Windows Package Manager 1.30.80-preview

[Akinwale Alagbe (hackean-msft)]

This is a preview build of WinGet for those interested in trying out upcoming features and fixes. While it has had some use and should be free of major issues, it may have bugs or usability problems. If you find any, please help us out by filing an issue.

New in v1.30

Nothing yet.

Bug Fixes

• Updated NUnit to v4
• Fixed a crash (0x8000ffff) when using --disable-interactivity with the Resume experimental feature enabled during install operations.

What's Changed

• Bump js-yaml from 4.1.1 to 4.3.0 in /tools/WinGetLogViewer by Dependabot (@dependabot)[bot] in Bump js-yaml from 4.1.1 to 4.3.0 in /tools/WinGetLogViewer #6359
• Fix portable tests impacted by ADO image by JohnMcPMS in Fix portable tests impacted by ADO image #6354
• /await:strict and fixes for it by JohnMcPMS in /await:strict and fixes for it #6240
• Fix NuGet packages path by Flor Chacón (@florelis) in Fix NuGet packages path #6365
• Update in-codebase documentation for E2E tests by Kaleb Luedtke (@Trenly) in Update in-codebase documentation for E2E tests #6355
• Update NUnit to v4 by Kaleb Luedtke (@Trenly) in Update NUnit to v4 #6287
• Use NUnit key constraints in DSCv3 settings tests by Kaleb Luedtke (@Trenly) in Use NUnit key constraints in DSCv3 settings tests #6371
• Optional Telemetry Event for Microsoft Store Catalog Installs (msstore Source) by Shmueli Englard (@shmuelie) in Optional Telemetry Event for Microsoft Store Catalog Installs (msstore Source) #6352

New Contributors

• Shmueli Englard (@shmuelie) made their first contribution in Optional Telemetry Event for Microsoft Store Catalog Installs (msstore Source) #6352

Full Changelog: v1.30.50-preview...v1.30.80-preview

---

This discussion was created from the release Windows Package Manager 1.30.80-preview.

[jbalaji3110]

We are investigating CVE-2026-68821, for which the Microsoft Security Update Guide identifies 1.30.80 as the required/fixed version.

However, we are seeing a version discrepancy when installing the package provided through MSRC.

The MSRC package is identified as build 1.30.80, but after installation the device reports:

Microsoft.DesktopAppInstaller: 1.29.280.0
WinGet: v1.29.280

The previous version on the device was WinGet v1.28.220, so the package does update the installation, but the reported version is 1.29.280 rather than 1.30.80.

This is also causing an issue with vulnerability management, as Nessus is reporting WinGet versions below 1.30.80 as vulnerable.

Could someone please confirm:

1. Is the MSRC-provided 1.30.80 package expected to report WinGet as v1.29.280?
2. Is v1.29.280 actually the fixed version for CVE-2026-68821?
3. If 1.30.80 is the required fixed version, is there a production App Installer/WinGet package that should report v1.30.80 or later?
4. What version should enterprise customers use as the supported remediation for CVE-2026-68821?

We want to make sure we deploy the correct Microsoft-supported package rather than a preview build simply to satisfy the vulnerability scanner.

[Demitrius Nelon (denelon)]

I believe there is some confusion here. It looks like we need to get the CVE listing updated.

This is the stable version to address the vulnerability:

• https://github.com/microsoft/winget-cli/releases/tag/v1.29.280

[CuriosityBroughtMe]

I came for the same question, and He was faster than me :)
Scanner is detecting v1.29.280 to be vulnerable, so this won't go away as the version said to be 1.30.80 on MSRC gave v1.29.280

[JohnMcPMS]

We have corrected the CVE listing on our side, but I'm not sure how quickly consumers of that data will be updated:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68821