outdated

Q: How do I install outdated?

Run npx skills add https://github.com/codewithmukesh/dotnet-claude-kit --skill outdated in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/outdated/ (personal) or .claude/skills/outdated/ (project).

by codewithmukeshBackend & APIs

Dependency health report for .NET solutions: outdated NuGet packages, vulnerable versions, and commercial-license traps (MediatR, MassTransit, FluentAssertions, AutoMapper) — powered by the getnugetpackages MCP tool. Invoke when: "outdated packages", "check dependencies", "stale packages", "package audit", "dependency health", "are my packages up to date", "license check", "vulnerable packages", "nuget audit".

Installs: 2.8K
Last 24h: +55
Trending rank: #3170
Security: Not audited

Install

Works with every agent the skills CLI supports.

npx skills add https://github.com/codewithmukesh/dotnet-claude-kit --skill outdated

01
Install
Run the command in your project. The CLI asks which agents to install for.
02
Describe the task
Ask your agent for something this skill covers. It loads outdated automatically when relevant.
03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.

SKILL.md

The instructions your agent reads when the skill is triggered.

/outdated

What

A three-layer dependency health report:

Inventory — every PackageReference per project, with TFMs and central package management awareness, via the get_nuget_packages MCP tool (no network, token-cheap).
Staleness + vulnerabilities — current vs latest stable, and known CVEs, via the dotnet CLI.
License screen — flags packages that moved to commercial licenses so an innocent dotnet outdated --upgrade doesn't silently change your legal position.

The output is a single prioritized table — vulnerabilities first, license traps second, staleness last — with a recommended action per row.

When

"check for outdated packages", "package audit", "dependency health"
Before a .NET version upgrade (pairs with /migrate Flow B)
After inheriting an unfamiliar codebase
Dependabot/NuGet audit warnings appeared and you want the full picture
Periodically on long-lived projects — quarterly is a good cadence

How

Step 1: Inventory (MCP, no network)

get_nuget_packages()                          -- whole solution
get_nuget_packages(projectFilter: "Api")      -- or one project

Returns per-project {Name, TargetFramework, Cpm, Packages: [{Id, Version}]}. Note Cpm: true — updates then belong in Directory.Packages.props, not the csproj. Flag mixed TFMs across projects while you're here.

Step 2: Staleness and vulnerabilities (CLI)

dotnet list package --outdated
dotnet list package --vulnerable --include-transitive

Both need a successful restore first. If restore fails, fix that before auditing — a broken lock state makes version output unreliable.

Step 3: License screen

Check the inventory against the known commercial moves (full rationale in knowledge/package-recommendations.md):

Package	Commercial from	Free alternative
MediatR	13+ (Lucky Penny, RPL)	`Mediator` (martinothamar) — source-generated, MIT
MassTransit	9+ (v8 Apache, patches end 2026 then EOL)	Wolverine 6.x, or stay on v8 short-term
FluentAssertions	8+ (v7 stays Apache, frozen)	xUnit built-in `Assert` (kit default), Shouldly, AwesomeAssertions
AutoMapper	15+ (Lucky Penny)	Manual mapping (kit default) or Mapperly (MIT)

A license flag fires when the project is on the free major and a naive "update all" would cross the boundary — that is the trap this step exists for.

Step 4: Report

One table, priority-ordered:

Priority	Meaning	Action
VULNERABLE	Known CVE in current version	Update now, test, deploy
LICENSE	Next major crosses a commercial boundary	Pin below boundary or plan migration
MAJOR	Behind a major (breaking changes likely)	One at a time, release notes first
MINOR/PATCH	Routine drift	Batch patches; minors one at a time

Step 5: Act (optional)

Offer to execute updates via /migrate Flow C — one package at a time, dotnet build && dotnet test between each. Never batch major updates: batched failures are unattributable.

MCP Tools Used

get_nuget_packages — inventory, CPM detection, TFM audit
get_diagnostics — verify the solution still compiles clean after updates

Example

User: /outdated

Claude: Inventorying packages (get_nuget_packages)...
  3 projects, CPM enabled (Directory.Packages.props), all net10.0.

  Checking versions and CVEs...

  | Package                  | Current | Latest  | Priority   | Action                          |
  |--------------------------|---------|---------|------------|---------------------------------|
  | System.Text.Json (trans.)| 10.0.2  | 10.0.10 | VULNERABLE | Update now (CVE-2026-XXXX)      |
  | MassTransit              | 8.3.0   | 9.1.2   | LICENSE    | v9 is commercial. Stay on v8    |
  |                          |         |         |            | (EOL end 2026) or plan Wolverine|
  | Serilog.AspNetCore       | 9.0.0   | 10.0.0  | MAJOR      | Update alone, check sink compat |
  | FluentValidation         | 12.0.1  | 12.1.1  | PATCH      | Batch with other patches        |

  1 vulnerability, 1 license trap, 1 major, 1 patch.
  Want me to apply these via /migrate Flow C?

/migrate — Flow C executes the updates this report recommends
knowledge/package-recommendations.md — vetted packages + licensing detail
knowledge/mediatr-to-mediator-migration.md — step-by-step MediatR exit
/verify — full pipeline after applying updates

FAQ

What does the outdated skill do?

How do I install outdated?

Run npx skills add https://github.com/codewithmukesh/dotnet-claude-kit --skill outdated in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/outdated/ (personal) or .claude/skills/outdated/ (project).

Which AI agents can use outdated?

Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.

Is outdated safe to install?

No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.

Who maintains outdated?

It is published by codewithmukesh in codewithmukesh/dotnet-claude-kit. It has 2,820 recorded installs.