Chocolatey¶

ID: choco
Home page: https://chocolatey.org
Version requirement: >= 2
Platforms: 🪟 Windows
Operations: installed · outdated · search · install · upgrade · upgrade_all · remove
purl types: pkg:choco · pkg:chocolatey
CLI name: choco
Every call: choco <command> --no-progress --no-color --retry-count=3
Issues and PRs: 📦 manager: choco
Source: meta_package_manager/managers/choco.toml

Chocolatey is the community package manager for Windows.

Parsing notes:

Every operation passes --limit-output, whose pipe-delimited rows are the machine-readable format; --no-progress, --no-color and --retry-count ride along as post_args on every invocation.
choco search reaches into all package metadata by default: the {id_name_only_args} template narrows it to package IDs for mpm’s default --id-name-only mode, and {exact_args} maps --exact.

The version floor is the first release where choco list reports installed packages without the removed --local-only flag.

What `mpm` adds to `choco`¶

mpm reaches across every manager at once, not choco alone: mpm installed and mpm outdated cover choco alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your `choco` commands, in `mpm`¶

You already know choco: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With `choco`	With `mpm`
List what’s installed	`choco list --limit-output`	`mpm --choco installed`
List outdated packages	`choco outdated --limit-output`	`mpm --choco outdated`
Search for a package	`choco search <query> --limit-output <id_name_only_args> <exact_args>`	`mpm --choco search <exact_args>`
Install a package	`choco install <package_id> --yes --limit-output`	`mpm install pkg:choco/<package_id>`
Upgrade one package	`choco upgrade <package_id> --yes --limit-output`	`mpm --choco upgrade <package_id>`
Upgrade everything	`choco upgrade all --yes --limit-output`	`mpm --choco upgrade --all`
Remove a package	`choco uninstall <package_id> --yes --limit-output`	`mpm remove pkg:choco/<package_id>`

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations¶

Operation	Supported
`installed`	✓
`outdated`	✓
`orphans`
`search`	✓
`install`	✓
`upgrade`	✓
`upgrade_all`	✓
`remove`	✓
`sync`
`cleanup`
`doctor`

Selecting and configuring `choco`¶

Deselect choco for a single run with --no-choco, or persist the choice in your configuration:

[mpm]
choco = false

The arguments and environment variables listed in the box atop this page are forced on every choco call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.choco]
timeout = 900

mpm config-template choco prints every overridable attribute as a ready-to-paste block.

Recipes¶

A few jobs you would otherwise script around choco, one mpm command each:

Snapshot and clone a machine: mpm --choco dump choco.toml, then mpm restore choco.toml on the next one.
Export a compliance SBOM: mpm --choco sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation¶

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

None of its operations needs root.

See privilege escalation for the full policy.

Cooldown¶

State of Chocolatey’s release-age gating, from the cooldown support table:

Status: ❌ None

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

Registry: Chocolatey Community Repository (pkg:chocolatey)
Retraction: Unlist: moderators can unlist individual package versions (list/unlist), and malicious scripts are grounds for banning the maintainer and deleting their packages (moderation)

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --allow-unsupported-managers opts back in.

Version probe¶

The version is probed by running:

$ choco --version
2.2.2

and extracted with:

r"(?P<version>\S+)"

Reference traces¶

Raw native outputs captured in the bundled definition: the reference mpm’s parsers were written against. If you know Chocolatey well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ choco list --limit-output
adobereader|11.0.10
ccleaner|5.03.5128
chocolatey|0.9.9.2
ConEmu|14.9.23.0
gimp|2.8.14.1
git|1.9.5.20150114

$ choco outdated --limit-output
7zip.commandline|16.02.0.20170209|16.02.0.20170209|false
atom|1.23.3|1.24.0|false
bulkrenameutility|3.0.0.1|3.0.0.1|false

$ choco search {query} --limit-output {id_name_only_args} {exact_args}
virtualbox|6.1.0
VirtualBox.ExtensionPack|5.1.10.20161223
enigmavirtualbox|9.20
virtualbox-guest-additions-guest.install|6.1.0

Feed any of these through mpm and the raw output becomes one uniform table, the same shape for every manager: filter it, project columns, or export it (mpm --choco installed --output json, or csv, toml, yaml), each package carrying a purl and a version comparable across managers.

Changelog¶

7.3.0 (2026-07-17)
- Convert from a Python class to a bundled configuration definition, the native exact and ID-restricted search switches declared through the new refinement templates.
6.4.0 (2026-04-27)
- Add remove operation. Closes #1775.
6.1.1 (2026-02-06)
- Add --retry-count=3 option to all choco invocations.
5.15.0 (2024-02-25)
- Bump minimal choco requirement to 2.0.0.
5.11.0 (2023-01-30)
- Bump minimal choco requirement to 0.10.4.
4.5.0 (2021-09-30)
- Add Chocolatey package manager.