Outdated

codewithmukesh/dotnet-claude-kit/skills/outdated

by codewithmukesh23300897f4d1No license754 starsListed Oct 8, 2026Updated Oct 8, 2026Repository updated 2 months ago

Dependency health report for .NET solutions: outdated NuGet packages, vulnerable versions, and commercial-license traps (MediatR, MassTransit, FluentAssertions, AutoMapper) — powered by the get_nuget_packages MCP tool. Invoke when: "outdated packages", "check dependencies", "stale packages", "package audit", "dependency health", "are my packages up to date", "license check", "vulnerable packages", "nuget audit".

Instructions onlySoftware DevelopmentSecurity
AI-generated overview

Audits .NET solution dependencies for outdated NuGet packages, known vulnerabilities, and commercial license traps.

What it does
Produces a three-layer dependency health report for .NET solutions: an inventory of every PackageReference per project with target frameworks and central package management awareness, a staleness and vulnerability check comparing current versus latest stable versions and known CVEs, and a license screen flagging packages that moved to commercial licenses. The output is a single prioritized table ordered vulnerabilities first, license traps second, staleness last, with a recommended action per row. It can optionally offer to apply updates one package at a time.
When to use it
Use it when checking for outdated packages, running a package audit or dependency health check, before a .NET version upgrade, after inheriting an unfamiliar codebase, or when Dependabot or NuGet audit warnings appear and the full picture is wanted. It is also suited to periodic checks on long-lived projects.
Requirements
Requires the get_nuget_packages MCP tool for inventory and the dotnet CLI for staleness and vulnerability checks, with a successful restore first. It references knowledge files such as knowledge/package-recommendations.md. It ships no scripts; it is instructions only.

/outdated

What

A three-layer dependency health report:

  1. Inventory — every PackageReference per project, with TFMs and central package management awareness, via the get_nuget_packages MCP tool (no network, token-cheap).
  2. Staleness + vulnerabilities — current vs latest stable, and known CVEs, via the dotnet CLI.
  3. License screen — flags packages that moved to commercial licenses so an innocent dotnet outdated --upgrade doesn't silently change your legal position.

The output is a single prioritized table — vulnerabilities first, license traps second, staleness last — with a recommended action per row.

When

  • "check for outdated packages", "package audit", "dependency health"
  • Before a .NET version upgrade (pairs with /migrate Flow B)
  • After inheriting an unfamiliar codebase
  • Dependabot/NuGet audit warnings appeared and you want the full picture
  • Periodically on long-lived projects — quarterly is a good cadence

How

Step 1: Inventory (MCP, no network)

get_nuget_packages()                          -- whole solutionget_nuget_packages(projectFilter: "Api")      -- or one project

Returns per-project {Name, TargetFramework, Cpm, Packages: [{Id, Version}]}. Note Cpm: true — updates then belong in Directory.Packages.props, not the csproj. Flag mixed TFMs across projects while you're here.

Step 2: Staleness and vulnerabilities (CLI)

bash
dotnet list package --outdateddotnet list package --vulnerable --include-transitive

Both need a successful restore first. If restore fails, fix that before auditing — a broken lock state makes version output unreliable.

Step 3: License screen

Check the inventory against the known commercial moves (full rationale in knowledge/package-recommendations.md):

PackageCommercial fromFree alternative
MediatR13+ (Lucky Penny, RPL)Mediator (martinothamar) — source-generated, MIT
MassTransit9+ (v8 Apache, patches end 2026 then EOL)Wolverine 6.x, or stay on v8 short-term
FluentAssertions8+ (v7 stays Apache, frozen)xUnit built-in Assert (kit default), Shouldly, AwesomeAssertions
AutoMapper15+ (Lucky Penny)Manual mapping (kit default) or Mapperly (MIT)

A license flag fires when the project is on the free major and a naive "update all" would cross the boundary — that is the trap this step exists for.

Step 4: Report

One table, priority-ordered:

PriorityMeaningAction
VULNERABLEKnown CVE in current versionUpdate now, test, deploy
LICENSENext major crosses a commercial boundaryPin below boundary or plan migration
MAJORBehind a major (breaking changes likely)One at a time, release notes first
MINOR/PATCHRoutine driftBatch patches; minors one at a time

Step 5: Act (optional)

Offer to execute updates via /migrate Flow C — one package at a time, dotnet build && dotnet test between each. Never batch major updates: batched failures are unattributable.

MCP Tools Used

  • get_nuget_packages — inventory, CPM detection, TFM audit
  • get_diagnostics — verify the solution still compiles clean after updates

Example

User: /outdated
Claude: Inventorying packages (get_nuget_packages)...  3 projects, CPM enabled (Directory.Packages.props), all net10.0.
  Checking versions and CVEs...
  | Package                  | Current | Latest  | Priority   | Action                          |  |--------------------------|---------|---------|------------|---------------------------------|  | System.Text.Json (trans.)| 10.0.2  | 10.0.10 | VULNERABLE | Update now (CVE-2026-XXXX)      |  | MassTransit              | 8.3.0   | 9.1.2   | LICENSE    | v9 is commercial. Stay on v8    |  |                          |         |         |            | (EOL end 2026) or plan Wolverine|  | Serilog.AspNetCore       | 9.0.0   | 10.0.0  | MAJOR      | Update alone, check sink compat |  | FluentValidation         | 12.0.1  | 12.1.1  | PATCH      | Batch with other patches        |
  1 vulnerability, 1 license trap, 1 major, 1 patch.  Want me to apply these via /migrate Flow C?

Related

  • /migrate — Flow C executes the updates this report recommends
  • knowledge/package-recommendations.md — vetted packages + licensing detail
  • knowledge/mediatr-to-mediator-migration.md — step-by-step MediatR exit
  • /verify — full pipeline after applying updates

Source and attribution

Source:codewithmukesh/dotnet-claude-kitinskills/outdatedat commit2330089

License: No license

Content belongs to its original authors. SourceWeft indexes it from a public repository.

Report or request removal

More from codewithmukesh/dotnet-claude-kit

Wrap Up

codewithmukesh

Captures end-of-session work, pending tasks and learnings into a handoff file, and reloads it at session start.

Productivity & Workflow754updated 2 months ago

Workflow Mastery

codewithmukesh

Claude Code workflow mastery for .NET developers. Covers parallel execution with git worktrees, plan mode strategy, verification loops, auto-formatting hooks, permission setup for dotnet CLI, prompting techniques, subagent patterns, and context discipline — token budget management, MCP-first navigation, lazy loading, and subagent isolation — all adapted for the .NET ecosystem. Load this skill when setting up Claude Code for a .NET project, optimizing workflows, running parallel sessions, when context is running low or sessions feel sluggish, when exploring a large codebase efficiently, or when the user mentions "productivity", "workflow", "parallel", "worktree", "plan mode", "permissions", "hooks", "10x", "setup Claude Code", "speed up development", "context", "tokens", "budget", "running out of context", "too many files", or "large codebase". Inspired by tips from Boris Cherny (creator of Claude Code) and the Anthropic team.

Awaiting classification754updated 2 months ago

Vertical Slice

codewithmukesh

Guides .NET developers in structuring applications with Vertical Slice Architecture, covering feature folders, endpoint grouping and handler patterns.

Software Development754updated 2 months ago

Testing

codewithmukesh

Testing strategy for .NET 10 applications. Covers xUnit v3, WebApplicationFactory for integration tests, Testcontainers for real database testing, Verify for snapshot testing, and the AAA pattern. Load this skill when writing tests, setting up test infrastructure, reviewing test coverage, or when the user mentions "test", "xUnit", "WebApplicationFactory", "Testcontainers", "integration test", "unit test", "bUnit", "snapshot test", "Verify", "test coverage", "AAA pattern", "WireMock", or "FakeTimeProvider".

Awaiting classification754updated 2 months ago

Tdd

codewithmukesh

Guided test-driven development workflow for .NET 10 using xUnit v3, WebApplicationFactory, Testcontainers, and Verify snapshots. Follows the strict red-green-refactor cycle. Use when: "TDD", "test-driven", "let's TDD this", "red green refactor", "write the test first", or when building a feature with clear acceptance criteria.

Awaiting classification754updated 2 months ago

Spec

codewithmukesh

Turns a vague feature idea into an agreed, persisted specification file through structured questioning rounds.

Productivity & Workflow754updated 2 months ago

More in Software Development

Playground

anthropics

Featured

Builds self-contained interactive HTML playgrounds with controls, live preview, and copyable prompt output.

Software Development37Kupdated today

M5 Onboard

anthropics

Featured

Provisions M5Stack ESP32 boards by detecting them on USB, flashing UIFlow 2.0 firmware, and installing a MicroPython app bundle.

Software Development37Kupdated today

Cardputer Buddy

anthropics

Featured

Guides iterating on a Cardputer-Adv MicroPython app bundle: adding apps, pushing files over USB-serial, tailing logs, and running REPL commands.

Software Development37Kupdated today

Web Design Guidelines

vercel-labs

Featured

Reviews UI code against Web Interface Guidelines fetched from a remote source and reports findings as file:line entries.

Software Development32Kupdated 5 weeks ago

Vercel React Native Skills

vercel-labs

Featured

React Native and Expo best-practice rules covering list performance, animation, navigation, UI patterns, state, and monorepo setup.

Software Development32Kupdated 5 weeks ago

Vercel React Best Practices

vercel-labs

Featured

Vercel's React and Next.js performance guidelines, organized as 70 rules for writing, reviewing, and refactoring code.

Software Development32Kupdated 5 weeks ago