| name | check-nuget-updates |
| description | Check for outdated NuGet dependencies in the Rask repo and propose safe bumps. Use periodically or before a release. Reads central package management (Directory.Packages.props), reports outdated/vulnerable/deprecated packages, and updates versions behind the rask-ship gate. |
check-nuget-updates
Versions are centrally managed in Directory.Packages.props (CPM). Dependabot also opens PRs
weekly (.github/dependabot.yml) — this skill is the manual/on-demand path.
1. Scan
dotnet restore Rask.slnx
dotnet list Rask.slnx package --outdated
dotnet list Rask.slnx package --vulnerable --include-transitive
dotnet list Rask.slnx package --deprecated
2. Triage
- Security/vulnerable → bump now (highest priority).
- Patch/minor → safe to bump; batch them.
- Major → bump deliberately, read release notes, expect API changes (esp. xunit, Playwright,
Microsoft.CodeAnalysis.CSharp which the generators pin, ASP.NET 10.x stack).
- Keep the
Microsoft.Extensions.* / Microsoft.AspNetCore.* family on the same version.
3. Apply + verify
Edit the <PackageVersion> entries in Directory.Packages.props, then run the rask-ship
gate (build is warnings-as-errors, so analyzer-rule changes from an SDK/analyzer bump surface
immediately). Note version bumps in CHANGELOG.md.
