VulnBump1.0 draft
Menu

Data

Take the datawith you.

The files below are generated from the same validated dataset that draws every chart, so downloads and figures cannot drift apart.

  • JSON

    Full dataset

    Every figure and table on this site: gates, paired results, the split by Snyk's advice, root causes, version jumps, package managers, breakdowns, dataset selection, cost, and integrity.

    Download
  • CSV

    Head-to-head

    One row per harness: gate and PASS rates, the macro PASS rate, gate-by-gate counts, latency, and cost.

    Download
  • CSV

    By package manager

    One row per agent and package manager, with the pooled and per-repository (macro) PASS rates.

    Download
  • CSV

    By vulnerability

    Per-vulnerability fix and pass rates by fix difficulty, dependency type, package manager, and severity, plus the package manager bump's pass rates where the paper reports them.

    Download

License

Research artifacts are provided under the Apache License 2.0. Rates are stored as fractions between 0 and 1. Figures are computed from the three harness reports and match the VulnBump paper; per-attempt records, prompts, logs, and diffs stay in the benchmark repository and are not published here. See the methodology for metric definitions.

Cite it

Preferred citation

@misc{pasiunaite2026vulnbump,
  author = {Gabija Pasiunaite and Ryan McMorrow and Brian Clark and Liran Tal and Luke Tu},
  title = {VulnBump: A Benchmark for Fixing Vulnerable Dependencies in Real Projects While Keeping the Build and Tests Green},
  howpublished = {Snyk},
  year = {2026}
}