Outdated

codewithmukesh/dotnet-claude-kit/skills/outdated

作者 codewithmukesh23300897f4d1無授權條款754 個星標收錄於 2026年10月8日更新於 2026年10月8日儲存庫2 個月前更新

Dependency health report for .NET solutions: outdated NuGet packages, vulnerable versions, and commercial-license traps (MediatR, MassTransit, FluentAssertions, AutoMapper) — powered by the get_nuget_packages MCP tool. Invoke when: "outdated packages", "check dependencies", "stale packages", "package audit", "dependency health", "are my packages up to date", "license check", "vulnerable packages", "nuget audit".

僅含說明Software DevelopmentSecurity
AI 產生的概覽

稽核 .NET 解決方案相依性，檢查過時的 NuGet 套件、已知弱點與商業授權陷阱。

功能
為 .NET 解決方案產生三層相依性健康報告：逐專案列出所有 PackageReference 的清單，包含目標框架與集中套件管理辨識；透過比較目前版本與最新穩定版及已知 CVE 進行過時與弱點檢查；以及標記已轉為商業授權的套件的授權篩檢。輸出是一張依優先順序排序的表格，弱點優先、授權陷阱其次、過時最後，每列附建議動作。也可選擇逐一套件提供更新執行建議。
適用情境
適用於檢查過時套件、執行套件稽核或相依性健康檢查、在 .NET 版本升級之前、接手不熟悉的程式碼庫之後，或出現 Dependabot/NuGet 稽核警告並希望了解全貌時。也適合對長期專案進行定期檢查。
執行需求
需要 get_nuget_packages MCP 工具進行清單收集，以及 dotnet CLI 進行過時與弱點檢查，且需先成功還原。會引用 knowledge/package-recommendations.md 等知識檔案。不附帶指令碼，僅為指示。

/outdated

What

A three-layer dependency health report:

  1. Inventory — every PackageReference per project, with TFMs and central package management awareness, via the get_nuget_packages MCP tool (no network, token-cheap).
  2. Staleness + vulnerabilities — current vs latest stable, and known CVEs, via the dotnet CLI.
  3. License screen — flags packages that moved to commercial licenses so an innocent dotnet outdated --upgrade doesn't silently change your legal position.

The output is a single prioritized table — vulnerabilities first, license traps second, staleness last — with a recommended action per row.

When

  • "check for outdated packages", "package audit", "dependency health"
  • Before a .NET version upgrade (pairs with /migrate Flow B)
  • After inheriting an unfamiliar codebase
  • Dependabot/NuGet audit warnings appeared and you want the full picture
  • Periodically on long-lived projects — quarterly is a good cadence

How

Step 1: Inventory (MCP, no network)

get_nuget_packages()                          -- whole solutionget_nuget_packages(projectFilter: "Api")      -- or one project

Returns per-project {Name, TargetFramework, Cpm, Packages: [{Id, Version}]}. Note Cpm: true — updates then belong in Directory.Packages.props, not the csproj. Flag mixed TFMs across projects while you're here.

Step 2: Staleness and vulnerabilities (CLI)

bash
dotnet list package --outdateddotnet list package --vulnerable --include-transitive

Both need a successful restore first. If restore fails, fix that before auditing — a broken lock state makes version output unreliable.

Step 3: License screen

Check the inventory against the known commercial moves (full rationale in knowledge/package-recommendations.md):

PackageCommercial fromFree alternative
MediatR13+ (Lucky Penny, RPL)Mediator (martinothamar) — source-generated, MIT
MassTransit9+ (v8 Apache, patches end 2026 then EOL)Wolverine 6.x, or stay on v8 short-term
FluentAssertions8+ (v7 stays Apache, frozen)xUnit built-in Assert (kit default), Shouldly, AwesomeAssertions
AutoMapper15+ (Lucky Penny)Manual mapping (kit default) or Mapperly (MIT)

A license flag fires when the project is on the free major and a naive "update all" would cross the boundary — that is the trap this step exists for.

Step 4: Report

One table, priority-ordered:

PriorityMeaningAction
VULNERABLEKnown CVE in current versionUpdate now, test, deploy
LICENSENext major crosses a commercial boundaryPin below boundary or plan migration
MAJORBehind a major (breaking changes likely)One at a time, release notes first
MINOR/PATCHRoutine driftBatch patches; minors one at a time

Step 5: Act (optional)

Offer to execute updates via /migrate Flow C — one package at a time, dotnet build && dotnet test between each. Never batch major updates: batched failures are unattributable.

MCP Tools Used

  • get_nuget_packages — inventory, CPM detection, TFM audit
  • get_diagnostics — verify the solution still compiles clean after updates

Example

User: /outdated
Claude: Inventorying packages (get_nuget_packages)...  3 projects, CPM enabled (Directory.Packages.props), all net10.0.
  Checking versions and CVEs...
  | Package                  | Current | Latest  | Priority   | Action                          |  |--------------------------|---------|---------|------------|---------------------------------|  | System.Text.Json (trans.)| 10.0.2  | 10.0.10 | VULNERABLE | Update now (CVE-2026-XXXX)      |  | MassTransit              | 8.3.0   | 9.1.2   | LICENSE    | v9 is commercial. Stay on v8    |  |                          |         |         |            | (EOL end 2026) or plan Wolverine|  | Serilog.AspNetCore       | 9.0.0   | 10.0.0  | MAJOR      | Update alone, check sink compat |  | FluentValidation         | 12.0.1  | 12.1.1  | PATCH      | Batch with other patches        |
  1 vulnerability, 1 license trap, 1 major, 1 patch.  Want me to apply these via /migrate Flow C?

Related

  • /migrate — Flow C executes the updates this report recommends
  • knowledge/package-recommendations.md — vetted packages + licensing detail
  • knowledge/mediatr-to-mediator-migration.md — step-by-step MediatR exit
  • /verify — full pipeline after applying updates

來源與署名

來源：codewithmukesh/dotnet-claude-kit位於skills/outdated提交2330089

授權條款： 無授權條款

內容歸原作者所有。SourceWeft 從公開儲存庫中收錄這些內容。

檢舉或申請下架

更多來自 codewithmukesh/dotnet-claude-kit 的技能

Wrap Up

codewithmukesh

在 session 結束時把已完成工作、待辦事項與經驗寫入交接檔案，並在 session 開始時重新載入。

Productivity & Workflow7542 個月前更新

Workflow Mastery

codewithmukesh

Claude Code workflow mastery for .NET developers. Covers parallel execution with git worktrees, plan mode strategy, verification loops, auto-formatting hooks, permission setup for dotnet CLI, prompting techniques, subagent patterns, and context discipline — token budget management, MCP-first navigation, lazy loading, and subagent isolation — all adapted for the .NET ecosystem. Load this skill when setting up Claude Code for a .NET project, optimizing workflows, running parallel sessions, when context is running low or sessions feel sluggish, when exploring a large codebase efficiently, or when the user mentions "productivity", "workflow", "parallel", "worktree", "plan mode", "permissions", "hooks", "10x", "setup Claude Code", "speed up development", "context", "tokens", "budget", "running out of context", "too many files", or "large codebase". Inspired by tips from Boris Cherny (creator of Claude Code) and the Anthropic team.

待分類7542 個月前更新

Vertical Slice

codewithmukesh

指導 .NET 開發者以垂直切片架構組織應用程式，涵蓋功能資料夾、端點分組與處理常式模式。

Software Development7542 個月前更新

Testing

codewithmukesh

Testing strategy for .NET 10 applications. Covers xUnit v3, WebApplicationFactory for integration tests, Testcontainers for real database testing, Verify for snapshot testing, and the AAA pattern. Load this skill when writing tests, setting up test infrastructure, reviewing test coverage, or when the user mentions "test", "xUnit", "WebApplicationFactory", "Testcontainers", "integration test", "unit test", "bUnit", "snapshot test", "Verify", "test coverage", "AAA pattern", "WireMock", or "FakeTimeProvider".

待分類7542 個月前更新

Tdd

codewithmukesh

Guided test-driven development workflow for .NET 10 using xUnit v3, WebApplicationFactory, Testcontainers, and Verify snapshots. Follows the strict red-green-refactor cycle. Use when: "TDD", "test-driven", "let's TDD this", "red green refactor", "write the test first", or when building a feature with clear acceptance criteria.

待分類7542 個月前更新

Spec

codewithmukesh

透過結構化提問，把模糊的功能想法轉化為雙方確認並持久化的規格文件。

Productivity & Workflow7542 個月前更新

更多Software Development技能

Playground

anthropics

精選

建立自成一體的互動式 HTML 遊樂場，包含控制項、即時預覽與可複製的提示詞輸出。

Software Development37K今天更新

M5 Onboard

anthropics

精選

透過 USB 偵測 M5Stack ESP32 開發板，燒錄 UIFlow 2.0 韌體並安裝 MicroPython 應用程式套件。

Software Development37K今天更新

Cardputer Buddy

anthropics

精選

指導迭代 Cardputer-Adv 的 MicroPython 應用程式套件：新增應用程式、透過 USB 序列埠推送檔案、查看日誌並執行 REPL 指令。

Software Development37K今天更新

Web Design Guidelines

vercel-labs

精選

依據從遠端來源取得的 Web Interface Guidelines 審查 UI 程式碼，並以 file:line 形式回報問題。

Software Development32K5 週前更新

Vercel React Native Skills

vercel-labs

精選

React Native 與 Expo 最佳實務規則，涵蓋清單效能、動畫、導覽、UI 模式、狀態與 monorepo 設定。

Software Development32K5 週前更新

Vercel React Best Practices

vercel-labs

精選

Vercel 的 React 與 Next.js 效能指南，以 70 條規則的形式用於撰寫、審查與重構程式碼。

Software Development32K5 週前更新