microsoft / microsoft/winget-cli
Upgrade delay setting for 'winget upgrade --all'
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 26.4k
- Forks
- 1.8k
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 15
Description
Relevant area(s)
WinGet CLI
Description of the new feature / enhancement
Add an optional user setting installBehavior.upgradeDelayInDays that delays upgrades when running winget upgrade --all by skipping updates whose ReleaseDate is newer than the configured age, reducing exposure to newly published (and so, supply-chain/bug risky) releases.
So, for exemple, if installBehavior.upgradeDelayInDays is set to 5 days, and a new version of Mozilla.Thunderbird was released just yesterday, when running winget upgrade --all, the installation of this upgrade will be delayed until in 4 days.
It is the same idea as this config param from dependabot: https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#cooldown-
Proposed technical implementation details
Read installBehavior.upgradeDelayInDays from settings (default: 0).
During winget upgrade --all, for each available upgrade, if installBehavior.upgradeDelayInDays > 0, compare "today" to the package's ReleaseDate (prefer the selected applicable installer’s ReleaseDate, fallback to manifest.DefaultInstallerInfo.ReleaseDate).
If the age is less than the configured delay, skip that upgrade, continue processing the rest, and show a summary indicating how many upgrades were skipped due to the delay (with guidance to upgrade individually to override).
If ReleaseDate is missing/invalid, skip that upgrade in the same way as above.
If the age is more than the configured delay, process that upgrade in a classical way.
Those verifications are located in UpdateAllApplicable, so upgrading a single package is'nt affected by them.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at UpdateAllApplicable and trace how settings, applicable installers, and ReleaseDate values are represented. Check the existing upgrade-all summary and related tests before implementing the delay behavior. Done means the configured setting defaults to 0, recent or missing-date upgrades are skipped with an override message, and eligible upgrades continue normally.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- cli
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100