WinGet¶

ID: winget
Home page: https://github.com/microsoft/winget-cli
Version requirement: >= 1.28.190
Platforms: 🪟 Windows
Operations: installed · outdated · search · install · upgrade · upgrade_all · remove · sync
purl types: pkg:winget
Brewfile entry: winget, in Brewfile backups
CLI name: winget
Every call: winget <command> --accept-source-agreements --disable-interactivity
Issues and PRs: 📦 manager: winget
Source: meta_package_manager/managers/winget.py

Microsoft’s official Windows package manager.

mpm reads inventory from winget list --details, whose Key: Value blocks carry the installed version and an Available Upgrades section, and reads search from winget’s fixed-width column table.

Note

installed and outdated keep only rows whose Origin Source is winget, dropping packages winget merely tracks (sideloaded, portable or Microsoft Store). Store entries still surface in search, but their real version cannot be queried through winget, so mpm tags them with an msstore sentinel version and sorts them below winget-native ones.

Warning

Two Windows-only, process-level workarounds keep winget from taking the calling process down with it:

winget is spawned with DETACHED_PROCESS. Its COM server and installer children call GenerateConsoleCtrlEvent as they shut down, broadcasting a CTRL_C_EVENT to every process sharing their console: detaching removes winget from that console, so the signal never reaches the caller.
WindowsPackageManagerServer.exe is killed by image name after each call. This COM server is activated out-of-process, so it never inherits mpm’s pipes and is never reaped by communicate().

What `mpm` adds to `winget`¶

mpm reaches across every manager at once, not winget alone: mpm installed and mpm outdated cover winget alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your `winget` commands, in `mpm`¶

You already know winget: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With `winget`	With `mpm`
List what’s installed	`winget list --details`	`mpm --winget installed`
List outdated packages	`winget list --upgrade-available --details`	`mpm --winget outdated`
Search for a package	`winget search --query vscode`	`mpm --winget search vscode`
Install a package	`winget install --id Microsoft.PowerToys --accept-package-agreements`	`mpm install pkg:winget/Microsoft.PowerToys`
Upgrade one package	`winget install --id Git.Git --accept-package-agreements`	`mpm --winget upgrade Git.Git`
Upgrade everything	`winget update --all --accept-package-agreements`	`mpm --winget upgrade --all`
Remove a package	`winget uninstall --id Microsoft.PowerToys --source winget`	`mpm remove pkg:winget/Microsoft.PowerToys`

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations¶

Operation	Supported
`installed`	✓
`outdated`	✓
`orphans`
`search`	✓
`install`	✓
`upgrade`	✓
`upgrade_all`	✓
`remove`	✓
`sync`	✓
`cleanup`
`doctor`

Selecting and configuring `winget`¶

Deselect winget for a single run with --no-winget, or persist the choice in your configuration:

[mpm]
winget = false

The arguments and environment variables listed in the box atop this page are forced on every winget call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.winget]
timeout = 900

mpm config-template winget prints every overridable attribute as a ready-to-paste block.

Recipes¶

A few jobs you would otherwise script around winget, one mpm command each:

Snapshot and clone a machine: mpm --winget dump winget.toml, then mpm restore winget.toml on the next one.
Export a Brewfile entry instead: mpm --winget dump --brewfile Brewfile.
Export a compliance SBOM: mpm --winget sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation¶

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

See privilege escalation for the full policy.

Cooldown¶

State of WinGet’s release-age gating, from the cooldown support table:

Status: 🚧 Proposed
Mechanism: open feature request
Reference: microsoft/winget-cli#6178

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

Registry: Git-manifest indexes
Retraction: Index revert: reverting the manifest, Portfile or derivation commit withdraws the version
Publish date: ❌ only the commit date, which is client-set and trivially backdated

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --allow-unsupported-managers opts back in.

Version probe¶

The version is probed by running:

$ winget --version
v1.28.220

and extracted with:

r"v(?P<version>\S+)"

Reference traces¶

Raw native outputs captured in the manager source: the reference mpm’s parsers were written against. If you know WinGet well and a transcript below looks wrong, or a newer release changed its output format, report it.

> winget list --details --accept-source-agreements --disable-interactivity
(1/7) CCleaner [CCleaner]
Version: 6.08
Publisher: Piriform Software Ltd
Local Identifier: ARP\Machine\X64\CCleaner
Product Code: CCleaner
Installer Category: exe
Installed Scope: Machine
Installed Architecture: X64
Installed Locale: en-US
Origin Source: winget
Available Upgrades:

(2/7) Git [Git.Git]
Version: 2.37.3
Publisher: The Git Development Community
Origin Source: winget

> winget list --upgrade-available --details --accept-source-agreements --disable-interactivity
(1/4) Git [Git.Git]
Version: 2.37.3
Publisher: The Git Development Community
Origin Source: winget
Available Upgrades:
  winget [2.45.1]

(2/4) Microsoft Edge [Microsoft.Edge]
Version: 109.0.1518.70
Publisher: Microsoft
Origin Source: winget
Available Upgrades:
  winget [125.0.2535.51]

Feed any of these through mpm and the raw output becomes one uniform table, the same shape for every manager: filter it, project columns, or export it (mpm --winget installed --output json, or csv, toml, yaml), each package carrying a purl and a version comparable across managers.

Changelog¶

7.4.0 (2026-07-25)
- Documentation samples use the conventional > PowerShell prompt instead of PS C:\Users\kev>, reconnecting them to the corpus harvester: the documented commands are now validated against the constructed ones, the manager page gains its full Rosetta table and a clean version transcript, and the reference traces render under proper pwsh-session fences. The full and single-package upgrade samples show the exact winget update --all and winget install invocations mpm runs, and the agreement-prompt and different-install-technology illustrations move to non-fixture console fences.
6.4.1 (2026-05-04)
- Fix the parsing of winget tables: the package-block split no longer fires on indented upgrade rows, and the table width is read from the separator line, which stays full-width even when winget trims the trailing spaces of the header. Microsoft Store entries are recognized from their 12-character product ID or their XP-prefixed extension ID.
6.4.0 (2026-04-27)
- Add sync operation.
- Fix search crash when no results are returned.
6.3.0 (2026-04-09)
- Switch installed and outdated to winget list --details structured output; filter to Origin Source: winget packages only, excluding sideloaded and portable entries. Bump minimum required version to >=1.28.190.
5.16.0 (2024-05-24)
- Add support for WinGet on Windows. Closes #500 and #1241.