We need to talk about the state of Winget. More specifically, the state of the Winget community repository, where Winget packages are submitted and approved.

Before I start, two things. First, this is not a hit piece. The Winget team and the community volunteers have built something genuinely awesome, and we relied on it for years. Second, I run Pckgr, which does application packaging and patching for Microsoft Intune, so you should read this knowing I’m not a neutral party. Everything below comes from public GitHub discussions, and I’ve linked them so you can read them yourself.

Winget has been a really cool project and genuinely life changing for me. It’s been a big help to us and plenty of other IT admins over the years, which is why it’s really sad to see what’s happening to it now.

Why we moved away from Winget

In 2025 we started moving away from Winget as our main source for application packages. It was getting harder and harder to give our customers an enterprise level experience.

The validation and publishing pipelines would regularly break, which stopped new updates from being released. On top of that, other users would submit PRs for existing applications that broke our deployments. For a long time we just accepted that. It’s a free, open source service run mostly by community volunteers, and the good far outweighed the bad. But as the problems became more frequent, I knew we couldn’t keep promising our customers stable package updates while relying on it.

So we moved to a privately hosted repository. We store the application files ourselves and deploy them as PowerShell App Deployment Toolkit (PSADT) wrapped applications. Since then, we’ve slowly removed our dependency on Winget and moved to our own packaging workflows and testing with the goal of providing a secure, consistent experience for our customers.

From a few hundred PRs to thousands

I used to get stressed when the queue went past a few hundred PRs, because I knew updates would be delayed. As I write this, there are more than 5,000 open PRs for new applications and updates.

It has climbed quickly. On 12 October, someone opened a discussion simply asking when their PRs would be approved, and nobody from Microsoft replied. A few days later a contributor reported more than 4,100 open PRs. On 26 October, Stephen Gillie posted that 2,427 new package PRs had already passed validation and were just waiting for review, which he estimated was more than half of the whole queue.

Back in January, contributors were reporting new package PRs sitting for well over a week after passing validation, with some waiting four weeks or more. By September, one long-time contributor said the average processing time simply couldn’t be calculated anymore, because the waits had become so long.

The current setup is no longer working. It is at breaking point.

I’m not the only one who thinks so. In that same discussion, a contributor suggested Microsoft may need to “burn the barn down” to fix it. Their idea was to freeze and archive the current repository, then start a new one with hand-picked packages, where only vetted submitters are allowed to send PRs. When regular contributors are suggesting it be wiped and started again, that tells you how bad things have got.

How did it get this bad?

The ability for anyone to submit packages is one of the best things about Winget, and it has now come back to bite. There has been a huge rise in vibe coded applications being submitted, and some of these projects push multiple new versions a day.

Here’s a real example from the lack of active moderators discussion. In early October, one contributor had between 51 and 72 open PRs for a single app at the same time. They closed 71 of them after being pinged. Multiply that behaviour across hundreds of projects and the moderators simply can’t keep up.

Microsoft saw this coming. In January 2026, Demitrius Nelon from the Winget team said the repo was at “an inflection point” for the number of PRs being submitted.

The moderation problem

Getting a PR merged needs two things. A moderator has to approve it, and then the merge itself happens through Microsoft. Community moderators can approve, but only Microsoft employees or vendors can be given merge rights.

The problem is there are very few people doing either. In January, the contributor who started the moderators discussion said there was really only one admin processing packages full time, Stephen Gillie, with Demitrius Nelon helping out occasionally. In May, the same contributor tracked around 20 listed admins and moderators and found only four were reliably active.

The community repository’s docs say moderators are chosen by nomination from existing moderators. There is no way to apply. In all my time working in the repo, I don’t think I’ve seen a new moderator actually be added, and the public discussions back that up. In May, Microsoft said it was building a business case to get more admin support. Through to the end of October, no new admins have been confirmed. On 26 October, in a discussion asking why the community can’t help more, the Winget team admitted the documentation doesn’t explain how someone actually becomes a moderator.

One person holding it together

If you’ve submitted anything to Winget in the last year, you’ll know the name Stephen Gillie. His GitHub profile lists him as Microsoft external staff, and he is the main reason Winget hasn’t completely buckled.

He has built a semi-automated review process. It checks PRs every 30 minutes, uses virtual machines to install and scan the packages, approves the safe and simple cases automatically, and leaves him to deal with the edge cases. A write-up from May looked at PR reviews across Microsoft’s entire GitHub organisation, around 6,000 repositories. Stephen was the number one reviewer, ahead of the bots. A month and a half earlier, he alone had about as many reviews as the next eight human and bot reviewers combined. Community members estimate the repo needs to handle 600 or more PRs a day.

That is an incredible effort, and he deserves a lot of credit. But it also means one person is the single point of failure for a package manager that ships with Windows. Contributors have been openly asking what the backup plan is if he burns out or steps back. So far there hasn’t been a clear answer.

Setting the right expectations

If you’re an IT admin using Winget, it’s worth being realistic about two things. How you treat the people running it, and what you rely on it for.

The moderators don’t owe you anything.

Most of the people reviewing PRs in the community repository are volunteers giving up their own time, and the Microsoft staff involved are stretched well past what they should be. I’ve seen IT admins submit an app, then turn up in the comments a few days later demanding to know why it hasn’t been merged yet, as if the moderators owe them something. They don’t.

If you’re submitting to Winget, here’s how to make life easier for everyone, including yourself:

• Check your PR has passed validation and has no blocking labels before asking about it.
• Respond to feedback quickly. PRs waiting on the author are closed after 10 days.
• Don’t open duplicate PRs or keep tagging moderators. It only adds to the pile.
• Be patient. With thousands of PRs in the queue, waiting weeks is now normal.

Final thoughts

Winget isn’t struggling because the team did a bad job. It’s struggling because a free, community-run service became far more popular than Microsoft has resourced it for.

For Winget to keep going, I think three things need to change:

• Stricter rules for brand new apps. New apps should have to meet tougher criteria before they can be submitted at all, such as a minimum project age or a limit on how many versions can be in the queue at once. Automation should close PRs that don’t meet the criteria, so moderators never have to look at them.
• Faster approval for trusted vendors. Well established, reputable vendors should be able to skip manual review entirely. Their updates should be checked and merged by automation. This is what the verified developer work was meant to deliver, and it can’t come soon enough.
• Backup for Stephen. Right now one person is keeping the repo running. Microsoft needs to give Stephen more people with the access and tools to approve and merge PRs, so the whole service doesn’t depend on him being available.

Between them, these changes would take a big chunk of work off the moderators and let them focus on the PRs that actually need a human.

I really hope something changes, because Windows needs a good package manager and I still think that is Winget.