check-deps

Check Dependencies

Scan the current project and report which dependencies have newer versions available, then apply the updates the user confirms. Prefer the plugin MCP tools — they use project-declared repositories, version classification, and OSV hydration already implemented in the server.

Step 1 — Audit via MCP (preferred)

Call audit_project_dependencies with:

• projectPath — project root (default: cwd)
• includeVulnerabilities — true by default; set false if the user only wants updates
• productionOnly — true by default; set false to include test-scoped deps

This single call resolves production dependencies through Gradle (./gradlew dependencies / buildEnvironment), merges build-file provenance (catalogs, module paths, plugin DSL), looks up latest versions against project repos, and optionally queries OSV. Requires gradlew at the project root.

Alternatively, when you only need the declared list first:

1. scan_project_dependencies → extract coordinates
2. compare_dependency_versions with {groupId, artifactId, currentVersion} per entry
3. get_dependency_vulnerabilities for versioned coordinates (optional)

Do not hand-parse maven-metadata.xml or POST to OSV yourself while MCP tools work.

Step 2 — Build the report

From the audit / compare results, only include entries where an upgrade is available (upgradeType ≠ none, or latestVersion ≠ currentVersion). Group by source.kind:

• catalog-library / catalog-plugin — alias, current → latest, upgrade type, catalog file, usages
• module-direct — module, file, artifact, current → latest, configuration; flag catalog drift
• plugins-dsl — split settings pluginManagement vs root/module plugins {}
• buildscript-classpath — artifact, current → latest, file; note legacy style
• gradle-resolved — Gradle-resolved direct dependency with no matching build-file provenance

When resolvedBy: "gradle" is present on the scan/audit result, versions are Gradle-resolved (effective versions from BOM/platform/constraints), not regex-guessed from build files.