CANARY: Jenkins Plugin Security-Advisory Forecasting — Dataset and Model Artifacts (v0.1.17)

Abstract

Labeled plugin-month datasets, trained model artifacts, and evaluation outputs for CANARY, a public-data-first framework for forecasting security advisories in the Jenkins plugin ecosystem. The master dataset covers 2,053 plugins as monthly observations (2018-01 to 2026-06 in this version); each row carries features constructed only from information available at the observation date, with a binary label indicating whether a security advisory was published for the plugin within the following 180 days. Feature families span advisory history, plugin ecosystem metadata, GitHub Archive activity signals, repository governance indicators, historically anchored Software Heritage repository and revision features, and, new in this version, the enrichment families of the honest evaluation layer (activity-recency clocks, contributor dynamics, install base from stats.jenkins.io, advisory recurrence, security-vocabulary text signals, and Software Heritage visit deltas). This version adds a second evaluation layer alongside the original. The historical / diagnostic layer is the 64-configuration model suite evaluated under a standard chronological split, retained in full together with its label-embargoed twin; a label-leakage audit showed those numbers to be structurally optimistic for this task (entity-level label overlap across the train/test boundary and advisory-label maturity). The honest layer is the set of embargoed rolling-origin backtests — a 13-fold development sweep on 2023–2025 (760 advisory-positive plugin-months) and a pre-registered out-of-time evaluation of the frozen configurations on three untouched folds in July–December 2025 (127 positives), each run once — together with the pre-registration document (panel_extension_protocol.md) whose dated changelog records every decision and deviation. The bundle includes per-family dataset variants used in ablation experiments, the enriched panels with their completion markers, the full saved model suite (XGBoost, LightGBM, Random Forest, logistic regression across feature-family configurations and split strategies) with per-model metrics and test predictions, every rolling-backtest run directory with per-fold artifacts and pooled metrics, and the analysis result files behind the reported figures and tables. Code, pipeline, and documentation: https://github.com/timmybx/canary (tag v0.1.17). All data derives from public sources. See DATASET_README.md for the two-layer reading guide, file inventory, checksums, and reproduction steps.