pnpm-lock.yaml (lockfileVersion 9)
A pnpm v9 lockfile with its three-section layout — importers for declared specifiers, packages for resolution metadata and snapshots for the resolved edges — pinning the same fictional tree. Every package, version, hash and licence is fictional — the tree describes nothing real.
# SAMPLE — fictional supply-chain data. Every package, registry, version, hash, licence, advisory identifier and signature in this document is invented.
lockfileVersion: '9.0'
settings:
autoInstallPeers: true
excludeLinksFromLockfile: false
importers:
.:
dependencies:
'@orchard-example/router':
specifier: ^2.1.0
version: 2.1.3
'@orchard-example/http-core':
specifier: ^1.8.0
version: 1.8.0
'example-metrics':
specifier: ^4.0.0
version: 4.0.0
'example-cache':
specifier: ^0.9.0
version: 0.9.2
'example-crypto-shim':
specifier: ^1.2.0
version: 1.2.0
packages:
'@orchard-example/router@2.1.3':
resolution: {integrity: sha512-qtnM4l9j8zUuqQ9ICsxCdfl879PtducHYPiqO151qEu6bBv48+zuYbTbn/vSTJGbCd2RvGpDry/NEkSe1babaA==}
engines: {node: '>=20.9'}
'@orchard-example/http-core@1.8.0':
resolution: {integrity: sha512-fG9AJmG+37+sln/eMVPmbu/bIcV+QbJ3bibSV9ob8PV6GYNFinrhSJQYFxkEYEHxckXBn7ExDim59rqSDaYoFg==}
engines: {node: '>=20.9'}
'example-metrics@4.0.0':
resolution: {integrity: sha512-Sq3cxZ+Brv4bgLd+5B/o3upQ1O6YKjbr6TP5ZBZfw4XVjna6/8YkOeB52iLhrRDjs1UiF5v20Ijr7bEJtHKcOQ==}
engines: {node: '>=20.9'}
'example-cache@0.9.2':
resolution: {integrity: sha512-AfwdCZmLEAUsc7Xx0ze+X4cSz6ES8G63hh3Jwx7mHEBJUNpzRLZBq7fDYVk7+cVh9spu+3wey8a0VDJS6cEpTw==}
engines: {node: '>=20.9'}
'example-crypto-shim@1.2.0':
resolution: {integrity: sha512-C9iqJP6f/S7V/NsRGHnVv/u2nPtnjFMJbs4p8tMbjRSxrHeEjl6APolSniPvMFH0jlDUuO06nb86/a/GDEWRKg==}
engines: {node: '>=20.9'}
Specifications
- Seed
- 51200
- Sample Only
- true
- Ecosystem
- pnpm
- Lockfile Version
- 9.0
- Importers
- 1
- Packages
- 9
- Sections
- importers + packages + snapshots
- Line Endings
- LF
Testing contract
Expected to pass- Scenario
- Rebuild a dependency graph from pnpm's split importers/packages/snapshots layout.
- Expected result
- The five declared specifiers in importers resolve against the 9 packages, and the snapshots section supplies the edges the packages section omits.
What is a .yaml file?
YAML (YAML Ain't Markup Language) is a human-readable data-serialization format using indentation, key-value pairs, and lists, and is a superset of JSON. It supports comments, anchors, and multiple documents per file, favoring readability for configuration. Its indentation sensitivity makes it error-prone to hand-edit.
How to use this file
Use an example YAML file to test config parsers, indentation and anchor handling, multi-document streams, and safe-loading to avoid arbitrary object construction.
How to use this file for testing
“pnpm-lock.yaml (lockfileVersion 9)” is a deterministic Novus Examples fixture for Config parsing, Conversion testing, Schema validation. TOML and INI configuration files with nested sections and typed values — for testing config parsers and loaders.
Documented properties for this file: seed 51200 · LF. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
SBOM, lockfile, provenance, and advisory fixtures describe the same fabricated component tree across formats, so a converter or scanner can be diffed against a known answer. Every package name, version, hash, and advisory ID is invented — never treat a finding here as real.
Point your config loader at the file and assert it reads the documented sections and typed values, including any deliberately-tricky nesting or comments.
Code examples
import yaml # pip install pyyaml
with open("pnpm-lock.yaml") as f:
data = yaml.safe_load(f)
print(data)Related files
- lockCargo.lock (version 4)A Rust Cargo.lock in the version 4 format — TOML [[package]] tables with a registry source, a sha256-shaped checksum and a name-only dependencies array that resolves against the other tables. Every package, version, hash and licence is fictional — the tree describes nothing real.
- spdxSPDX 2.2 Legacy SBOM (Tag-Value)The same fictional tree as an SPDX 2.2 tag-value document — the version still produced by older toolchains — for upgrade and compatibility tests against the 2.3 twin in this family. Every package, version, hash and licence is fictional — the tree describes nothing real.
- yamlSPDX 2.3 Application SBOM (YAML)The SPDX 2.3 SBOM in its YAML serialisation — the third form the specification defines alongside JSON and tag-value, and the one most often hand-edited in a repository. Every package, version, hash and licence is fictional — the tree describes nothing real.
- spdxSPDX 2.3 SBOM With LicenseRef and Compound ExpressionsAn SPDX tag-value SBOM that declares a non-standard LicenseRef with its extracted text and uses it inside compound expressions — the case that breaks compliance tools which assume every licence is an SPDX id. Every package, version, hash and licence is fictional — the tree describes nothing real.
- lockCargo.lock (version 3, Legacy)The same fictional Rust tree pinned by a version 3 Cargo.lock, for testing that a reader keys on the declared version rather than assuming the newest format. Every package, version, hash and licence is fictional — the tree describes nothing real.
- jsonnpm package-lock.json (lockfileVersion 3)An npm lockfile in the modern v3 layout: a flat packages map keyed by node_modules path, with resolved tarball URLs and sha512 subresource integrity for nine fictional dependencies. Every package, version, hash and licence is fictional — the tree describes nothing real.
Generated by generation/supply_chain.py. Free for any use, no attribution required — license.