lock3.1 KB

yarn.lock (Berry, __metadata version 8)

A modern Yarn Berry lockfile: YAML-shaped with an __metadata header, npm: protocol resolutions and cache-key-prefixed checksums — deliberately different from the Classic file in the same family. Every package, version, hash and licence is fictional — the tree describes nothing real.

Config parsing Conversion testing Error handling

Preview — first 50 lineslock

# This file is generated by running "yarn install" inside your project.
# Manual changes might be lost - proceed with caution!
# SAMPLE — fictional supply-chain data. Every package, registry, version, hash, licence, advisory identifier and signature in this document is invented.

__metadata:
  version: 8
  cacheKey: 10c0

"@orchard-example/router@npm:^2.1.0":
  version: 2.1.3
  resolution: "@orchard-example/router@npm:2.1.3"
  dependencies:
    example-logger: "npm:^3.4.0"
    example-retry: "npm:^1.0.0"
  checksum: 10c0/068769179ef7cec75f93943ca163faea23c181f1ff8afd073f73a750be6154207cad9b631a80bb4e2472dcf428a7d1f4664935f5d825d2de0df9d9771761f3a6
  languageName: node
  linkType: hard

"@orchard-example/http-core@npm:^1.8.0":
  version: 1.8.0
  resolution: "@orchard-example/http-core@npm:1.8.0"
  dependencies:
    example-logger: "npm:^3.4.0"
    example-json-path: "npm:^2.0.0"
  checksum: 10c0/cacc5e282e19382e59562c6ca088bf96891e3dbed91a5d8da14a50f4996c47431689ca4f71f9db24d9de928c629f1757dd8104d469e9dd4dadd96f3561ed8270
  languageName: node
  linkType: hard

"example-metrics@npm:^4.0.0":
  version: 4.0.0
  resolution: "example-metrics@npm:4.0.0"
  dependencies:
    example-logger: "npm:^3.4.0"
  checksum: 10c0/177bbcd488f1a836bda09863c5e5469bc5142d5b19f1c730d3a5a8b672b25df29fcf3edba391374af120867f02011709ecf2ba3265511de69af1ce87bb8e61a2
  languageName: node
  linkType: hard

"example-cache@npm:^0.9.0":
  version: 0.9.2
  resolution: "example-cache@npm:0.9.2"
  dependencies:
    example-yaml-lite: "npm:^1.1.0"
  checksum: 10c0/fd53273a971b4e7223673a51618f41e0ce3929a28e3bc17b5b5c6a66dc579f8cf430c5384a3765c0260cb411c220922048155592dff1271602fc21889a21c87f
  languageName: node
  linkType: hard

"example-crypto-shim@npm:^1.2.0":
  version: 1.2.0
  resolution: "example-crypto-shim@npm:1.2.0"
  checksum: 10c0/140c77fc21423b4726a41fbeec5598d7534a7c5d6902c85086158638f779922bf1c794d1db4328ba7a11d286af80f3ad91b52350e5f8279fb6a712ebd5831b39

… 83 lines total — download for the full file.

Specifications

Seed: 51200
Sample Only: true
Ecosystem: Yarn Berry
Metadata Version: 8
Entries: 9
Checksum: 10c0/sha512-hex
Line Endings: LF

Testing contract

Expected to pass

Scenario: Tell a Yarn Berry lockfile apart from a Yarn Classic one and parse each correctly.
Expected result: Detection keys on the __metadata block, and all 9 entries expose the npm: protocol resolution plus a 10c0/-prefixed checksum.

What is a .lock file?

A .lock file pins the exact dependency graph a package manager resolved, so a later install reproduces it byte for byte. Cargo.lock and Poetry's poetry.lock use TOML, Gemfile.lock and yarn.lock use their own line-oriented grammars, and all of them record resolved versions, source registries, integrity hashes, and the transitive edges between packages. It is committed alongside the human-edited manifest, which states ranges rather than exact versions.

How to use this file

Use an example .lock file to test dependency parsers, SBOM generators, and vulnerability scanners, verifying that transitive dependencies and integrity hashes are read correctly and that a pinned version is never confused with the range declared in the manifest.

How to use this file for testing

“yarn.lock (Berry, __metadata version 8)” is a deterministic Novus Examples fixture for Config parsing, Conversion testing, Error handling. TOML and INI configuration files with nested sections and typed values — for testing config parsers and loaders.

Documented properties for this file: seed 51200 · 9 entries · LF. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.

Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.

SBOM, lockfile, provenance, and advisory fixtures describe the same fabricated component tree across formats, so a converter or scanner can be diffed against a known answer. Every package name, version, hash, and advisory ID is invented — never treat a finding here as real.

Point your config loader at the file and assert it reads the documented sections and typed values, including any deliberately-tricky nesting or comments.