winget, Chocolatey or Scoop — and the gap all three leave open

Short answer: winget if you want to serve Windows desktops without installing anything extra. Chocolatey if you need scripting, your own packages and an internal repository. Scoop if developers should pull tools without admin rights. The longer answer is less comfortable: in an average estate none of the three touches more than a handful of rows — and those rows update themselves anyway.

Reading “winget upgrade --all” honestly

winget is already there: Microsoft documents it as part of the App Installer on Windows 10 from version 1809 (build 17763), Windows 11 and Windows Server 2025. Server 2019 and 2022 are not named in that list — worth checking before you plan to patch servers with it. Two exceptions to winget upgrade --all mostly hit the software you did not install through winget yourself:

• Applications that do not report a version count as always latest and are skipped; the documentation says an upgrade is not possible unless --include-unknown is specified.
• Packages pinned with winget stay out; --include-pinned brings back only those with a non-blocking pin.

So the command you actually mean is winget upgrade --all --include-unknown — which then also reinstalls applications that are perfectly current, because winget cannot tell. It knows nothing about maintenance windows, rings, or which machine got what — a loop, not a patch process.

What Chocolatey does differently

choco upgrade all does the same job with one real advantage: exceptions exist. Packages can be held with choco pin or excluded at call time via --except — the documentation spells that out. The honest part is in Chocolatey’s own note on the public package repository: “Organizational use of the community repository is not recommended.”

The reasons given are distribution rights and control. Most Windows packages may not ship the binary for licensing reasons, so they download it from the vendor at install time — a step outside the package’s control. Separately there is a usage limit: more than roughly a hundred installs per hour on average counts as abuse there and can lead to a temporary block; the documented remedy is an internal repository. A third limit gets skipped in most comparisons: synchronising with Programs and Features — recognising applications that were not installed through Chocolatey — is a Pro/Business feature, as is central reporting through Chocolatey Central Management. The free edition only knows what it installed itself.

Scoop has not shipped a release in 372 days

The newest Scoop version we have recorded is 0.5.3, dated 12/08/2025 — as of 19/08/2026 that is 372 days. For comparison, from the same dataset: winget 1.29.280 from 24/06/2026, Chocolatey 2.7.3 from 10/06/2026. Looking into the project itself sharpens the picture:

• The master branch has had no commit since 12/08/2025.
• The develop branch was last touched on 03/05/2026.
• The Main and Extras buckets — the package sources — are still updated several times a day, most recently on the morning of 19/08/2026.

That matters because scoop update fetches the tool itself over Git from whichever branch SCOOP_BRANCH points at, and the default is master. Change nothing and you get fresh package definitions daily but no change to the tool for over a year. On a developer machine that is fine. For a hundred desktops it is something you want to know before you standardise.

Ten items from an ordinary estate

Three rows out of ten — with Scoop partly only once the Extras bucket is added — and those three largely update themselves already. The seven empty rows share no command. They do not even share a place to look.

The empty column

For those seven rows there is no tool that runs overnight. There is only the question of whether you notice that the vendor published something. That list is what patchletter keeps: tick your products in the catalogue and you get an email when a new version ships for one of them — firewalls, hypervisors, NAS systems and services included, none of which any package manager touches. The three tools from this article are in there too: winget, Chocolatey and Scoop. The 372 days above came out of exactly that mechanism.

The honest limitation

Those 372 days are a release counter, not a verdict on quality: roughly seventeen months sat between Scoop 0.3.1 (November 2022) and 0.4.0 (April 2024), and the project carried on afterwards. A tool with that cadence is not dead, it is hard to plan around — a different complaint. The table likewise rates categories, not individual packages, and a package existing in a repository says nothing about how quickly its maintainer follows the vendor. The original question stays badly framed too: most places end up running two of the three side by side — winget because it is already there, Chocolatey because somebody wrote a script.

Version states from our own dataset, as of 19/08/2026: winget 1.29.280 (24/06/2026), Chocolatey 2.7.3 (10/06/2026), Scoop 0.5.3 (12/08/2025). Commands and restrictions from Microsoft Learn and the Chocolatey documentation; Scoop release, branch and bucket dates from the GitHub API. All external sources retrieved 19/08/2026.