper artifact to the file that produced it, with SHA-256 checksums.The study protocol was preregistered on OSF (project 6kbrj) on 2026-07-13, before data collection (2026-07-13 to 2026-07-16).