microsoft / microsoft/winget-cli

Upgrade delay setting for 'winget upgrade --all'

Open
#6,178 10 comments 21 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Issue-Feature
Dominant language
C++
Stars
26.4k
Forks
1.8k
Avg merge
1d 11h
Merged PRs (30d)
15

Description

Relevant area(s)

WinGet CLI

Description of the new feature / enhancement

Add an optional user setting installBehavior.upgradeDelayInDays that delays upgrades when running winget upgrade --all by skipping updates whose ReleaseDate is newer than the configured age, reducing exposure to newly published (and so, supply-chain/bug risky) releases.
So, for exemple, if installBehavior.upgradeDelayInDays is set to 5 days, and a new version of Mozilla.Thunderbird was released just yesterday, when running winget upgrade --all, the installation of this upgrade will be delayed until in 4 days.

It is the same idea as this config param from dependabot: https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#cooldown-

Proposed technical implementation details

Read installBehavior.upgradeDelayInDays from settings (default: 0).
During winget upgrade --all, for each available upgrade, if installBehavior.upgradeDelayInDays > 0, compare "today" to the package's ReleaseDate (prefer the selected applicable installer’s ReleaseDate, fallback to manifest.DefaultInstallerInfo.ReleaseDate).
If the age is less than the configured delay, skip that upgrade, continue processing the rest, and show a summary indicating how many upgrades were skipped due to the delay (with guidance to upgrade individually to override).
If ReleaseDate is missing/invalid, skip that upgrade in the same way as above.
If the age is more than the configured delay, process that upgrade in a classical way.

Those verifications are located in UpdateAllApplicable, so upgrading a single package is'nt affected by them.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at UpdateAllApplicable and trace how settings, applicable installers, and ReleaseDate values are represented. Check the existing upgrade-all summary and related tests before implementing the delay behavior. Done means the configured setting defaults to 0, recent or missing-date upgrades are skipped with an override message, and eligible upgrades continue normally.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
cli
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.