Dependency Audit

Dependency Audit

Scans CP repositories for dependency version inconsistencies, outdated libraries, and parent POM alignment issues.

When to Use

• User asks to "check dependency versions", "audit dependencies", "find version mismatches"
• User wants to verify a specific library version across all repos
• User wants to check parent POM chain alignment
• Before upgrading a shared library to find all consumers

Process

Step 1: Determine Scope

Ask the user what to audit:

• All context services — scan all cpp-context-* repos
• Specific repos — scan named repositories
• Specific dependency — find all usages of a named dependency
• Parent POM chain — verify super-pom → parent-pom → service alignment

Step 2: Extract Version Information

For Maven repos (cpp-context-*, cp-*)

Read pom.xml from each repo root and extract:

1. Parent POM — `` groupId, artifactId, version
2. Properties — `` block for version properties
3. Direct dependencies — any `` with explicit versions (not managed)
4. Plugin versions — any plugins with explicit versions

Key properties to check across the parent POM chain:

| Property | Defined in | Controls | |----------|-----------|----------| | cpp.framework.version | Service POM | cp-framework-libraries version | | cpp.microservice-framework.version | Service POM | cp-microservice-framework version | | cpp.event-store.version | Service POM | cp-event-store version | | cpp.file-service.version | Service POM | cp-file-service version | | cpp.platform-libraries.version | Service POM | cpp-platform-libraries version |

For Gradle repos (cp-audit-*, cp-auth-*, cpp-mbd-*)

Read build.gradle and extract:

1. Plugin versions — Spring Boot, dependency-management
2. Dependencies — implementation, testImplementation blocks
3. Ext properties — version variables

For Node repos (cpp-ui-*)

Read package.json and extract:

1. Angular version — @angular/core
2. Key dependencies — ngrx, govuk-frontend, ngx-bootstrap
3. Node/npm versions — engines field or .nvmrc

Step 3: Compare and Report

Generate a report grouped by finding type:

## Dependency Audit Report

### Parent POM Versions
| Repo | Parent Artifact | Parent Version |
|------|----------------|----------------|
| cpp-context-hearing | cp-maven-parent-pom | 1.2.3 |
| cpp-context-resulting | cp-maven-parent-pom | 1.2.4 |
...

### Framework Library Versions
| Repo | framework | microservice-fw | event-store | platform-libs |
|------|-----------|-----------------|-------------|----------------|
...

### Version Mismatches (Action Required)
- **cp-framework-libraries**: 5 repos on 2.1.0, 3 repos on 2.0.8 (latest: 2.1.0)
- **Spring Boot**: gradle repos split between 3.4.1 and 3.4.2

### Outdated Dependencies
- **[repo]**: dependency X is N versions behind latest

Step 4: Recommend Actions

For each mismatch, provide:

• Which repos need updating
• The target version
• Whether it's a breaking change (major version bump)
• Suggested update order (shared libraries first, then consumers)

Tips

• The parent POM chain is: cp-maven-super-pom → cp-maven-parent-pom → cp-maven-framework-parent-pom → service POM
• cp-maven-common-bom manages transitive dependency versions — check it for the canonical version of third-party libs
• Renovate bot creates automated PRs for dependency updates — check for open Renovate PRs before manually updating
• Framework library version changes often require coordinated releases across multiple context services

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: hmcts
• Source: hmcts/claude
• License: MIT

Install and usage instructions live in the source repository linked above.