Windows Package Manager 1.30.140 Preview ships with --ignore-unavailable and crash fixes
Microsoft released Windows Package Manager 1.30.140 preview today. It's a servicing update that lands between the v1.30.90 and v1.30.180 previews, and it's doing what servicing releases should do: fixing annoyances and patching crashes rather than introducing shiny new features.
The release adds 8 commits across 21 files, contributed by six people. Keep in mind that this is a preview build. Microsoft describes it as a servicing release of the v1.30 train and asks users to file issues if something breaks. That's about as much marketing copy as you'll get.
Key changes
The headline addition is the --ignore-unavailable flag for winget install. If you've ever written a batch command like winget install Notepad++ 7zip Firefox Chrome only to have the whole thing abort because one app was removed from a source, this is for you.
The flag tells Winget to skip any packages it can't find and continue installing the rest. It brings the install command to parity with winget import, which already supported this behavior. First-time contributor @CatBraaain pushed the change in PR #6351.
The crash fix is probably the next most important item for anyone running Winget in automation pipelines. Previously, combining the Resume experimental feature with the --disable-interactivity flag triggered a fatal exception with HRESULT 0x8000ffff. If you're deploying packages via SCCM or Intune and needed both flags for non-interactive resumable installs, you know this was a blocker. It's fixed now.
Microsoft also addressed a long-standing quirk with Microsoft Store app searches. PR #6309 by @Trenly fixes issues where winget search --id <storeId> refused to work unless you also passed --exact. The search command now falls back to an optimized exact-ID manifest lookup for REST-backed sources when a substring query returns nothing.
On the security side, PR #6357 by @florelis hardens how Winget handles rooted paths in manifests. The validation function AppInstaller::Filesystem::PathEscapesBaseDirectory now checks for root paths before applying escape detection. This prevents crafted absolute, UNC, or drive-relative paths from slipping through validation. The fix was also backported to the v1.29 branch.
Internal workflow changes
The changelog includes a handful of internal updates that signal Microsoft is leaning hard into AI-assisted development within the repo.
The team added a root AGENTS.md file to nudge AI agents toward searching for duplicates, using issue forms, and following templates. There's also a policy rule to auto-label PRs that modify .github/copilot-instructions.md, plus an experimental agentic workflow that uses GitHub Copilot to identify open issues for closure based on merged PR references.
Dependabot handled security updates for the undici and fast-uri dependencies in the WinGetLogViewer tool, addressing several advisories including a high-severity Cache-Control disclosure vulnerability.
Head here to download the v1.30.140-preview from the GitHub releases page. The primary asset is a ~207 MB .msixbundle for sideloading. Keep in mind that as a preview, this build may contain rough edges.
