Back to Details

outdated

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

/outdated

/outdated

What

概述

A three-layer dependency health report:
  1. Inventory — every 
    PackageReference
    per project, with TFMs and central package management awareness, via the 
    get_nuget_packages
    MCP tool (no network, token-cheap).
  2. Staleness + vulnerabilities — current vs latest stable, and known CVEs, via the 
    dotnet
    CLI.
  3. License screen — flags packages that moved to commercial licenses so an innocent 
    dotnet outdated --upgrade
    doesn't silently change your legal position.
The output is a single prioritized table — vulnerabilities first, license traps second, staleness last — with a recommended action per row.
一份三层结构的依赖健康报告：
  1. 包清单统计——通过
    get_nuget_packages
    MCP工具获取每个项目的所有
    PackageReference
    ，支持目标框架（TFMs）和中央包管理（CPM）感知，无需联网，令牌消耗极低。
  2. 陈旧性与漏洞检测——通过
    dotnet
    CLI对比当前版本与最新稳定版本，并检测已知的CVE漏洞。
  3. 许可证筛查——标记转为商业许可证的包，避免执行
    dotnet outdated --upgrade
    这类操作时无意中改变你的法律合规状态。
输出结果为一个按优先级排序的表格——漏洞优先，许可证陷阱次之，陈旧性最后，每行均附带建议操作。

When

适用场景

  • "check for outdated packages", "package audit", "dependency health"
  • Before a .NET version upgrade (pairs with 
    /migrate
    Flow B)
  • After inheriting an unfamiliar codebase
  • Dependabot/NuGet audit warnings appeared and you want the full picture
  • Periodically on long-lived projects — quarterly is a good cadence
  • “检查过时包”、“包审计”、“依赖健康状况检查”
  • .NET版本升级前（可搭配
    /migrate
    流程B）
  • 接手陌生代码库后
  • 出现Dependabot/NuGet审计警告，想要了解完整情况时
  • 长期维护的项目定期执行——每季度一次是合适的频率

How

操作步骤

Step 1: Inventory (MCP, no network)
get_nuget_packages()                          -- whole solution
get_nuget_packages(projectFilter: "Api")      -- or one project
Returns per-project 
{Name, TargetFramework, Cpm, Packages: [{Id, Version}]}
. Note 
Cpm: true
— updates then belong in 
Directory.Packages.props
, not the csproj. Flag mixed TFMs across projects while you're here.
Step 2: Staleness and vulnerabilities (CLI)
bash
dotnet list package --outdated
dotnet list package --vulnerable --include-transitive
Both need a successful restore first. If restore fails, fix that before auditing — a broken lock state makes version output unreliable.
Step 3: License screen
Check the inventory against the known commercial moves (full rationale in 
knowledge/package-recommendations.md
):
PackageCommercial fromFree alternative
MediatR13+ (Lucky Penny, RPL)
Mediator
(martinothamar) — source-generated, MIT
MassTransit9+ (v8 Apache, patches end 2026 then EOL)Wolverine 6.x, or stay on v8 short-term
FluentAssertions8+ (v7 stays Apache, frozen)xUnit built-in 
Assert
(kit default), Shouldly, AwesomeAssertions
AutoMapper15+ (Lucky Penny)Manual mapping (kit default) or Mapperly (MIT)
A license flag fires when the project is on the free major and a naive "update all" would cross the boundary — that is the trap this step exists for.
Step 4: Report
One table, priority-ordered:
PriorityMeaningAction
VULNERABLEKnown CVE in current versionUpdate now, test, deploy
LICENSENext major crosses a commercial boundaryPin below boundary or plan migration
MAJORBehind a major (breaking changes likely)One at a time, release notes first
MINOR/PATCHRoutine driftBatch patches; minors one at a time
Step 5: Act (optional)
Offer to execute updates via 
/migrate
Flow C — one package at a time, 
dotnet build && dotnet test
between each. Never batch major updates: batched failures are unattributable.
步骤1：包清单统计（MCP工具，无需联网）
get_nuget_packages()                          -- 整个解决方案
get_nuget_packages(projectFilter: "Api")      -- 或单个项目
返回每个项目的
{Name, TargetFramework, Cpm, Packages: [{Id, Version}]}
数据。注意
Cpm: true
表示更新需在
Directory.Packages.props
中进行，而非csproj文件。同时可标记跨项目的混合TFMs情况。
步骤2：陈旧性与漏洞检测（CLI工具）
bash
dotnet list package --outdated
dotnet list package --vulnerable --include-transitive
执行这两个命令前需先成功完成还原操作。如果还原失败，需先修复问题再进行审计——锁定状态异常会导致版本输出不可靠。
步骤3：许可证筛查
将包清单与已知转为商业许可证的包进行比对（完整依据见
knowledge/package-recommendations.md
）：
包名称商业许可证起始版本免费替代方案
MediatR13+（Lucky Penny、RPL许可证）
Mediator
（martinothamar开发）——源代码生成，MIT许可证
MassTransit9+（v8版本为Apache许可证，补丁支持至2026年随后停止维护）Wolverine 6.x，或短期保留v8版本
FluentAssertions8+（v7版本保持Apache许可证，不再更新）xUnit内置
Assert
（工具包默认）、Shouldly、AwesomeAssertions
AutoMapper15+（Lucky Penny许可证）手动映射（工具包默认）或Mapperly（MIT许可证）
当项目使用的是免费大版本，而执行“全部更新”会跨越到商业版本边界时，会触发许可证标记——这正是此步骤要防范的陷阱。
步骤4：生成报告
生成一个按优先级排序的表格：
优先级含义建议操作
VULNERABLE当前版本存在已知CVE漏洞立即更新、测试并部署
LICENSE下一个大版本将跨越商业许可证边界锁定版本在边界以下，或规划迁移方案
MAJOR落后一个大版本（可能存在破坏性变更）逐个更新，先查看发布说明
MINOR/PATCH常规版本滞后批量更新补丁版本；小版本逐个更新
步骤5：执行更新（可选）
可通过
/migrate
流程C执行更新——逐个包更新，每次更新后执行
dotnet build && dotnet test
。切勿批量更新大版本：批量更新出现故障时无法定位问题根源。

MCP Tools Used

使用的MCP工具

  • get_nuget_packages
    — inventory, CPM detection, TFM audit
  • get_diagnostics
    — verify the solution still compiles clean after updates
  • get_nuget_packages
    ——包清单统计、CPM检测、TFMs审计
  • get_diagnostics
    ——验证更新后解决方案仍能正常编译

Example

示例

User: /outdated

Claude: Inventorying packages (get_nuget_packages)...
  3 projects, CPM enabled (Directory.Packages.props), all net10.0.

  Checking versions and CVEs...

  | Package                  | Current | Latest  | Priority   | Action                          |
  |--------------------------|---------|---------|------------|---------------------------------|
  | System.Text.Json (trans.)| 10.0.2  | 10.0.10 | VULNERABLE | Update now (CVE-2026-XXXX)      |
  | MassTransit              | 8.3.0   | 9.1.2   | LICENSE    | v9 is commercial. Stay on v8    |
  |                          |         |         |            | (EOL end 2026) or plan Wolverine|
  | Serilog.AspNetCore       | 9.0.0   | 10.0.0  | MAJOR      | Update alone, check sink compat |
  | FluentValidation         | 12.0.1  | 12.1.1  | PATCH      | Batch with other patches        |

  1 vulnerability, 1 license trap, 1 major, 1 patch.
  Want me to apply these via /migrate Flow C?
用户: /outdated

Claude: 正在统计包清单（get_nuget_packages）...
  3个项目，已启用CPM（Directory.Packages.props），全部基于net10.0。

  正在检查版本与漏洞...

  | 包名称                  | 当前版本 | 最新版本 | 优先级   | 建议操作                          |
  |--------------------------|---------|---------|------------|---------------------------------|
  | System.Text.Json (trans.)| 10.0.2  | 10.0.10 | VULNERABLE | 立即更新（CVE-2026-XXXX）      |
  | MassTransit              | 8.3.0   | 9.1.2   | LICENSE    | v9为商业版本。保留v8版本    |
  |                          |         |         |            |（2026年停止维护）或规划迁移至Wolverine|
  | Serilog.AspNetCore       | 9.0.0   | 10.0.0  | MAJOR      | 单独更新，检查接收器兼容性 |
  | FluentValidation         | 12.0.1  | 12.1.1  | PATCH      | 与其他补丁批量更新        |

  1个漏洞，1个许可证陷阱，1个大版本更新，1个补丁更新。
  需要我通过/migrate流程C执行这些更新吗？

Related

相关内容

  • /migrate
    — Flow C executes the updates this report recommends
  • knowledge/package-recommendations.md
    — vetted packages + licensing detail
  • knowledge/mediatr-to-mediator-migration.md
    — step-by-step MediatR exit
  • /verify
    — full pipeline after applying updates
  • /migrate
    ——流程C可执行本报告建议的更新操作
  • knowledge/package-recommendations.md
    ——经过验证的包列表及许可证详情
  • knowledge/mediatr-to-mediator-migration.md
    ——MediatR迁移至Mediator的分步指南
  • /verify
    ——更新完成后的全流程验证