packages.lock.json (NuGet)
A NuGet lockfile keyed by target framework, distinguishing Direct from Transitive entries and recording a base64 contentHash for each fictional package. Every package, version, hash and licence is fictional — the tree describes nothing real.
{
"version": 1,
"dependencies": {
"net8.0": {
"Example.Router": {
"type": "Direct",
"resolved": "2.1.3",
"contentHash": "2onDN/bXQkeHbPZFPcF9tc2YIU+LcDnq7gdgqzvlnVRqHhYQVgpXh5NWaCaXCLX4ey0GFLM3L7X39dzn5fL/PA==",
"requested": "[2.1.3, )",
"dependencies": {
"Example.Logger": "3.4.1",
"Example.Retry": "1.0.4"
}
},
"Example.HttpCore": {
"type": "Direct",
"resolved": "1.8.0",
"contentHash": "cDcUfzohvEiIFHvlWyarKTWj4lBcTZRsLbebHFqlsCb3NGN9yzd5ni4Xn8xpwLxl3IaWvVevu44/Gp2OgVyqKQ==",
"requested": "[1.8.0, )",
"dependencies": {
"Example.Logger": "3.4.1",
"Example.Jsonpath": "2.0.5"
}
},
"Example.Metrics": {
"type": "Direct",
"resolved": "4.0.0",
"contentHash": "wgLekQ5NcUDaCyh3NFlX29ln/OTtW6oswRzLklYKyxn1qQod0O4teDRlPIKjfpQBm9HG2GmOJK0DoVpQKmJ/Mg==",
"requested": "[4.0.0, )",
"dependencies": {
"Example.Logger": "3.4.1"
}
},
"Example.Cache": {
"type": "Direct",
"resolved": "0.9.2",
"contentHash": "gk/tM9CRH8PS1fJLSbJsO2/mUpqT55awQ8ICV+R1PGSt/Hm+SGxc6eHSHOE8a2RvI+0RymBdotJ/U2v9/h/M9g==",
"requested": "[0.9.2, )",
"dependencies": {
"Example.Yamllite": "1.1.7"
}
},
"Example.Crypto": {
"type": "Direct",
"resolved": "1.2.0",
"contentHash": "68a4jZjr7KXFgHsyHyX6oT67JrBoQEFIS7LyGR9qB2+b7LQLcQXae1khU8qCdEFnAhM3N6X6mpyWnrkHK38Qbw==",
"requested": "[1.2.0, )"
},
"Example.Logger": {
"type": "Transitive",Specifications
- Seed
- 51200
- Sample Only
- true
- Ecosystem
- NuGet
- Lock Version
- 1
- Target Framework
- net8.0
- Packages
- 9
- Line Endings
- LF
Testing contract
Expected to pass- Scenario
- Read a lockfile whose top level is a target-framework map.
- Expected result
- The net8.0 key yields 9 packages, 5 typed Direct with a requested range and 4 typed Transitive without one.
What is a .json file?
JSON (JavaScript Object Notation) is a lightweight, text-based data-interchange format representing objects, arrays, strings, numbers, booleans, and null. It is language-independent, human-readable, and the dominant format for web APIs and configuration. It requires a single well-formed root value.
How to use this file
Use an example JSON file to test parsers and serializers, schema validation, Unicode and number-precision handling, and API request or response processing.
How to use this file for testing
“packages.lock.json (NuGet)” is a deterministic Novus Examples fixture for JSON parsing, Config parsing, Conversion testing. Flat, deeply nested, JSON Lines, and intentionally invalid JSON for testing parsers and error handling.
Documented properties for this file: seed 51200 · LF. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
SBOM, lockfile, provenance, and advisory fixtures describe the same fabricated component tree across formats, so a converter or scanner can be diffed against a known answer. Every package name, version, hash, and advisory ID is invented — never treat a finding here as real.
Feed the file to your parser and assert it handles the documented quirks — quoted delimiters, embedded newlines, ragged rows, or invalid syntax; the valid↔invalid distinction is labelled in the title.
Code examples
import json
with open("packages.lock.json") as f:
data = json.load(f)
print(type(data), len(data))Related files
- lockCargo.lock (version 3, Legacy)The same fictional Rust tree pinned by a version 3 Cargo.lock, for testing that a reader keys on the declared version rather than assuming the newest format. Every package, version, hash and licence is fictional — the tree describes nothing real.
- lockCargo.lock (version 4)A Rust Cargo.lock in the version 4 format — TOML [[package]] tables with a registry source, a sha256-shaped checksum and a name-only dependencies array that resolves against the other tables. Every package, version, hash and licence is fictional — the tree describes nothing real.
- jsonnpm package-lock.json (lockfileVersion 1, Legacy)The original npm v1 lockfile layout — a nested dependencies object with requires maps and no packages section — still found in long-lived repositories and needed by any migration path. Every package, version, hash and licence is fictional — the tree describes nothing real.
- jsonnpm package-lock.json (lockfileVersion 2, Dual Layout)The transitional npm v2 lockfile, which carries BOTH the v3 packages map and the legacy nested dependencies tree describing the same fictional install — the case where a parser must not double-count. Every package, version, hash and licence is fictional — the tree describes nothing real.
- jsonnpm package-lock.json (lockfileVersion 3)An npm lockfile in the modern v3 layout: a flat packages map keyed by node_modules path, with resolved tarball URLs and sha512 subresource integrity for nine fictional dependencies. Every package, version, hash and licence is fictional — the tree describes nothing real.
- jsonnpm-shrinkwrap.json (Publishable Lock)The shrinkwrap variant of an npm lockfile — identical in structure to package-lock.json but published inside the package tarball, so tooling that keys on the filename must handle both. Every package, version, hash and licence is fictional — the tree describes nothing real.
Generated by generation/supply_chain.py. Free for any use, no attribution required — license.