microsoft / microsoft/winget-pkgs
[Package Issue]: Yubico.YubiKeyPersonalizationTool is EOL and affected by CVE-2026-40947 - suggest to the user to replace it?
- Dominant language
- No language data
- Stars
- 11.1k
- Forks
- 9.7k
- PR merge metrics
- PR metrics pending
Description
### Please confirm these before moving forward
- [x] I have searched for my issue and not found a work-in-progress/duplicate/resolved issue.
- [x] I have not been informed if the issue is resolved in a preview version of the winget client.
### Category of the issue
Other
### Brief description of your issue
https://www.yubico.com/support/terms-conditions/yubico-end-of-life-policy/eol-products/
scroll down to Software products ... suggested CLI-based app for replacement is Yubico.YubiKeyManagerCLI and (my suggestion for) GUI-based app for replacement is Yubico.Authenticator (both also already available through WinGet).
**Please note that soon Yubico will start releasing keys based on firmware 5.8 and the EOL apps are likely to have errors when running with new firmware devices.**
Also see: https://www.yubico.com/support/security-advisories/ysa-2026-01/
https://developers.yubico.com/yubikey-personalization-gui/
and CVE-2026-40947
### Steps to reproduce
Use ancient Yubico apps.
### Actual behavior
EOL = no longer updated or tested for compatibility with new firmware devices, leading to potential errors.
### Expected behavior
expected: Management tools should have no errors when used with new firmware devices and also have the possibility to configure the new functions too.
### Environment
```raw
environment is not relevant - this is a WinGet supply chain issue. (winget keeps EOL software listed)
```
### Screenshots and Logs
_No response_
Contributor guide
Research direction
Start by locating the Yubico.YubiKeyPersonalizationTool manifest in winget-pkgs and review the EOL and security-advisory links in the issue. Check repository guidance for handling EOL packages and determine whether the listing should be removed or updated to direct users toward Yubico.YubiKeyManagerCLI or Yubico.Authenticator. Done means the package's status and replacement guidance match the repository's accepted approach.
Written by the indexing model from the issue text.
Assessment
- Domain
- security, tooling
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100