WinGet Package Version Manifests

Read version manifests from Microsoft's public WinGet package repository and export package identifiers, versions, locales and source links. Each dataset row represents an actual version manifest. The Actor verifies that the identifier and version inside the file match its repository path before exporting it.

This is useful when you need traceable package records for a Windows software inventory, compatibility research or an internal catalog. It requires no GitHub credentials and no proxy. Start with the three-record default to inspect the output before choosing a larger limit.

What you get

Field	Meaning
package_id	WinGet identifier read from PackageIdentifier, such as 0-don.clippy.
package_version	Exact PackageVersion string from the manifest.
default_locale	Default locale declared in the version manifest.
manifest_version	Version of the WinGet manifest format.
manifest_url	Direct link to the source YAML file.
source_url	GitHub page for the same file.
scraped_at	UTC timestamp when the Actor constructed the record.

Package identifiers and versions remain strings. For example, 1.5.12 is a package version, while 1.12.0 may be the manifest format version. Those fields describe different things and should not be compared as application releases. An identifier can appear more than once because the repository contains multiple versions of a package.

Example input

{"maxResults": 3}

maxResults sets the maximum number of version manifests written to the default dataset. It defaults to 3 and accepts values from 1 through 1,000. The limit counts package versions, not publishers, directories or distinct application names. A run with a limit of three can therefore return three versions of the same application.

The Actor walks the repository's manifest groups in the order returned by GitHub and stops at the requested result limit. It does not offer a search query, a date filter or a newest-release sort. Repeated small runs will normally revisit the beginning of the repository; they are useful for checking the integration, but they do not constitute a complete update feed.

Real output example

The cloud validation returned this package and version from a public version manifest. Timestamps change on each run.

{
  "package_id": "0-don.clippy",
  "package_version": "1.5.12",
  "default_locale": "en-US",
  "manifest_version": "1.12.0",
  "manifest_url": "https://raw.githubusercontent.com/microsoft/winget-pkgs/master/manifests/0/0-don/clippy/1.5.12/0-don.clippy.yaml",
  "source_url": "https://github.com/microsoft/winget-pkgs/blob/master/manifests/0/0-don/clippy/1.5.12/0-don.clippy.yaml"
}

Open manifest_url to inspect the YAML or use source_url to see the repository page. The Actor checks the manifest contents, rather than presenting GitHub directory entries as software packages. Installer manifests and locale manifests are separate files; they are not additional rows in this output.

Running the Actor

Enter a small maxResults value, start a run and inspect the Overview tab. Download the default dataset as JSON, CSV or Excel using Apify's dataset export controls. JSON keeps field names and values explicit; CSV is convenient for importing these flat records into an inventory table.

You can also save the input as an Apify Task and run it through the Task API. A saved Task stores the configuration. Its successful run creates a dataset containing that run's records. Keep the dataset ID alongside your import job so you can trace a catalog entry to the exact export that supplied it.

For unattended jobs, connect the successful-run event to your import workflow. Check run status before importing data. Do not treat an empty or failed run as evidence that packages disappeared from WinGet. GitHub outages and rate limits can prevent a run from completing even while the underlying repository remains available.

Inventory and comparison workflows

Use the pair package_id and package_version as a record key in your own database. Using only package_id would overwrite earlier versions when the next manifest for the same package arrives. Store manifest_version separately so a schema revision cannot be confused with an application upgrade.

When comparing two exports, remember that each export is bounded by its result limit. A record missing from a later limited export is not proof that the repository removed it. Likewise, the first version returned for an application is not necessarily its latest release. Repository path order is not chronological order, and package version formats are not universally compatible with semantic-version sorting.

The output can support an internal manifest browser, a traceability check against a known package identifier, or research into the versions listed in WinGet. For installation decisions, inspect the related installer manifest and the application's own documentation. This Actor does not download installers, execute packages, test compatibility, inspect installed software or assess whether a release is safe.

Reliability and limits

The Actor uses GitHub's public repository API to discover version files and reads the corresponding YAML from the same repository. It retries temporary server and rate-limit responses a bounded number of times. GitHub's unauthenticated limits still apply. A larger result limit may require more source requests and can fail if the source refuses further access.

GitHub can truncate very large recursive tree responses. The Actor fails visibly if it encounters that condition instead of silently describing a partial subtree as complete. It also rejects a version manifest whose identifier or version does not agree with its path. These checks protect the meaning of an exported row; they do not guarantee that every run can traverse the entire repository.

The source links point to the repository's current master branch. Files can change after a run. Save the source response or a commit-specific reference in your own archival process if you need immutable evidence. The Actor's observation timestamp records collection time, not the software release date or the date that a contributor added the file.

Pricing

Apify displays the current result price and available plan discounts in the Store pricing panel. A result is one exported version-manifest row. Review the run's usage and charged events in Console when planning larger jobs. The Actor does not require a separate paid scraping service or a user-supplied GitHub token.

Questions and support

Does this return only the latest package version? No. It exports version manifests in repository traversal order, with the requested upper limit.

Does it return installer download links? No. The version manifest identifies the package version and default locale. Installer files are separate source documents.

Can I search for a particular application? This version exposes a result limit only. Search, publisher selection and incremental traversal are not implemented.

Why do several rows share an identifier? They represent different versions. Deduplicate on both identifier and version if you combine exports.

What should I include in an issue? Share the public Actor run ID, the input and the relevant manifest URL. Avoid posting credentials or private inventory data. If the output proves useful in your workflow, a Store review helps other users assess it.

Keywords: WinGet package manifests, Windows package identifiers, WinGet versions, Microsoft winget-pkgs, software inventory, YAML manifest export.