When the File Changes Under You: The Case for Immutable Data Releases
Photo: Florian Hirzinger - www.fh-ap.com, CC BY-SA 3.0, via Wikimedia Commons
In 2026, a researcher downloads a dataset cited in a 2021 paper. The DOI resolves. The landing page looks familiar. The file name is identical. But the row count has changed, a key variable has been recoded, and a footnote about a correction appears nowhere. The published result no longer reproduces. The citation, however, remains intact.
This is silent dataset revision: the practice of updating files in place without a visible version, a change log, or a new identifier. It is common because it is convenient. It is damaging because it breaks the chain between what a paper analyzed and what a reader can obtain today.
The Quiet Mechanics of In-Place Revision
Many repositories allow depositors to replace files under the same landing page. Some support versioning, but do not require it. A depositor who fixes a coding error may see the update as a service. A downstream analyst sees a different dataset. If the change is not announced, the difference is invisible until someone tries to reproduce a table.
DOIs are often treated as guarantees of stability. They are not. A DOI is a persistent identifier that resolves to a location or landing page. It does not, by itself, guarantee that the content behind that page is immutable. The distinction matters because citations usually point to the identifier, not to a checksum.
How Revision Propagates Through the Literature
A single silent revision can travel far. A meta-analysis may pool effect sizes from studies that used different versions of the same dataset. A review may cite a dataset as evidence for a variable that was later recoded. A teaching module may use a file that no longer matches its answer key. None of these errors requires misconduct. They require only an ordinary correction made without a public record.
The problem compounds because most readers do not re-download data. They trust the citation. When the citation resolves, they assume the data are the same. That assumption is reasonable, but it is not currently safe. In fields where datasets are updated frequently, the published literature can become a set of claims about files that no longer exist in the form the authors saw.
A DOI Is Not a Release
A release is a fixed object: a specific set of files, with a manifest, checksums, a date, and a change log. A DOI can point to a release, but only if the repository enforces immutability or versioned deposits. A concept DOI may point to the latest version, which is useful for discovery but dangerous for citation. A version DOI points to a specific release, which is what reproducibility requires.
The practical difference is simple. If a reader can download two files from the same DOI on two dates and get different bytes, the DOI is not functioning as a stable citation. It may still be a useful locator, but it is not an immutable release.
What Immutable Releases Require
Repositories should prohibit overwriting published files. Corrections should create a new version with a new version DOI, a visible change log, and a clear statement of what changed and why. The prior version should remain accessible, even if deprecated. Authors should deposit the exact data and code used for a publication, tag the release, and record checksums in the manuscript or supplement.
Journals and reviewers have a role as well. A data availability statement that says the data are available at a DOI is not enough. It should state which version was used. Reviewers who check reproducibility should be able to verify that the cited release is the one the analysis consumed.
The Cost of Doing Nothing
The cost is not abstract. Meta-analyses can inherit errors from upstream revisions. Expensive cohorts can be re-analyzed on data that no longer match their documentation. Early-career researchers can spend weeks chasing discrepancies that a changelog would have explained in a paragraph. Public trust in open data depends on the reasonable expectation that a citation means something stable.
At BAM Dataset, immutability is not a boutique feature for well-funded archives. It is a baseline norm for any dataset that expects to be cited. Open science without stable releases is merely convenient access to a moving target. The fix is neither exotic nor expensive: stop overwriting, start versioning, publish the change log, and cite the release.
