[Feature Request]: Delay Application Updates

[AusomeOllie10]

The request

Given the recent increase in supply chain attacks, would it make sense to introduce a configurable temporary delay for package upgrades?

For example, if an Adobe update is released on Monday, it would not be installed until Wednesday. Likewise, if a Chrome update is released on Tuesday, it would not be applied until Thursday.

The idea would be to create a small buffer period before updates are automatically deployed, providing some additional protection against malicious or compromised releases. An example would be the NPM attacks recently. The benefit may be limited, but it could still be a worthwhile safeguard acting as a small line of defence.

Is your feature request related to a problem?

Negative

Additional information

No response

[rka]

Wanted to add the same suggestion 👆 This would be lovely 🤞

[Romanitho]

Would this feature answer your need? #1132

[tom-HCgY7HY6kq]

Not OP but I'm thinking the request is a little different to the feature you linked @Romanitho . Some other package management tools I use have the feature referred to as different names but essentially doing the same thing :

UV: https://docs.astral.sh/uv/reference/settings/#exclude-newer
PNPM: https://pnpm.io/supply-chain-security#delay-dependency-updates

This would be a great feature for my use case also 😄

[AusomeOllie10]

Apologies, I have been on holiday last few days

The requested feature is best explained by @tom-HCgY7HY6kq we use UV package manager for python and have started delaying updates by a day or so as a safety measure for supply chain attacks.

We would like to potentially implement a similar situation here, as a bit of a safety net against these types of attacks.

[mrkazoodle]

Ideally, you would have 2 settings:

1. the requested "age" a new version of a program should have before updating to it, and also
2. what delay to wait when that release fixes a security issue

But this requires you to know if an update contains security fixes: I've looked into it, but apparently winget doesn't have this info...

[github-actions]

This issue is stale because it has been open for 30 days with no activity.

[SebastianK90]

It would be a very nice feature.
E.g. setting via Mod or even better admx.
"App Update Delay Days" : 3 or something like that.
+

[github-actions]

This issue is stale because it has been open for 30 days with no activity.

[SebastianK90]

bump

[AusomeOllie10]

bump