--delay-upgrade-by=7d

[Sieboldianus]

I use chocolatey to update all my Windows apps on a daily basis:

cmd.exe /K "choco upgrade all -Y"

This is great and has served me well for a long time.

However:

• I am regularly the victim of zero-day bugs, such as recently with the nextcloud-client 4.0.0 client
• this increases the risk of supply chain attacks

It would be great if choco would support a flag such as --delay-upgrade-by, to wait a user-defined number of days after a release was made, before updating.

At the moment, my workaround is to create a wrapper script:

• Get a list of all your outdated packages.
• For each package, check the date when the latest version was published.
• Compare that date to the current date.
• If the package version is more than 7 days old, it proceeds to upgrade it.

Was such a feature ever considered for chocolatey?

[pauby]

Thanks for raising this discussion.

Running choco upgrade all is a something you do intentionally, and understanding the consequences of upgrading all your packages. Sometimes the software that the package provides causes problems on your system -- bugs, zero-day attacks, changes in functionality that break your use of the software) just overall. This isn't a package issue, but a software one, and is no different when using any package manager.

With this in mind, we provide the ability to pin a package. This excludes it from being upgraded automatically when running choco upgrade all and then gives you time to review the software -- nextcloud-client in this case -- for any of those issues that we both mentioned, or even test is out in a separate environment, and intentionally upgrade or not.

Looking at how this would work in reality brings in the complication of dependencies too.

Chocolatey CLI open-source is all about you digging in and using the tool in the way that works for you, so it's great to see you've created a wrapper script for this. Would you consider sharing this so that others may use it?

Overall, I don't think this is a terrible idea. However, after reviewing it, it's not something we expect to prioritise in the foreseeable future and I'm going to close it to keep our backlog focused, but we’re open to revisiting it in the future if priorities shift or new interest arises. You are welcome to comment here or open a new issue if you'd like to discuss it further down the line.

[Sieboldianus]

Thank you very much, @pauby. This makes sense and is completely following the direction of thoughts as well. My wrapper script is not t the stage where I would share it, it is slow, because it needs to request/retrieve a lot of additional information (when was the last release, how many days backwards from now is that etc.). I found it not super good to use when the package list of chocolatey grows.

I was thinking in the direction of pinnings, too. Maybe this could even be combined with a wrapper script, to release pins after a certain time since new versions have been published has passed, and this is only applied to a small selection of software that is known to break (nextcloud-client). I find this the better approach, the longer I think about it.

Let's keep this open and I will report back here for the community.

Thank you for all your work 👍

[pauby]

Let's keep this open and I will report back here for the community.

I'll close it meantime, as I like to try to keep things tidy 😄 . If you do manage to get the work done on the script and come back, we can always reopen again.

Thanks again for bringing this up.