Dependency health report for .NET solutions: outdated NuGet packages, vulnerable versions, and commercial-license traps (MediatR, MassTransit, FluentAssertions, AutoMapper) — powered by the get_nuget_packages MCP tool. Invoke when: "outdated packages", "check dependencies", "stale packages", "packag

/outdated What A three layer dependency health report: 1. Inventory — every PackageReference per project, with TFMs and central package management awareness, via the get nuget packages MCP tool (no network, token cheap). 2. Staleness + vulnerabilities — current vs latest stable, and known CVEs, via the dotnet CLI. 3. License screen — flags packages that moved to commercial licenses so an innocent dotnet outdated upgrade doesn't silently change your legal position. The output is a single prioritized table — vulnerabilities first, license traps second, staleness last — with a recommended action per row. When "check for outdated packages", "package audit", "dependency health" Before a .NET version upgrade (pairs with /migrate Flow B) After inheriting an unfamiliar codebase Dependabot/NuGet audit warnings appeared and you want the full picture Periodically on long lived projects — quarterly is a good cadence How Step 1: Inventory (MCP, no network) Returns per project {Name, TargetFramework, Cpm, Packages: [{Id, Version}]} . Note Cpm: true — updates then belong in Directory.Packages.props , not the csproj. Flag mixed TFMs across projects while you're here. Step 2: Staleness and vulnerabilities (CLI) Both need a successful restore first. If restore fails, fix that before auditing — a broken lock state makes version output unreliable. Step 3: License screen Check the inventory against the known commercial moves (full rationale in knowledge/package recommendations.md ): Package Commercial from Free alternative MediatR 13+ (Lucky Penny, RPL) Mediator (martinothamar) — source generated, MIT MassTransit 9+ (v8 Apache, patches end 2026 then EOL) Wolverine 6.x, or stay on v8 short term FluentAssertions 8+ (v7 stays Apache, frozen) xUnit built in Assert (kit default), Shouldly, AwesomeAssertions AutoMapper 15+ (Lucky Penny) Manual mapping (kit default) or Mapperly (MIT) A license flag fires when the project is on the free major and a naive "update all" would cross the boundary — that is the trap this step exists for. Step 4: Report One table, priority ordered: Priority Meaning Action VULNERABLE Known CVE in current version Update now, test, deploy LICENSE Next major crosses a commercial boundary Pin below boundary or plan migration MAJOR Behind a major (breaking changes likely) One at a time, release notes first MINOR/PATCH Routine drift Batch patches; minors one at a time Step 5: Act (optional) Offer to execute updates via /migrate Flow C — one package at a time, dotnet build && dotnet test between each. Never batch major updates: batched failures are unattributable. MCP Tools Used get nuget packages — inventory, CPM detection, TFM audit get diagnostics — verify the solution still compiles clean after updates Example Related /migrate — Flow C executes the updates this report recommends knowledge/package recommendations.md — vetted packages + licensing detail knowledge/mediatr to mediator migration.md — step by step MediatR exit /verify — full pipeline after applying updates