Problem statement
A vulnerable dependency does not become remediated just because its severity is known. A usable fix, the consumer project’s readiness to adopt it and the maintenance context of the upstream dependency can all shape when remediation becomes possible and when it actually happens.
My current thesis direction asks whether historical upstream maintenance signals add useful prospective information about remediation timing beyond vulnerability, remediation and consumer-project characteristics.
Working research question
To what extent do upstream dependency maintenance signals improve the prediction of vulnerable-dependency remediation latency beyond vulnerability characteristics, remediation characteristics, and consumer-project remediation readiness?
This is the current working question, not a frozen conclusion. The exact wording and outcome clock remain under validation while I test whether the data can support the comparison without temporal leakage.
Research design
The candidate design compares nested evidence sets: M0 starts with vulnerability and remediation characteristics, M1 adds consumer-project remediation readiness, and M2 adds upstream maintenance signals. The useful question is whether M2 provides stable incremental value under out-of-time validation. The final model family is not selected in advance.
Signals under study
Data feasibility
The baseline is restricted to open data. npm is the first feasibility ecosystem; the thesis may later extend beyond npm. The pilot is testing whether vulnerable-dependency episodes, remediation opportunities and observation-time features can be reconstructed consistently enough for a prospective study.
Current status
The initial literature review changed my original thesis direction instead of confirming it. Current work is mapping the closest competing evidence, validating the data pipeline and deciding whether the proposed outcome can be measured cleanly. The final research question, outcome definition and model family remain deliberately open until that evidence is strong enough.
Decisions still open
