npm package-lock.json (lockfileVersion 2, Dual Layout)
The transitional npm v2 lockfile, which carries BOTH the v3 packages map and the legacy nested dependencies tree describing the same fictional install — the case where a parser must not double-count. Every package, version, hash and licence is fictional — the tree describes nothing real.
{
"name": "orchard-gateway",
"version": "4.2.0",
"lockfileVersion": 2,
"requires": true,
"packages": {
"": {
"name": "orchard-gateway",
"version": "4.2.0",
"license": "Apache-2.0",
"dependencies": {
"@orchard-example/router": "^2.1.0",
"@orchard-example/http-core": "^1.8.0",
"example-metrics": "^4.0.0",
"example-cache": "^0.9.0",
"example-crypto-shim": "^1.2.0"
},
"engines": {
"node": ">=20.9"
}
},
"node_modules/@orchard-example/router": {
"version": "2.1.3",
"resolved": "https://registry.orchard.example/@orchard-example/router/-/router-2.1.3.tgz",
"integrity": "sha512-qtnM4l9j8zUuqQ9ICsxCdfl879PtducHYPiqO151qEu6bBv48+zuYbTbn/vSTJGbCd2RvGpDry/NEkSe1babaA==",
"license": "Apache-2.0",
"dependencies": {
"example-logger": "^3.4.0",
"example-retry": "^1.0.0"
}
},
"node_modules/@orchard-example/http-core": {
"version": "1.8.0",
"resolved": "https://registry.orchard.example/@orchard-example/http-core/-/http-core-1.8.0.tgz",
"integrity": "sha512-fG9AJmG+37+sln/eMVPmbu/bIcV+QbJ3bibSV9ob8PV6GYNFinrhSJQYFxkEYEHxckXBn7ExDim59rqSDaYoFg==",
"license": "MIT",
"dependencies": {
"example-logger": "^3.4.0",
"example-json-path": "^2.0.0"
}
},
"node_modules/example-metrics": {
"version": "4.0.0",
"resolved": "https://registry.orchard.example/example-metrics/-/example-metrics-4.0.0.tgz",
"integrity": "sha512-Sq3cxZ+Brv4bgLd+5B/o3upQ1O6YKjbr6TP5ZBZfw4XVjna6/8YkOeB52iLhrRDjs1UiF5v20Ijr7bEJtHKcOQ==",
"license": "MIT",
"dependencies": {
"example-logger": "^3.4.0"
}
},Specifications
- Seed
- 51200
- Sample Only
- true
- Ecosystem
- npm
- Lockfile Version
- 2
- Sections
- packages + dependencies
- Line Endings
- LF
Testing contract
Expected to pass- Scenario
- Parse a v2 lockfile that duplicates the tree in two sections.
- Expected result
- Tool reads one section, reports 9 dependencies, and does not emit 18 packages by merging both layouts.
What is a .json file?
JSON (JavaScript Object Notation) is a lightweight, text-based data-interchange format representing objects, arrays, strings, numbers, booleans, and null. It is language-independent, human-readable, and the dominant format for web APIs and configuration. It requires a single well-formed root value.
How to use this file
Use an example JSON file to test parsers and serializers, schema validation, Unicode and number-precision handling, and API request or response processing.
How to use this file for testing
“npm package-lock.json (lockfileVersion 2, Dual Layout)” is a deterministic Novus Examples fixture for JSON parsing, Conversion testing, Error handling. Flat, deeply nested, JSON Lines, and intentionally invalid JSON for testing parsers and error handling.
Documented properties for this file: seed 51200 · LF. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
SBOM, lockfile, provenance, and advisory fixtures describe the same fabricated component tree across formats, so a converter or scanner can be diffed against a known answer. Every package name, version, hash, and advisory ID is invented — never treat a finding here as real.
Feed the file to your parser and assert it handles the documented quirks — quoted delimiters, embedded newlines, ragged rows, or invalid syntax; the valid↔invalid distinction is labelled in the title.
Code examples
import json
with open("package-lock-v2.json") as f:
data = json.load(f)
print(type(data), len(data))Related files
- jsonnpm audit Report (v1, Legacy Shape)The legacy npm audit shape — numeric advisory ids, a separate actions array and dependency paths written with '>' — which tools built for the v2 report silently read as zero findings. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
- jsonpip-audit Report (JSON)A pip-audit report for the fictional Python packages. It deliberately carries no severity field — pip-audit does not assign one — which is the case a severity gate must handle without defaulting to critical. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
- jsonCucumber JSON — Failing Step with Stack TraceOne step of one scenario fails with an assertion message and a stack frame; every other step passes. In cucumber.json a scenario has no status of its own — it is failed if any of its steps is — so this file catches reporters that look for a scenario-level field that does not exist.
- jsonCucumber JSON — Undefined, Pending and Skipped StepsThe three non-failure statuses BDD runners produce and dashboards routinely collapse into "failed": undefined (no step definition matched), pending (explicitly unimplemented) and skipped (never attempted). Whether the run is red depends on the runner's strict setting, which is exactly the decision this file forces.
- ndjsonCucumber Messages — Failing Run (NDJSON)The messages twin of the failing run: one testStepFinished carries status FAILED with both a human message and a structured exception object, and testRunFinished reports success false. Comparing it with the passing stream in the other group isolates exactly which envelopes a failure changes.
- jsonJest — JSON ResultsJest's --json output, where skipped tests are called pending and the totals appear as flat numTotal/numPassed/numFailed fields alongside per-file assertionResults. Timestamps are epoch milliseconds rather than ISO strings, which is the field most converters mis-handle. Reports the same canonical run as the JUnit dialect files: 12 tests, 9 passed, 1 assertion failure, 1 error and 1 skip.
Generated by generation/supply_chain.py. Free for any use, no attribution required — license.