Chocolatey¶

ID: choco
Links: Home page · Documentation · Repository · Wikipedia
Upstream stars: ⭐ 11,528
Last commit: 2026-09-25
Version requirement: >= 2
Platforms: 🪟 Windows
Operations: installed · outdated · search · install · upgrade · upgrade_all · remove
purl types: pkg:choco/ · pkg:chocolatey/
CLI name: choco
Every call: choco <command> --no-progress --no-color
Issues and PRs: 📦 manager: choco
Source: choco.toml

Chocolatey is the community package manager for Windows.

Parsing notes:

Every operation passes --limit-output, whose pipe-delimited rows are the machine-readable format, with --no-progress and --no-color riding along as post_args on every invocation. Nothing else may join them without being driven first: Chocolatey’s parser hands an option it does not recognize to the command as a positional argument, so list and outdated filter on it and match nothing, while search folds it into the query and the feed answers 406. All three fail silently, returning an empty inventory rather than an error.
choco search reaches into all package metadata by default: the {id_name_only_args} template narrows it to package IDs for mpm’s default --id-name-only mode, and {exact_args} maps --exact.
--by-id-only answers nothing for a search term under four characters, and the community feed reports 0 packages found at exit 0 rather than refusing. Measured against Chocolatey 2.7.4: vim, git, zip, gcc and foo all return empty, while curl, make, java, 7zip and python return results. --exact is unaffected and finds vim either way, so a short query is only ever short-changed in the default mode.

The version floor is the first release where choco list reports installed packages without the removed --local-only flag.

What `mpm` adds to `choco`¶

mpm reaches across every manager at once, not choco alone: mpm installed and mpm outdated cover choco alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your `choco` commands, in `mpm`¶

You already know choco: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With `choco`	With `mpm`
List what’s installed	`choco list --limit-output`	`mpm --choco installed`
List outdated packages	`choco outdated --limit-output`	`mpm --choco outdated`
Search for a package	`choco search <query> --limit-output <id_name_only_args> <exact_args>`	`mpm --choco search <exact_args>`
Install a package	`choco install <package_id> --yes --limit-output`	`mpm install pkg:choco/<package_id>`
Upgrade one package	`choco upgrade <package_id> --yes --limit-output`	`mpm --choco upgrade <package_id>`
Upgrade everything	`choco upgrade all --yes --limit-output`	`mpm --choco upgrade --all`
Remove a package	`choco uninstall <package_id> --yes --limit-output`	`mpm remove pkg:choco/<package_id>`

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations¶

Operation	Supported
`installed`	✅
`outdated`	✅
`orphans`
`search`	✅
`install`	✅
`upgrade`	✅
`upgrade_all`	✅
`remove`	✅
`sync`
`cleanup`
`doctor`

Configuration¶

Ignore choco on the mpm CLI by passing the --no-choco option.
Ignore it for every run in your configuration:
```
[mpm]
choco = false
```
Raise the timeout of all choco calls:
```
[mpm.overrides.choco]
timeout = 900
```

Run mpm config-template choco to print all overridable settings for your configuration file:

[mpm.overrides.choco]
cli_names = [
    "choco",
]
cli_search_path = []
dry_run = false
ignore_auto_updates = true
plan = false
post_args = [
    "--no-progress",
    "--no-color",
]
pre_args = []
pre_cmds = []
requirement = ">=2.0.0"
stop_on_error = false
unmaintained = false
version_cli_options = [
    "--version",
]
version_regexes = [
    "(?P<version>\\S+)",
]

The arguments and environment variables listed in the box atop this page are forced on every choco call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.

Recipes¶

A few jobs you would otherwise script around choco, one mpm command each:

Snapshot and clone a machine: mpm --choco dump choco.toml, then mpm restore choco.toml on the next one.
Export a compliance SBOM: mpm --choco sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation¶

System-wide manager: mpm wraps its privileged operations in sudo out of the box. Instead of letting the tool prompt mid-run, mpm primes the credential cache up-front, with a single branded password prompt at most. Turn escalation off for rootless setups with --no-sudo or the per-manager sudo override.

Its privileged operations are install, remove, upgrade, upgrade_all.

See privilege escalation for the full policy.

Cooldown¶

State of Chocolatey’s release-age gating, from the cooldown support table:

Status: ❌ None

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

Registry: Chocolatey Community Repository (pkg:chocolatey)
Retraction: Unlist: moderators can unlist individual package versions (list/unlist), and malicious scripts are grounds for banning the maintainer and deleting their packages (moderation)

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --cooldown best-effort opts back in.

Reference traces¶

A collection of raw native outputs captured from the manager’s own CLI and recorded in the bundled definition. If you know Chocolatey well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ choco list --limit-output
adobereader|11.0.10
ccleaner|5.03.5128
chocolatey|0.9.9.2
ConEmu|14.9.23.0
gimp|2.8.14.1
git|1.9.5.20150114

$ choco outdated --limit-output
7zip.commandline|16.02.0.20170209|16.02.0.20170209|false
atom|1.23.3|1.24.0|false
bulkrenameutility|3.0.0.1|3.0.0.1|false

$ choco search {query} --limit-output {id_name_only_args} {exact_args}
virtualbox|6.1.0
VirtualBox.ExtensionPack|5.1.10.20161223
enigmavirtualbox|9.20
virtualbox-guest-additions-guest.install|6.1.0

Version check¶

The version is probed by running:

$ choco --version
2.2.2

and extracted with:

r"(?P<version>\S+)"

Upstream project¶

Metrics	`chocolatey/choco`
Activity
Popularity
Metadata

Changelog¶

8.0.0 (2026-09-20)
- Fix installed, outdated and search, which returned nothing at all because of a --retry-count=3 option Chocolatey does not have, and escalate install, remove and both upgrade paths, which failed unprivileged.
7.3.0 (2026-07-17)
- Convert from a Python class to a bundled configuration definition, the native exact and ID-restricted search switches declared through the new refinement templates.
6.4.0 (2026-04-27)
- Add remove operation. Closes #1775.
6.1.1 (2026-02-06)
- Add --retry-count=3 option to all choco invocations.
5.15.0 (2024-02-25)
- Bump minimal choco requirement to 2.0.0.
5.11.0 (2023-01-30)
- Bump minimal choco requirement to 0.10.4.
4.5.0 (2021-09-30)
- Add Chocolatey package manager.