| name | dependency-audit |
| description | Audit dependency versions across CPP repositories. Use when checking for version mismatches, outdated libraries, or parent POM alignment across context services. |
Dependency Audit
Scans CPP repositories for dependency version inconsistencies, outdated libraries, and parent POM alignment issues.
When to Use
- User asks to "check dependency versions", "audit dependencies", "find version mismatches"
- User wants to verify a specific library version across all repos
- User wants to check parent POM chain alignment
- Before upgrading a shared library to find all consumers
Process
Step 1: Determine Scope
Ask the user what to audit:
- All context services — scan all
cpp-context-* repos
- Specific repos — scan named repositories
- Specific dependency — find all usages of a named dependency
- Parent POM chain — verify super-pom → parent-pom → service alignment
Step 2: Extract Version Information
For Maven repos (cpp-context-*, cp-*)
Read pom.xml from each repo root and extract:
- Parent POM —
<parent> groupId, artifactId, version
- Properties —
<properties> block for version properties
- Direct dependencies — any
<dependency> with explicit versions (not managed)
- Plugin versions — any plugins with explicit versions
Key properties to check across the parent POM chain:
| Property | Defined in | Controls |
|---|
cpp.framework.version | Service POM | cp-framework-libraries version |
cpp.microservice-framework.version | Service POM | cp-microservice-framework version |
cpp.event-store.version | Service POM | cp-event-store version |
cpp.file-service.version | Service POM | cp-file-service version |
cpp.platform-libraries.version | Service POM | cpp-platform-libraries version |
For Gradle repos (cp-audit-*, cp-auth-*, cpp-mbd-*)
Read build.gradle and extract:
- Plugin versions — Spring Boot, dependency-management
- Dependencies — implementation, testImplementation blocks
- Ext properties — version variables
For Node repos (cpp-ui-*)
Read package.json and extract:
- Angular version —
@angular/core
- Key dependencies — ngrx, govuk-frontend, ngx-bootstrap
- Node/npm versions — engines field or .nvmrc
Step 3: Compare and Report
Generate a report grouped by finding type:
## Dependency Audit Report
### Parent POM Versions
| Repo | Parent Artifact | Parent Version |
|------|----------------|----------------|
| cpp-context-hearing | cp-maven-parent-pom | 1.2.3 |
| cpp-context-resulting | cp-maven-parent-pom | 1.2.4 |
...
### Framework Library Versions
| Repo | framework | microservice-fw | event-store | platform-libs |
|------|-----------|-----------------|-------------|----------------|
...
### Version Mismatches (Action Required)
- **cp-framework-libraries**: 5 repos on 2.1.0, 3 repos on 2.0.8 (latest: 2.1.0)
- **Spring Boot**: gradle repos split between 3.4.1 and 3.4.2
### Outdated Dependencies
- **[repo]**: dependency X is N versions behind latest
Step 4: Recommend Actions
For each mismatch, provide:
- Which repos need updating
- The target version
- Whether it's a breaking change (major version bump)
- Suggested update order (shared libraries first, then consumers)
Tips
- The parent POM chain is:
cp-maven-super-pom → cp-maven-parent-pom → cp-maven-framework-parent-pom → service POM
cp-maven-common-bom manages transitive dependency versions — check it for the canonical version of third-party libs- Renovate bot creates automated PRs for dependency updates — check for open Renovate PRs before manually updating
- Framework library version changes often require coordinated releases across multiple context services
