Lockfile Pin Summary (CSV)
Declared range against resolved version for every fictional package pinned by the lockfiles in this category — the table a review needs to see which pins drifted from their manifest ranges. Every package, version, hash and licence is fictional — the tree describes nothing real.
package,declared_range,resolved_version,depth,integrity_prefix
@orchard-example/router,^2.1.0,2.1.3,direct,sha512-qtnM4l9j8zUuqQ9IC...
@orchard-example/http-core,^1.8.0,1.8.0,direct,sha512-fG9AJmG+37+sln/eM...
example-metrics,^4.0.0,4.0.0,direct,sha512-Sq3cxZ+Brv4bgLd+5...
example-cache,^0.9.0,0.9.2,direct,sha512-AfwdCZmLEAUsc7Xx0...
example-crypto-shim,^1.2.0,1.2.0,direct,sha512-C9iqJP6f/S7V/NsRG...
example-logger,^3.4.0,3.4.1,transitive,sha512-kk/Leb1fYZthao23O...
example-retry,^1.0.0,1.0.4,transitive,sha512-9gWFnhD7XUYAeOv+2...
example-json-path,^2.0.0,2.0.5,transitive,sha512-L2s+lMlfrJzlz5234...
example-yaml-lite,^1.1.0,1.1.7,transitive,sha512-AjJT7N1g7ta4KaGEV...
Specifications
- Seed
- 51200
- Sample Only
- true
- Format
- CSV
- Columns
- 5
- Rows
- 9
- Delimiter
- ,
- Line Endings
- LF (documented, not RFC 4180 CRLF)
Testing contract
Reference control- Scenario
- Check that every resolved version satisfies the range its manifest declared.
- Expected result
- All 9 rows satisfy their caret ranges; the table is the reference answer for a resolver test run against the npm and pnpm lockfiles here.
What is a .csv file?
CSV (Comma-Separated Values) is a plain-text tabular format where rows are lines and fields are separated by commas, with quoting rules for values that contain delimiters, quotes, or newlines. It has no formal type system and depends on encoding and dialect conventions. It is the most portable format for tabular data exchange.
How to use this file
Use an example CSV to test parsers against quoting and embedded-delimiter edge cases, header handling, encoding detection, and import pipelines into databases or spreadsheets.
How to use this file for testing
“Lockfile Pin Summary (CSV)” is a deterministic Novus Examples fixture for CSV parsing, Data import, Conversion testing. Clean and deliberately messy CSVs — quoted commas, embedded newlines, ragged rows, odd delimiters, and encodings.
Documented properties for this file: seed 51200 · 9 rows · 5 columns · LF (documented, not RFC 4180 CRLF). Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
SBOM, lockfile, provenance, and advisory fixtures describe the same fabricated component tree across formats, so a converter or scanner can be diffed against a known answer. Every package name, version, hash, and advisory ID is invented — never treat a finding here as real.
Feed the file to your parser and assert it handles the documented quirks — quoted delimiters, embedded newlines, ragged rows, or invalid syntax; the valid↔invalid distinction is labelled in the title.
Code examples
import pandas as pd
df = pd.read_csv("lockfile-pin-summary.csv")
print(df.head())
print(df.dtypes)Related files
- csvSBOM Component Inventory (CSV)The same fictional component tree flattened to a spreadsheet-friendly CSV — name, version, licence, depth, purl and a SHA-256 prefix — for testing the export path SBOM tools offer alongside JSON. Every package, version, hash and licence is fictional — the tree describes nothing real.
- csvVulnerability Summary (CSV)The four SAMPLE advisories flattened to one row each — the export a security review circulates, and the reference answer for any converter run against the Trivy, Grype or OSV reports here. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
- csvCoverage — Per-File Table (CSV)The same coverage as a flat table with a TOTAL row, for spreadsheets, trend charts and diffing two runs without an XML parser. The TOTAL row is the arithmetic sum of the four file rows, so it doubles as a checksum on any tool that regenerates it. Every file in this group describes the same four-file source tree and reports 127/140 lines, 17/24 branch outcomes and 18/20 functions, so a converter can be diffed against a known answer.
- csvTest Case Matrix — Twelve Documented Cases (CSV)Twelve test cases with level, priority, the requirement each covers, preconditions, steps and expected result — the table a test-management import expects. Eleven of the twelve are automated, and the requirement column joins this file to the traceability matrix next to it.
- graphmlDependency Graph (GraphML)The dependency graph in GraphML, with typed attribute keys for node version, licence and depth and for edge range — the interchange format graph databases and analysis tools import. Every package, version, hash and licence is fictional — the tree describes nothing real.
- jsonlOSV Vulnerability Records (JSON Lines)All four SAMPLE advisories as newline-delimited OSV records — the bulk shape an advisory database is loaded from, where each line must parse independently. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
Generated by generation/supply_chain.py. Free for any use, no attribution required — license.