# Outdated Dependencies > [BETA] AEM Cloud Service expert skill — upgrade outdated Maven dependencies in pom.xml, both literal and same-pom ${property} shapes. Use for \"update my aem-sdk-api\", \"upgrade mockito\", or scanning a project for stale dependency versions. Discovery can find blocks but \"outdated\" needs a target version, which the user supplies. Pattern A/B locators and editing strategy… - **Type:** Skill - **Install:** `agentstack add skill-adobe-skills-outdated-dependencies` - **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior - **Seller:** [adobe](https://agentstack.voostack.com/s/adobe) - **Installs:** 0 - **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills) - **Latest version:** 0.1.0 - **License:** Apache-2.0 - **Upstream author:** [adobe](https://github.com/adobe) - **Source:** https://github.com/adobe/skills/tree/main/plugins/aem/cloud-service/skills/code-assessment/outdated-dependencies - **Website:** https://www.adobe.com/ai/overview.html ## Install ```sh agentstack add skill-adobe-skills-outdated-dependencies ``` Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent. ## About > **Beta Skill**: This skill is in beta and under active development. > Results should be reviewed carefully before use in production. > Report issues at https://github.com/adobe/skills/issues # Outdated Maven dependencies — AEM as a Cloud Service > This pattern is executed by the code-assessment runbook — follow [`../references/runbook.md`](../references/runbook.md) for the full flow (preflight → plan → apply → verify, run log). This skill supplies the detection + recipe the runbook applies. ## Overview Stale Maven dependencies (notably `aem-sdk-api`) cause build failures and local/runtime drift. This skill bumps a dependency's version surgically — literal `` or a same-pom `${property}` — without reformatting the pom. ## Answering "are my dependencies up to date?" This pattern **locates** Maven coordinates; it does **not** declare a dependency outdated vs current without a **user-supplied target version** (see Resolution contract). For a comparative ask ("up to date?", "stale?", "outdated?") with `report` intent: 1. Run discovery via the analyzer (`--pattern outdated-dependencies`, or a full audit). 2. Present every located coordinate in the Step 7 **Candidates** table with planned action `skipped` and reason `needs-user-target` (no target supplied). 3. State plainly: *"Found N versioned dependencies across M pom files. Supply target versions to mark upgrades. For `aem-sdk-api`, align with your Cloud Manager environment SDK — do not assume the latest public version."* 4. Offer follow-up: reply with target versions to apply, or name coordinates then say **apply**. **Do not** run `mvn versions:display-*`, `npm outdated`, or Maven Central / registry lookups in place of this inventory. A live registry comparison needs network and is advisory only — if the user explicitly asks, do it as a separate step **after** the skill report. ## Classification — confirm this pattern applies - A `pom.xml` with a `` whose version the user wants raised, either as a literal `` or via a `${prop}` + `` entry. - Applies to a `` that carries a `` (literal or `${property}`) in `` **or** ``. Not for `` / `` dependencies, version-less (inherited) `` entries, or versions defined only in an out-of-workspace parent pom. ## Discovery Detection is performed by the analyzer ([`../scripts/analyze.sh`](../scripts/README.md)), run by the runbook: ```bash bash ../scripts/analyze.sh --pattern outdated-dependencies ``` **Match criteria (what the detector flags):** each `` element carrying a `` (literal or `${property}`) under `` or `` — excluding ``/``/``/`` dependencies and version-less (inherited) `` entries — emitted with its `groupId:artifactId@version` and the line of its ``. The analyzer only **locates** dependencies — "is this outdated?" and "what is the target version?" are **user-supplied** (see Resolution contract); the analyzer performs no network lookup. If the same `(groupId, artifactId, version)` appears in more than one `` block in a file, the recipe's `ambiguous-locator` skip applies during planning. **Allowlist scope:** by default the detector is scoped to a curated allowlist of coordinates where upgrades are actionable in AEM Cloud Service projects (currently `com.adobe.aem:aem-sdk-api` and `org.mockito:*`). Non-allowlisted versioned dependencies are silently skipped. To list every versioned dependency regardless of allowlist, pass `--all` to `analyze.sh` — but **only** for an explicit full audit ("all dependencies", "every library", "comprehensive"). For a normal "are my dependencies outdated?" ask, keep the default allowlist scope: it is the actionable answer, and `--all` adds platform deps (OSGi, JCR, servlet-api) that are not independently upgradeable. Adding a coordinate to the allowlist is a one-line change in `OutdatedDependencies.java`; `analyze.sh` recompiles automatically. Both exact `groupId:artifactId` and prefix-wildcard `groupId:prefix*` forms are supported. ## Resolution contract **user-supplied** — list the found coordinates with their current versions and ask which to upgrade and to what target version before planning. Never guess a version. ## Review checklist - [ ] Only the `` text (or the `` entry) changed — no whitespace/attribute churn - [ ] Property shape edits validated: property exists, value matched, referenced by the target dependency - [ ] Ambiguous (multi-match) locators skipped, not guessed - [ ] Target version came from the user — never invented ## Recipe Read [`recipe.md`](recipe.md) in full before editing: input contract, Pattern A (literal), Pattern B (property), multi-module caveat, editing strategy. ## Handoff The skill never commits. See [`../references/git-workflow.md`](../references/git-workflow.md) for git vs in-place handoff and the suggested commit message. ## Source & license This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code. - **Author:** [adobe](https://github.com/adobe) - **Source:** [adobe/skills](https://github.com/adobe/skills) - **License:** Apache-2.0 - **Homepage:** https://www.adobe.com/ai/overview.html Install and usage instructions live in the source repository linked above. ## Pricing - **Free** — Free ## Security capabilities Automated source analysis of v0.1.0 — what this tool can access: - **Network access:** no - **Filesystem access:** no - **Shell / process execution:** no - **Environment & secrets:** no - **Dynamic code execution:** no *"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.* ## Versions - **0.1.0** — security scan: passed — Imported from the upstream source. ## Links - Listing page: https://agentstack.voostack.com/l/skill-adobe-skills-outdated-dependencies - Seller: https://agentstack.voostack.com/s/adobe - Browse the marketplace: https://agentstack.voostack.com/browse --- Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.