WinGet

ID

winget

Links

Documentation · Repository · Wikipedia

Upstream stars

⭐ 26,469

Last commit

2026-09-28

Version requirement

>= 1.29.280

Platforms

🪟 Windows

Operations

installed · outdated · search · install · upgrade · upgrade_all · remove · sync

purl types

pkg:winget/

CLI name

winget

Every call

winget <command> --accept-source-agreements --disable-interactivity --no-progress

Issues and PRs

📦 manager: winget

Source

winget.py

Microsoft’s official Windows package manager.

mpm reads inventory from winget list --details, whose Key: Value blocks carry the installed version and an Available Upgrades section.

Note

No operation is marked sudo, and escalating would be wrong. winget runs unelevated; a package whose installer wants administrator rights raises its own UAC prompt, which winget announces before handing over. Wrapping the call would instead decide the scope of every package: an EXE installer commonly picks user or machine by testing whether the caller is an administrator, and an MSIX registers per user and is unsupported in the system context.

What that costs is a package needing elevation from a session with no interactive desktop to answer the prompt. Measured on winget 1.29.290, installing 7zip.7zip from a medium-integrity shell reaches Installer failed with exit code: 1 and winget exits 6, where the same command succeeds elevated. Chocolatey is the opposite case and is escalated: it owns an administrator-locked tree of its own, so nothing there turns on which package is asked for.

Note

installed and outdated read every application the winget catalog matches, whether winget installed it or not, like a vendor’s own MSI: winget update --all upgrades those too. An application no source matches, or only msstore does, is left out.

What mpm adds to winget

mpm reaches across every manager at once, not winget alone: mpm installed and mpm outdated cover winget alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your winget commands, in mpm

You already know winget: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…

With winget

With mpm

List what’s installed

winget list --source winget --details

mpm --winget installed

List outdated packages

winget list --upgrade-available --details

mpm --winget outdated

Search for a package

winget search --query vscode

mpm --winget search vscode

Install a package

winget install --id Microsoft.PowerToys --accept-package-agreements

mpm install pkg:winget/Microsoft.PowerToys

Upgrade one package

winget install --id Git.Git --accept-package-agreements

mpm --winget upgrade Git.Git

Upgrade everything

winget update --all --accept-package-agreements

mpm --winget upgrade --all

Remove a package

winget uninstall --id Microsoft.PowerToys --source winget

mpm remove pkg:winget/Microsoft.PowerToys

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations

Operation

Supported

Notes

installed

✅

Every application the catalog matches is reported, whether the tool installed it or not, like a vendor’s own MSI.

outdated

✅

Every application the catalog matches is reported, whether the tool installed it or not, like a vendor’s own MSI.

orphans

search

✅

Store (msstore) entries cannot be queried for a real version, so they carry a sentinel version sorted below native ones.

install

✅

upgrade

✅

upgrade_all

✅

remove

✅

sync

✅

cleanup

doctor

Configuration

  • Ignore winget on the mpm CLI by passing the --no-winget option.

  • Ignore it for every run in your configuration:

    [mpm]
winget = false

  • Raise the timeout of all winget calls:

    [mpm.overrides.winget]
timeout = 900

  • Run mpm config-template winget to print all overridable settings for your configuration file:

    [mpm.overrides.winget]
cli_names = [
    "winget",
]
cli_search_path = []
dry_run = false
ignore_auto_updates = true
plan = false
post_args = [
    "--accept-source-agreements",
    "--disable-interactivity",
    "--no-progress",
]
pre_args = []
pre_cmds = []
requirement = ">=1.29.280"
stop_on_error = false
unmaintained = false
version_cli_options = [
    "--version",
]
version_regexes = [
    "v(?P<version>\\S+)",
]

The arguments and environment variables listed in the box atop this page are forced on every winget call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.

Recipes

A few jobs you would otherwise script around winget, one mpm command each:

  • Snapshot and clone a machine: mpm --winget dump winget.toml, then mpm restore winget.toml on the next one.

  • Export a Brewfile entry instead: mpm --winget dump --brewfile Brewfile.

  • Export a compliance SBOM: mpm --winget sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

None of its operations is privileged.

See privilege escalation for the full policy.

Cooldown

State of WinGet’s release-age gating, from the cooldown support table:

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

  • Registry: Git-manifest indexes

  • Retraction: Index revert: reverting the manifest, Portfile or derivation commit withdraws the version

  • Publish date: ❌ only the commit date, which is client-set and trivially backdated. A date declared in the manifest, like winget’s optional ReleaseDate, is author-supplied too and no sounder

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --cooldown best-effort opts back in.

Reference traces

A collection of raw native outputs captured from the manager’s own CLI and recorded in the manager source. If you know WinGet well and a transcript below looks wrong, or a newer release changed its output format, report it.

> winget list --source winget --details --accept-source-agreements --disable-interactivity --no-progress
(1/53) 7-Zip 26.03 (x64) [7zip.7zip]
Version: 26.03
Publisher: Igor Pavlov
Local Identifier: ARP\Machine\X64\7-Zip
Product Code: 7-zip
Installer Category: exe
Installed Scope: Machine
Installed Location: C:\Program Files\7-Zip\
(10/53) hyperfine [sharkdp.hyperfine]
Version: 1.20.0
Publisher: David Peter
Local Identifier: ARP\User\X64\sharkdp.hyperfine_Microsoft.Winget.Source_8wekyb3d8bbwe
Product Code: sharkdp.hyperfine_microsoft.winget.source_8wekyb3d8bbwe
Installer Category: portable
Installed Scope: User
Installed Architecture: X64
Installed Location: C:\Users\runneradmin\AppData\Local\Microsoft\WinGet\Packages\sharkdp.hyperfine_Microsoft.Winget.Source_8wekyb3d8bbwe
Origin Source: winget

> winget list --upgrade-available --details --accept-source-agreements --disable-interactivity --no-progress
(1/4) Git [Git.Git]
Version: 2.37.3
Publisher: The Git Development Community
Origin Source: winget
Available Upgrades:
  winget [2.45.1]

(2/4) Microsoft Edge [Microsoft.Edge]
Version: 109.0.1518.70
Publisher: Microsoft
Origin Source: winget
Available Upgrades:
  winget [125.0.2535.51]

Version check

The version is probed by running:

$ winget --version
v1.29.290

and extracted with:

r"v(?P<version>\S+)"

Upstream project

Metrics

microsoft/winget-cli

Activity

commit activity commits since open issues open pull requests

Popularity

forks watchers contributors

Metadata

latest release release date license main language

Changelog

  • 8.0.0 (2026-09-20)

    • Silence progress spinners by passing --no-progress on every invocation, which raises the winget floor to 1.29.280.

    • Record the optional ReleaseDate its manifests carry as author-supplied, so it cannot back a release-age gate.

    • Fix installed and outdated leaving out applications installed without winget, like a vendor’s own MSI, although upgrade --all upgrades them.

  • 7.4.0 (2026-07-25)

    • Documentation samples use the conventional > PowerShell prompt instead of PS C:\Users\kev>, reconnecting them to the corpus harvester: the documented commands are now validated against the constructed ones, the manager page gains its full Rosetta table and a clean version transcript, and the reference traces render under proper pwsh-session fences. The full and single-package upgrade samples show the exact winget update --all and winget install invocations mpm runs, and the agreement-prompt and different-install-technology illustrations move to non-fixture console fences.

  • 6.4.1 (2026-05-04)

    • Fix the parsing of winget tables: the package-block split no longer fires on indented upgrade rows, and the table width is read from the separator line, which stays full-width even when winget trims the trailing spaces of the header. Microsoft Store entries are recognized from their 12-character product ID or their XP-prefixed extension ID.

  • 6.4.0 (2026-04-27)

    • Add sync operation.

    • Fix search crash when no results are returned.

  • 6.3.0 (2026-04-09)

    • Switch installed and outdated to winget list --details structured output; filter to Origin Source: winget packages only, excluding sideloaded and portable entries. Bump minimum required version to >=1.28.190.

  • 5.16.0 (2024-05-24)

    • Add support for WinGet on Windows. Closes #500 and #1241.