[pull] master from microsoft:master - #57

The loc pipeline uses windows-2019 agents that are being deprecated.
###### Microsoft Reviewers: [Open in
CodeFlow](https://microsoft.github.io/open-pr/?codeflow=https://github.com/microsoft/winget-cli/pull/5538)

###### Microsoft Reviewers: [Open in
CodeFlow](https://microsoft.github.io/open-pr/?codeflow=https://github.com/microsoft/winget-cli/pull/5532)

## Change
Call `CoAllowSetForegroundWindow` from the PS module to prevent/reduce
instances of the UAC prompt being launched but not foreground.

## Change
Use `UseProdCLSIDs` rather than `WingetDisableTestHooks` to drive the
dev/not-dev decision in DSC v3 resources. This only matters to the
internal local builds; everywhere else they are the same value.

The last couple of builds have failed due to a missing SDK version
10.0.22621.0, presumably due to the agent images being updated to remove
this. The only project where we use this version is CommonCore,
everywhere else we use 26100 already. This PR updates CommonCore to use
the same SDK version as all the other projects.
###### Microsoft Reviewers: [Open in
CodeFlow](https://microsoft.github.io/open-pr/?codeflow=https://github.com/microsoft/winget-cli/pull/5570)

`Repair-WinGetPackageManager` is failing to install winget in some Win10
systems. The issue seems come from #5517 and be caused because in some
cases we fail to mark any one architecture as the right one to use for
dependencies. This PR is a partial revert of #5517 to add the previous
logic as a fallback.

May fix #5559 (but I haven't set up an environment to test it...)
###### Microsoft Reviewers: [Open in
CodeFlow](https://microsoft.github.io/open-pr/?codeflow=https://github.com/microsoft/winget-cli/pull/5568)

We are seeing a crash coming from cpprestsdk, which happened after
moving to use vcpkg dependencies and updating to v2.10.19. This reverts
to the version we knew to be good, but it may be that the actual issue
is not from cpprestsdk but from one of the patches from vcpkg.

We consume cpprestsdk from a local port overlay that we use to be able
to patch it with support for certificate pinning, so the main change is
to the script that creates the port overlay. The script makes a copy of
the port from the official registry; and this PR updates it so that it
can fetch a version from an older commit and not just the latest.
###### Microsoft Reviewers: [Open in
CodeFlow](https://microsoft.github.io/open-pr/?codeflow=https://github.com/microsoft/winget-cli/pull/5567)

…5564)

### What was fixed

[CompletionData.cpp](cci:7://file:///c:/Users/T2430514/Downloads/winget-cli/src/AppInstallerCLICore/CompletionData.cpp:0:0-0:0)
passed a potentially negative `char` to `std::isspace`, invoking
undefined behaviour on non-ASCII input (signed `char` platforms). This
occasionally caused crashes or incorrect cursor repositioning when
autocompleting commands containing UTF-8 characters.

### How it was fixed
The character is now explicitly cast to `unsigned char` before the
`std::isspace` check:

```cpp
!std::isspace(static_cast<unsigned char>(commandLine[cursor - 1]))
```

This aligns with standard C++ guidance and makes the completion logic
robust across all locales.
###### Microsoft Reviewers: [Open in
CodeFlow](https://microsoft.github.io/open-pr/?codeflow=https://github.com/microsoft/winget-cli/pull/5564)

Co-authored-by: Odio Marcelino <odiomarcelino@gmail.com>

#5567 didn't actually fix the crash we were seeing.

The actual cause of the crash seems to be that I missed adding some
compilation flags that we had added to the `.vcxproj` for cpprestsdk
when I moved the dependencies to vcpkg (which does not use the
`.vcxproj`). Specifically, I didn't set a flag to compile it without
async support, so the library used async but winget wasn't prepared for
that.

This PR adds the missing compilation flags for all ports, taken from the
project files before the migration to vcpkg. I added the flags to the
triplet files (conditionally) so that it applies the same regardless of
whether a port comes from the official registry or a local overlay.

I noticed that for `libyaml` and `jsoncpp` I missed the flags to prepare
for fuzzing, so I added a new triplet for those.

This PR also updates the pipeline to publish the compilation logs from
vcpkg for easier debugging in the future.
###### Microsoft Reviewers: [Open in
CodeFlow](https://microsoft.github.io/open-pr/?codeflow=https://github.com/microsoft/winget-cli/pull/5587)

Yet another attempt to fix that crash we are seeing 🙃
See #5587

In the past we had added `_DISABLE_CONSTEXPR_MUTEX_CONSTRUCTOR` globally
to fix a similar crash using `Directory.Build.props`, but that does not
flow from MSBuild to vcpkg. This change adds it to all the ports we use.
###### Microsoft Reviewers: [Open in
CodeFlow](https://microsoft.github.io/open-pr/?codeflow=https://github.com/microsoft/winget-cli/pull/5592)

## Change
Catch errors coming from `FindProvisionedPackages` and ignore them. This
is most likely to happen when the caller is not elevated.

## Change
Starting with the time that the UndockedRegFreeWinRT change was
introduced and working backward through commits, I found the equivalent
one (only whitespace changes are present, probably due to
auto-formatting). This change uses the existing overlay infrastructure
to update the detours port to that commit.

## Change
The reason for this configuration and build step have been lost. If this
builds just fine, I think we are safe to remove it.

Discussion on further MCP work:
#5609

## Change
This change adds an MCP server that provides two tools:

- Find packages
- Searches for packages based on a single input value, returning
information about each one found.
- Install package
- Installs a package given a single input value, which is expected to be
an identifier, name or moniker (same rules as `winget` CLI)

The package response looks like:
```JSON
{
  "identifier":"Microsoft.VisualStudioCode",
  "name":"Microsoft Visual Studio Code",
  "catalog":"winget",
  "isInstalled":true,
  "installedVersion":"1.102.1",
  "installedLocation":"%LOCALAPPDATA%\\Programs\\Microsoft VS Code\\",  <- Is actually real path, not tokenized
  "isUpdateAvailable":false
}
```

Also includes:
- A group policy that determines whether the MCP server is allowed to
operate
- An `mcp` command that helps with manually configuring an MCP client
- A change to the default COM caller behavior that makes it only use the
file name
- Also changes to not use the package family name if it is the same as
the current process (so we can better differentiate our own callers)
- A `Version` property on the `PackageManager` COM object that returns
the version string as `1.2.3` or `1.2.3-preview`.
- Start preferentially using this in the PowerShell module to get the
version rather than running the CLI

## Change
Noticed in official build that I forgot to disable the build for this
configuration.

## Issue
When trying to create the actual package containing the MCP server, we
found issues in merging the directory contents. Specifically, some
common nuget packages were used at different versions.

## Change
Reference the MCP project from the configuration server project, forcing
the nuget package resolution to consider them as one unit. This also
helpfully outputs them as merged already.

Also change the name of the directory in the package to reflect the
expanded contents.

## Change
Update to the latest nuget available for the C# MCP SDK.

See #4970
###### Microsoft Reviewers: [Open in
CodeFlow](https://microsoft.github.io/open-pr/?codeflow=https://github.com/microsoft/winget-cli/pull/5656)

## Issue
When the package needs to be updated, the COM server does not currently
shut down in response to the signals that it receives. This is because
it only shuts down when all COM object references have been released. We
need to be more proactive in termination as the process will be
terminated shortly after we are notified either way.

## Change
This change refactors the existing shutdown signaling code out from
`ExecutionContext.cpp` into its own, public location. It then adds
another system for coordinating complex shutdown that is triggered by
the signaler.

Individual subsystems can register with the shutdown synchronizer with
functions for:
- Disable new work
- Cancel current work
- Wait for quiesce

and on shutdown initialization, all subsystems are called for each stage
in order. When the final subsystem returns from waiting, the existing
"all COM objects have been released" event is signaled and the process
will exit.

Additionally, the shutdown signal handler waits for shutdown
synchronization to complete in the window message function as after we
return from that we are expected to be gone shortly after. While this
will lead to some increased number of non-quiescing processes, we want
to do the best that we can to cooperatively exit.

> [!NOTE]
> Any actions being taken by callers outside of those described below
will **NOT** block the process from exiting.

### Package Management
Registers with synchronization on `PackageManager` creation. All of its
functions lead back to the `ContextOrchestrator` which has been
enlightened to handle the shutdown (and to operate as a contained set of
instances for test purposes).

- **Disable new work** causes the orchestrator to refuse to queue items
with an exception for new items and a cancellation for existing ones.
- **Cancel current work** causes all queued items to be cancelled, with
different handling based on current status.
- **Wait for quiesce** waits on an event for each queue that is signaled
when the queue is empty.

### Configuration
Registers with synchronization on `ConfigurationStaticFunctionsShim`
creation (the `IConfigurationStatics` for OOP use). All of its functions
are routed through `IConfigurationStaticsInternals` to a new shutdown
handler. It tracks all of the async token objects used in the
"background" sections of the `ConfigurationProcessor` functions. This
tracking is performed automatically by new types that manage that
tracking with the lifetime. It also enables non-async invocations to be
cancelled by providing a dummy promise into the existing system.

- **Disable new work** causes an error whenever a new async token object
is created.
- **Cancel current work** causes all tracked async tokens to have their
`Cancel` function invoked.
- **Wait for quiesce** waits until all async tokens are destroyed.

## Change

PR improves the issues forms by giving the user the option to select the
relevant area, as well as the relevant CLI command if applicable.
Updated the policy bot triggers to automatically apply certain labels
based on the user selection from the issue body.

cc @Trenly @denelon
###### Microsoft Reviewers: [Open in
CodeFlow](https://microsoft.github.io/open-pr/?codeflow=https://github.com/microsoft/winget-cli/pull/5661)

<!-- To check a checkbox place an "x" between the brackets. e.g: [x] -->

- [x] I have signed the [Contributor License
Agreement](https://cla.opensource.microsoft.com/microsoft/winget-pkgs).
- [ ] I have updated the [Release Notes](../doc/ReleaseNotes.md).
  - Not Applicable
- [ ] This pull request is related to an issue.

-----

@mdanish-kh @denelon
###### Microsoft Reviewers: [Open in
CodeFlow](https://microsoft.github.io/open-pr/?codeflow=https://github.com/microsoft/winget-cli/pull/5663)

## Issue
The use of the COM static store was causing crashes on long lived
processes because the implementation of `DllCanUnloadNow` did not count
those objects, nor did it clean them up. This led to our module being
unloaded, then when it was reloaded, the recreation of the static store
object would invoke the deletion of the old one, which was pointing to
the old, unloaded module location.

## Design Considerations
WindowsPackageManager.dll serves many purposes, making the lifetime of
statics complex.
- It serves as "in-proc" for the CLI
- It is the core implementation for the in-proc COM
- It is the core implementation for the OOP COM

In order to support in-proc COM, we must put static lifetime COM objects
in the static store. But in order to support unloading, we must also
clean them up. Additionally, we don't want to claim to be in use if the
only active objects are our statics (which are typically just event
handlers and their owners).

We already use the WRL object count to track OOP COM server lifetime,
and similarly we use it to implement `DllCanUnloadNow`. This is the
count externally owned objects; those that the client has requested
directly or indirectly.

## Change
The major change is to remove all of our static store objects when WRL
says we have no more externally owned. This is achieved by tracking the
names of the objects that we insert and attempting to remove them when
appropriate.

The original change to use the static store was templatized and reused
to hold the termination signal handler.

## Validation
The new test uses the CLI to validate that the implementation for
`DllCanUnloadNow` (`WindowsPackageManagerInProcModuleTerminate`) detects
the unload state and properly destroys the relevant objects. This is
done by checking that there are internal objects allocated before the
call, but none after.

* Updates schema to 1.12 and adds type "font" as a valid InstallerType
and NestedInstallerType in the schema.
* Adds InstallerType Font to the manifest and associated Enum
conversions.
* Updated some of the NestedInstaller validation that had assumed
Portable type as the only type that could have multiple installer files
(fonts can also have many fonts in a package).
* Added validation for 1.12 fonts in the manifest and associated tests
for the schema version.

This PR does not add any functional support for Fonts, only the
validation and schema update so the new schema can be used and is valid
in the related WinGet tooling.

Tested:
* Passed the AppInstallerCLITests with [ManifestValidation] and ensured
a clean result.
* Added new tests for the v 1.12 manifest updated with the new installer
types in the test installer manifest to ensure Fonts are correctly
passing the validation.

Closes #5686 

<!-- To check a checkbox place an "x" between the brackets. e.g: [x] -->

- [x] I have signed the [Contributor License
Agreement](https://cla.opensource.microsoft.com/microsoft/winget-pkgs).
- [x] I have updated the [Release Notes](../doc/ReleaseNotes.md).
- [x] This pull request is related to an issue.

-----

Fixes #4996 

## Change
Adds the ability to specify the target OS version for downloads from the
Microsoft Store. This is achieved by filtering the set of applicable
platforms in `GetSfsPackageFileSupportedPlatforms` further than the
existing platform targeting. Now they must also have a minimum specified
OS version >= the target OS version.

`winget.exe download` has a new parameter `--os-version`. This is a
UINT64 version (4 part version with 2^16-1 maximum value for each part)
that should be given as the target OS version.

COM `DownloadOptions` has a new property `TargetOSVersion`, which is a
string of the same format as above.

PowerShell `Export-WinGetPackage` has a new parameter
`-TargetOSVersion`, which is also a string of the same format.

Also added the previously implemented options to skip the license
download (`--skip-license`) and the target platform (`--platform`) to
COM (`SkipMicrosoftStoreLicense` and `Platform`) and PowerShell
(`-SkipMicrosoftStoreLicense` and `-Platform`).

Fixes #5259 

## Change
Register the configuration class names in the manifest to support proper
activation (not C++/WinRT fallback behavior).

Change the configuration link inputs to use the older `icu*.dll` files
rather than the one that comes in the umbrella of `onecoreuap.lib`
[`icu.lib`].

Closes #5694 

Updates the RestSource and interface to support v1.12 Manifest schema.

* Added Manifest 1.12 Schema to the Rest source and support for the new
installer type.
* Added tests for v1.12 rest source.
* Added unit tests for WinGetUtilInterop for the v1.12 merged manifest
and validating the new installertype.

Tested:
* WinGetUtilInterop Unit tests passed, verified in debugger that the new
v1.12 manifest and manifest properties were being tested and validated.
* AppInstallerCLITests for [RestSource] and the new [Interface_1_12]
both pass.

<!-- To check a checkbox place an "x" between the brackets. e.g: [x] -->
(This is part of schema update for 1.12 so nothing new to add to release
notes.)

- [x] I have signed the [Contributor License
Agreement](https://cla.opensource.microsoft.com/microsoft/winget-pkgs).
- [x] I have updated the [Release Notes](../doc/ReleaseNotes.md).
- [x] This pull request is related to an issue.

-----

## 📖 Description
Adds a root AGENTS.md for agent compatibility and mirrors issue/PR
guidance in .github/copilot-instructions.md.

This nudges agents to search for duplicates, use the repository issue
forms instead of blank issues, keep issue bodies concise, and follow the
PR template when opening pull requests.

## 🔗 References
Related context: #6433

## 🔍 Validation
Docs-only change. Reviewed the Markdown content and git diff.

## ✅ Checklist

- [ ] Signed the [Contributor License
Agreement](https://cla.opensource.microsoft.com)
- [x] Linked to an issue
- [ ] Updated [Release Notes](../doc/ReleaseNotes.md) (if applicable)
- [x] Updated documentation (if applicable)
- [x] Updated [Copilot instructions](.github/copilot-instructions.md)
(if build, architecture, or conventions changed)

## 📋 Issue Type
- [ ] Bug fix
- [ ] Feature
- [x] Task
###### Microsoft Reviewers: [Open in
CodeFlow](https://microsoft.github.io/open-pr/?codeflow=https://github.com/microsoft/winget-cli/pull/6446)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

## 📖 Description
Especially, Windows Server 2022 had been described pretty vaguely
previously; this PR explains how to get it running.

It also lists Windows Server 2025 and Windows 11 as fully supported just
in case, Windows Server 2019 as getting it to run, and Windows Server
Core / earlier Windows versions as not getting it to run and why.

## 🔗 References
* In large part based on #4502.

## 🔍 Validation
I spent an afternoon in early July or late June 2026 on gradually
testing my way from Windows 8.0 RTM (the earliest Windows version to
support UWP executable formats) onwards, seeing if the extracted
`winget.exe` could be run or not, and noted down the most important ones
of the error messages if not.

What I remember that I tested with in VMs, and the results:
— Windows 8.0 RTM
— Windows 8.1 RTM
— Windows Server 2016 RTM
✓ Windows Server 2019 RTM
— (Previous tests) Windows Server Core 2025
— (Test done 9 August 2026) Windows 10 1709 x64 (Only the `msstore`
source works with `winget list`, and trying to install from that source
leads to `0x80040154 : Class not registered`)
✓ (Test done 12 August 2026) Windows 11 SE 23H2 x64 (Wasn't the easiest
thing to accomplish, so I'll write a quickguide for it at some point.)

## ✅ Checklist
<!-- Place an "x" between the brackets to check an item. e.g: [x] -->

- [x] Signed the [Contributor License
Agreement](https://cla.opensource.microsoft.com)
- [x] Linked to an issue
- [ ] Updated [Release Notes](../doc/ReleaseNotes.md) (if applicable)
- [ ] Updated documentation (if applicable)
- [ ] Updated [Copilot instructions](.github/copilot-instructions.md)
(if build, architecture, or conventions changed)

## 📋 Issue Type
<!-- Select the type that best describes this PR -->
- [x] Bug fix
- [ ] Feature
- [ ] Task

###### Microsoft Reviewers: [Open in
CodeFlow](https://microsoft.github.io/open-pr/?codeflow=https://github.com/microsoft/winget-cli/pull/6447)

## 📖 Description
<!-- Describe what this PR changes, why, and any limitations. -->

The way we were checking that a relative path was inside a directory was
wrong because it didn't check if the path was rooted. This PR fixes
that.

## 📖 Description

Adds the valid Dependabot configuration key `cooldown` to the spelling
allow-list so the Check Spelling workflow accepts the configuration
introduced by #6471.

## 📖 Description
<!-- Describe what this PR changes, why, and any limitations. -->
Changes status icons for v1.28 release (completed February 28, 2026) and
v1.29 release (completed June 30, 2026)

## 🔗 References
<!-- Link related issues, PRs, or docs. Use "Resolves #1234" to
auto-close. -->
Resolves [#6482](#6482)
v1.28 completion: https://github.com/microsoft/winget-cli/milestone/48
v1.29 completion: https://github.com/microsoft/winget-cli/milestone/49

## 🔍 Validation
<!-- How did you test? List manual steps or note automated test
coverage. -->
Verified both completed releases show the standard checkmark (same as
v1.12 release)

## ✅ Checklist
<!-- Place an "x" between the brackets to check an item. e.g: [x] -->

- [x] Signed the [Contributor License
Agreement](https://cla.opensource.microsoft.com)
- [x] Linked to an issue
- [x] Updated [Release Notes](../doc/ReleaseNotes.md) (if applicable)
- [x] Updated documentation (if applicable)
- [x] Updated [Copilot instructions](.github/copilot-instructions.md)
(if build, architecture, or conventions changed)

## 📋 Issue Type
<!-- Select the type that best describes this PR -->
- [ ] Bug fix
- [ ] Feature
- [x] Task

###### Microsoft Reviewers: [Open in
CodeFlow](https://microsoft.github.io/open-pr/?codeflow=https://github.com/microsoft/winget-cli/pull/6483)

## Summary

This PR pins GitHub Actions to full-length commit SHAs for improved
security and reproducibility and adds a 7 day cooldown to Dependabot
configuration for GitHub Actions. This work is described in more detail
at https://aka.ms/action-pinning.

## Why?

Pinning actions to commit SHAs prevents supply-chain attacks where a tag
could be moved to point to malicious code. This is a recommended
security best practice per the [GitHub Actions security hardening
guide](https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions).

This change mitigates the risk of tag retargeting to malicious code as
seen in incidents like the [tj-actions/changed-files action
compromise](https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised)
or [codfish/semantic-release-action
compromise](https://www.stepsecurity.io/blog/supply-chain-compromise-codfish-semantic-release-action)
and improves the integrity and reproducibility of the CI/CD pipeline.

## What changed?

**Action pinning:** Third-party action references in
`.github/workflows/` that used mutable tag-based references (e.g.,
`actions/checkout@v4`) have been updated to full-length commit SHAs with
a version comment (e.g., `actions/checkout@<sha> # v4`) using the
[pinact](https://github.com/suzuki-shunsuke/pinact) tool. References
that were already pinned to a SHA, or that used immutable release tags,
were left unchanged.

**Dependabot configuration:** `.github/dependabot.yml` has been updated
to ensure a `github-actions` package-ecosystem section is present with a
`cooldown` configuration (`default-days: 7`). If the file did not exist,
it was created. If a `github-actions` section already existed, only the
`cooldown` block was added or its `default-days` value was increased to
7 if it was lower. The 7-day cooldown provides a window for the
community to detect and report compromised releases before they are
automatically proposed as updates, reducing exposure to supply-chain
attacks via newly published malicious versions.

## Is this safe to merge?

Yes. The pinned SHAs correspond to the same commits that the existing
tags pointed to. No behavioral changes in action execution are
introduced. You can verify the pinned SHA value using the GitHub REST
API (e.g., the commit hash for `actions/checkout@v7` can be found in the
`sha` property in the JSON response for `GET
https://api.github.com/repos/actions/checkout/commits/v7`).

## Additional Information

For more information, please see https://aka.ms/action-pinning

###### Microsoft Reviewers: [Open in
CodeFlow](https://microsoft.github.io/open-pr/?codeflow=https://github.com/microsoft/winget-cli/pull/6471)

## 📖 Description
Add a persistent `output.locale` user setting that allows overriding
winget interface string resolution by BCP47 tag.

Current implementation details:
- Reads `.output.locale` at CLI startup and applies the override only
when the setting is non-empty.
- Applies the override through `Resource::SetLanguageOverride`, which
sets the MRT `Language` qualifier for winget resource loading.
- Treats override failures as non-fatal (logs warning and continues
without the override).
- Uses `wil::srwlock` in the shared resource loader for synchronized
read/write access when resolving strings and updating locale override.
- Does not apply this setting in server initialization.

This PR also updates settings schema/documentation and local package
resource fallback handling for localized `winget.resw` files.

## 📖 Description
Sort each exported source's package list by package identifier. For the default
export mode, remove repeated identifiers after sorting. Keep repeated entries
when `--include-versions` is present so distinct version records are retained.

The workflow tests now start from an intentionally unsorted source and include
a duplicate package, then assert ordering and the mode-specific duplicate behavior.

AI assistance: OpenAI Codex helped draft the implementation and tests. I
reviewed the complete diff and validation evidence and take responsibility for
the contribution.

…ctions group (#6491)

Removed outdated information regarding Windows Package Manager Insider
program and pre-release builds.

This updates the NuGet dependencies due to a CVE in
`System.Security.Cryptography.Xml`. Instead of pinning its version to
something higher, I'm updating the root dependency to one that already
uses a good version. I'm also removing the pinned version for the
dependency and letting the root handle it. Same for a few other packages
that we were listing just to pin to a secure version.
###### Microsoft Reviewers: [Open in
CodeFlow](https://microsoft.github.io/open-pr/?codeflow=https://github.com/microsoft/winget-cli/pull/6416)

…ctions group (#6501)

Bumps the github-actions group with 1 update:
[github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions).

Updates `github/gh-aw-actions/setup` from 0.87.1 to 0.87.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="proxy.php?url=https%3A%2F%2Fgithub.com%2Fxxoolm%2Fwinget-cli%2Fpull%2F%3Ca+href%3D"https://github.com/github/gh-aw-actions/releases">github/gh-aw-actions/setup's">https://github.com/github/gh-aw-actions/releases">github/gh-aw-actions/setup's
releases</a>.</em></p>
<blockquote>
<h2>v0.87.5</h2>
<p>Sync of actions from <a
href="proxy.php?url=https%3A%2F%2Fgithub.com%2Fxxoolm%2Fwinget-cli%2Fpull%2F%3Ca+href%3D"https://github.com/github/gh-aw">gh-aw</a">https://github.com/github/gh-aw">gh-aw</a> at
<code>v0.87.5</code>.</p>
<h2>v0.87.4</h2>
<p>Sync of actions from <a
href="proxy.php?url=https%3A%2F%2Fgithub.com%2Fxxoolm%2Fwinget-cli%2Fpull%2F%3Ca+href%3D"https://github.com/github/gh-aw">gh-aw</a">https://github.com/github/gh-aw">gh-aw</a> at
<code>v0.87.4</code>.</p>
<h2>v0.87.2</h2>
<p>Sync of actions from <a
href="proxy.php?url=https%3A%2F%2Fgithub.com%2Fxxoolm%2Fwinget-cli%2Fpull%2F%3Ca+href%3D"https://github.com/github/gh-aw">gh-aw</a">https://github.com/github/gh-aw">gh-aw</a> at
<code>v0.87.2</code>.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="proxy.php?url=https%3A%2F%2Fgithub.com%2Fxxoolm%2Fwinget-cli%2Fpull%2F%3Ca+href%3D"https://github.com/github/gh-aw-actions/commit/2a78d04403fdc6907d0f05327cffac9dbad5312d"><code>2a78d04</code></a">https://github.com/github/gh-aw-actions/commit/2a78d04403fdc6907d0f05327cffac9dbad5312d"><code>2a78d04</code></a>
chore: sync actions from gh-aw@v0.87.5 (<a
href="proxy.php?url=https%3A%2F%2Fgithub.com%2Fxxoolm%2Fwinget-cli%2Fpull%2F%3Ca+href%3D"https://redirect.github.com/github/gh-aw-actions/issues/218">#218</a>)</li">https://redirect.github.com/github/gh-aw-actions/issues/218">#218</a>)</li>
<li><a
href="proxy.php?url=https%3A%2F%2Fgithub.com%2Fxxoolm%2Fwinget-cli%2Fpull%2F%3Ca+href%3D"https://github.com/github/gh-aw-actions/commit/ea4b911d44a5336c74325a122a5fd9110b45ff06"><code>ea4b911</code></a">https://github.com/github/gh-aw-actions/commit/ea4b911d44a5336c74325a122a5fd9110b45ff06"><code>ea4b911</code></a>
chore: sync actions from gh-aw@v0.87.4 (<a
href="proxy.php?url=https%3A%2F%2Fgithub.com%2Fxxoolm%2Fwinget-cli%2Fpull%2F%3Ca+href%3D"https://redirect.github.com/github/gh-aw-actions/issues/217">#217</a>)</li">https://redirect.github.com/github/gh-aw-actions/issues/217">#217</a>)</li>
<li><a
href="proxy.php?url=https%3A%2F%2Fgithub.com%2Fxxoolm%2Fwinget-cli%2Fpull%2F%3Ca+href%3D"https://github.com/github/gh-aw-actions/commit/b304200a0ef4b3998673bfc7945acb08ab8c88b7"><code>b304200</code></a">https://github.com/github/gh-aw-actions/commit/b304200a0ef4b3998673bfc7945acb08ab8c88b7"><code>b304200</code></a>
chore: sync actions from gh-aw@v0.87.2 (<a
href="proxy.php?url=https%3A%2F%2Fgithub.com%2Fxxoolm%2Fwinget-cli%2Fpull%2F%3Ca+href%3D"https://redirect.github.com/github/gh-aw-actions/issues/216">#216</a>)</li">https://redirect.github.com/github/gh-aw-actions/issues/216">#216</a>)</li>
<li>See full diff in <a
href="proxy.php?url=https%3A%2F%2Fgithub.com%2Fxxoolm%2Fwinget-cli%2Fpull%2F%3Ca+href%3D"https://github.com/github/gh-aw-actions/compare/423b3dc04bbf1b1797194a4a75aa5cf5d0d4f5b3...2a78d04403fdc6907d0f05327cffac9dbad5312d">compare">https://github.com/github/gh-aw-actions/compare/423b3dc04bbf1b1797194a4a75aa5cf5d0d4f5b3...2a78d04403fdc6907d0f05327cffac9dbad5312d">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github/gh-aw-actions/setup&package-manager=github_actions&previous-version=0.87.1&new-version=0.87.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>
###### Microsoft Reviewers: [Open in
CodeFlow](https://microsoft.github.io/open-pr/?codeflow=https://github.com/microsoft/winget-cli/pull/6501)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

## 📖 Description
Pipeline builds have been failing sporadically in the build step due to
a space issue (yet again). Disabling incremental linking there reduces
the disk footprint.

## 📖 Description
On our MS managed devices, we must leverage this feed for nuget
packages. It is public, so this shouldn't cause any issues externally.

## Summary

Fixes #6319.

`HRESULT_FROM_WIN32(ERROR_INTERNET_CANNOT_CONNECT)` is a WinINet error.
On MSVC, `std::system_category().message(12029)` and
`std::system_category().message(0x80072efd)` both return `unknown
error`, so decoding the HRESULT alone cannot provide the useful WinINet
diagnostic.

This change decodes `FACILITY_WIN32` HRESULTs and retrieves
WinINet-range messages from `wininet.dll`, falling back to
`std::system_category` for all other errors.

## Changes

- Centralize system error formatting for both user-facing HRESULT paths.
- Retrieve localized WinINet messages from the WinINet message table.
- Cover both `GetUserPresentableMessage` and
`HResultInformation::Find(...)->GetDescription()`.

Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.5 to
3.1.7.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="proxy.php?url=https%3A%2F%2Fgithub.com%2Fxxoolm%2Fwinget-cli%2Fpull%2F%3Ca+href%3D"https://github.com/fastify/fast-uri/releases">fast-uri's">https://github.com/fastify/fast-uri/releases">fast-uri's
releases</a>.</em></p>
<blockquote>
<h2>v3.1.7</h2>
<h2>⚠️ Security Warning</h2>
<p>This is a security release that fixes the following high-severity
security advisories:</p>
<ul>
<li><a
href="proxy.php?url=https%3A%2F%2Fgithub.com%2Fxxoolm%2Fwinget-cli%2Fpull%2F%3Ca+href%3D"https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3">GHSA-qw65-cvwx-89v3</a">https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3">GHSA-qw65-cvwx-89v3</a>
— authority injection via an unvalidated port in
<code>serialize()</code></li>
<li><a
href="proxy.php?url=https%3A%2F%2Fgithub.com%2Fxxoolm%2Fwinget-cli%2Fpull%2F%3Ca+href%3D"https://github.com/fastify/fast-uri/security/advisories/GHSA-58mr-gqgx-xq4g">GHSA-58mr-gqgx-xq4g</a">https://github.com/fastify/fast-uri/security/advisories/GHSA-58mr-gqgx-xq4g">GHSA-58mr-gqgx-xq4g</a>
— host confusion via unbalanced or misplaced IP-literal brackets</li>
</ul>
<p>Users of the v3.x release line should upgrade to v3.1.7.</p>
<p><strong>Full Changelog</strong>: <a
href="proxy.php?url=https%3A%2F%2Fgithub.com%2Fxxoolm%2Fwinget-cli%2Fpull%2F%3Ca+href%3D"https://github.com/fastify/fast-uri/compare/v3.1.6...v3.1.7">https://github.com/fastify/fast-uri/compare/v3.1.6...v3.1.7</a></p">https://github.com/fastify/fast-uri/compare/v3.1.6...v3.1.7">https://github.com/fastify/fast-uri/compare/v3.1.6...v3.1.7</a></p>
<h2>v3.1.6</h2>
<h2>⚠️ Security Warning</h2>
<p>This release addresses the following high-severity security
advisories:</p>
<ul>
<li><a
href="proxy.php?url=https%3A%2F%2Fgithub.com%2Fxxoolm%2Fwinget-cli%2Fpull%2F%3Ca+href%3D"https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8">GHSA-5jgf-p345-68v8</a">https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8">GHSA-5jgf-p345-68v8</a>
— host confusion via skipped IDN canonicalization on scheme-relative
references</li>
<li><a
href="proxy.php?url=https%3A%2F%2Fgithub.com%2Fxxoolm%2Fwinget-cli%2Fpull%2F%3Ca+href%3D"https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf">GHSA-fph4-wmhf-6fwf</a">https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf">GHSA-fph4-wmhf-6fwf</a>
— server-side request forgery via repeated hostname
percent-decoding</li>
<li><a
href="proxy.php?url=https%3A%2F%2Fgithub.com%2Fxxoolm%2Fwinget-cli%2Fpull%2F%3Ca+href%3D"https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc">GHSA-f65p-4m7j-42xc</a">https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc">GHSA-f65p-4m7j-42xc</a>
— server-side request forgery via malformed IPv6 normalization</li>
<li><a
href="proxy.php?url=https%3A%2F%2Fgithub.com%2Fxxoolm%2Fwinget-cli%2Fpull%2F%3Ca+href%3D"https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp">GHSA-jqff-g426-hqxp</a">https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp">GHSA-jqff-g426-hqxp</a>
— host confusion via percent-encoded scheme normalization</li>
</ul>
<p>Users of the v3.x release line should upgrade to v3.1.6.</p>
<p><strong>Full Changelog</strong>: <a
href="proxy.php?url=https%3A%2F%2Fgithub.com%2Fxxoolm%2Fwinget-cli%2Fpull%2F%3Ca+href%3D"https://github.com/fastify/fast-uri/compare/v3.1.5...v3.1.6">https://github.com/fastify/fast-uri/compare/v3.1.5...v3.1.6</a></p">https://github.com/fastify/fast-uri/compare/v3.1.5...v3.1.6">https://github.com/fastify/fast-uri/compare/v3.1.5...v3.1.6</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="proxy.php?url=https%3A%2F%2Fgithub.com%2Fxxoolm%2Fwinget-cli%2Fpull%2F%3Ca+href%3D"https://github.com/fastify/fast-uri/commit/412e40abd4eb8beabfb952d80abf949a2baf27a3"><code>412e40a</code></a">https://github.com/fastify/fast-uri/commit/412e40abd4eb8beabfb952d80abf949a2baf27a3"><code>412e40a</code></a>
Bumped v3.1.7</li>
<li><a
href="proxy.php?url=https%3A%2F%2Fgithub.com%2Fxxoolm%2Fwinget-cli%2Fpull%2F%3Ca+href%3D"https://github.com/fastify/fast-uri/commit/9f4c943e4d2133e8d78e0941203879216255bb01"><code>9f4c943</code></a">https://github.com/fastify/fast-uri/commit/9f4c943e4d2133e8d78e0941203879216255bb01"><code>9f4c943</code></a>
fix: backport port and IP-literal validation to v3.x (<a
href="proxy.php?url=https%3A%2F%2Fgithub.com%2Fxxoolm%2Fwinget-cli%2Fpull%2F%3Ca+href%3D"https://redirect.github.com/fastify/fast-uri/issues/216">#216</a>)</li">https://redirect.github.com/fastify/fast-uri/issues/216">#216</a>)</li>
<li><a
href="proxy.php?url=https%3A%2F%2Fgithub.com%2Fxxoolm%2Fwinget-cli%2Fpull%2F%3Ca+href%3D"https://github.com/fastify/fast-uri/commit/1eb3ce436fe050807caba79f886ab894f485a588"><code>1eb3ce4</code></a">https://github.com/fastify/fast-uri/commit/1eb3ce436fe050807caba79f886ab894f485a588"><code>1eb3ce4</code></a>
fix: treat unterminated bracket hosts as reg-names again (<a
href="proxy.php?url=https%3A%2F%2Fgithub.com%2Fxxoolm%2Fwinget-cli%2Fpull%2F%3Ca+href%3D"https://redirect.github.com/fastify/fast-uri/issues/214">#214</a>)</li">https://redirect.github.com/fastify/fast-uri/issues/214">#214</a>)</li>
<li><a
href="proxy.php?url=https%3A%2F%2Fgithub.com%2Fxxoolm%2Fwinget-cli%2Fpull%2F%3Ca+href%3D"https://github.com/fastify/fast-uri/commit/6f970b2951fd896aa0f3a7ff28eeb6640c137d33"><code>6f970b2</code></a">https://github.com/fastify/fast-uri/commit/6f970b2951fd896aa0f3a7ff28eeb6640c137d33"><code>6f970b2</code></a>
Bumped v3.1.6</li>
<li><a
href="proxy.php?url=https%3A%2F%2Fgithub.com%2Fxxoolm%2Fwinget-cli%2Fpull%2F%3Ca+href%3D"https://github.com/fastify/fast-uri/commit/d941579a84273ec7e96bde596b1f7a8be447df2a"><code>d941579</code></a">https://github.com/fastify/fast-uri/commit/d941579a84273ec7e96bde596b1f7a8be447df2a"><code>d941579</code></a>
fix: never run IDN canonicalization on bracketed IP literals</li>
<li><a
href="proxy.php?url=https%3A%2F%2Fgithub.com%2Fxxoolm%2Fwinget-cli%2Fpull%2F%3Ca+href%3D"https://github.com/fastify/fast-uri/commit/c0f0279cf370cb89ee56b04bbcde2a7afbe81aba"><code>c0f0279</code></a">https://github.com/fastify/fast-uri/commit/c0f0279cf370cb89ee56b04bbcde2a7afbe81aba"><code>c0f0279</code></a>
test: adapt decoded-scheme handler assertion to 3.x (no mailto
scheme)</li>
<li><a
href="proxy.php?url=https%3A%2F%2Fgithub.com%2Fxxoolm%2Fwinget-cli%2Fpull%2F%3Ca+href%3D"https://github.com/fastify/fast-uri/commit/37f3417c82994279656854f83ce938acd81c3862"><code>37f3417</code></a">https://github.com/fastify/fast-uri/commit/37f3417c82994279656854f83ce938acd81c3862"><code>37f3417</code></a>
Merge commit from fork</li>
<li><a
href="proxy.php?url=https%3A%2F%2Fgithub.com%2Fxxoolm%2Fwinget-cli%2Fpull%2F%3Ca+href%3D"https://github.com/fastify/fast-uri/commit/607bfbe953f28a14c2e06ae64aff38c81ca2937f"><code>607bfbe</code></a">https://github.com/fastify/fast-uri/commit/607bfbe953f28a14c2e06ae64aff38c81ca2937f"><code>607bfbe</code></a>
Merge commit from fork</li>
<li><a
href="proxy.php?url=https%3A%2F%2Fgithub.com%2Fxxoolm%2Fwinget-cli%2Fpull%2F%3Ca+href%3D"https://github.com/fastify/fast-uri/commit/ae92a4c5d8c4b6c9e447f048d5fcbde7eebd5514"><code>ae92a4c</code></a">https://github.com/fastify/fast-uri/commit/ae92a4c5d8c4b6c9e447f048d5fcbde7eebd5514"><code>ae92a4c</code></a>
Merge commit from fork</li>
<li><a
href="proxy.php?url=https%3A%2F%2Fgithub.com%2Fxxoolm%2Fwinget-cli%2Fpull%2F%3Ca+href%3D"https://github.com/fastify/fast-uri/commit/444ecdad447db2cc23c4d422acc6f0daa6fa8eef"><code>444ecda</code></a">https://github.com/fastify/fast-uri/commit/444ecdad447db2cc23c4d422acc6f0daa6fa8eef"><code>444ecda</code></a>
Merge commit from fork</li>
<li>Additional commits viewable in <a
href="proxy.php?url=https%3A%2F%2Fgithub.com%2Fxxoolm%2Fwinget-cli%2Fpull%2F%3Ca+href%3D"https://github.com/fastify/fast-uri/compare/v3.1.5...v3.1.7">compare">https://github.com/fastify/fast-uri/compare/v3.1.5...v3.1.7">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=fast-uri&package-manager=npm_and_yarn&previous-version=3.1.5&new-version=3.1.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/microsoft/winget-cli/network/alerts).

</details>
###### Microsoft Reviewers: [Open in
CodeFlow](https://microsoft.github.io/open-pr/?codeflow=https://github.com/microsoft/winget-cli/pull/6502)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

## 📖 Description

The initial sizing call to `FindPackagesByPackageFamily` returns
`ERROR_INSUFFICIENT_BUFFER` when matching packages exist, but can
validly return `ERROR_SUCCESS` with a count of zero when no package is
registered for the current identity.

The current code passes that success result to a failure-only WIL macro,
causing the calling process to CRASH through FAIL_FAST instead of
receiving a normal HRESULT. This change accepts the valid empty result
and lets the existing control flow return
`ERROR_PACKAGE_NOT_REGISTERED_FOR_USER` instead.

The registered-package path and propagation of other Win32 errors remain
unchanged. This is consistent with the handling established in #2922.

For the SYSTEM scenario in #4944, this prevents the direct CRASH caused
by FAIL_FAST, but does not add OutOfProc COM support, enumerate packages
registered to other users, or use staged packages.

## 📖 Description
Enable PR validation for feature branches

## 🔗 References
<!-- Link related issues, PRs, or docs. Use "Resolves #1234" to
auto-close. -->

## 🔍 Validation
<!-- How did you test? List manual steps or note automated test
coverage. -->

## ✅ Checklist
<!-- Place an "x" between the brackets to check an item. e.g: [x] -->

- [ ] Signed the [Contributor License
Agreement](https://cla.opensource.microsoft.com)
- [ ] Linked to an issue
- [ ] Updated [Release Notes](../doc/ReleaseNotes.md) (if applicable)
- [ ] Updated documentation (if applicable)
- [ ] Updated [Copilot instructions](.github/copilot-instructions.md)
(if build, architecture, or conventions changed)

## 📋 Issue Type
<!-- Select the type that best describes this PR -->
- [ ] Bug fix
- [ ] Feature
- [ ] Task

###### Microsoft Reviewers: [Open in
CodeFlow](https://microsoft.github.io/open-pr/?codeflow=https://github.com/microsoft/winget-cli/pull/6510)

Created a custom pool for our build pipeline that has additional
resources compared to the standard Microsoft-hosted agents. This should
help with the recurring issues of running out of disk space. Only using
the new pool for the build jobs, since they are the ones that need more
resources and I ran into issues getting the tests working in the new
pool.
###### Microsoft Reviewers: [Open in
CodeFlow](https://microsoft.github.io/open-pr/?codeflow=https://github.com/microsoft/winget-cli/pull/6521)

The log viewer is not used and is not built in any pipeline, so it
doesn't seem worth the overhead to keep the dependencies pinned to an up
to date version.

## 📖 Description
Fonts added a dynamic extension without changing the return from view to
string.

## 📖 Description
Adds a debug command (`validate-store-pinning`) to check the current
Store cert pinning against a target URL.

## 📖 Description

This PR updates portable alias handling to preserve original executable
filenames and use hardlink aliases instead of renaming files.

### What changed

**New `PortableFileType::Hardlink` support**
(`src/AppInstallerCommonCore/Public/winget/PortableFileEntry.h`):
- Added `Hardlink` enum value to `PortableFileType`
- Added `PortableFileEntry::CreateHardlinkEntry(...)` factory method

**New `CreateHardlink` filesystem helper**
(`src/AppInstallerSharedLib/Public/winget/Filesystem.h`,
`src/AppInstallerSharedLib/Filesystem.cpp`):
- `CreateHardlink(target, link)` wraps
`std::filesystem::create_hard_link` with error handling; returns `false`
(instead of throwing) when hardlinks are unsupported

**Updated portable flow**
(`src/AppInstallerCLICore/Workflows/PortableFlow.cpp`):
- Original executable filenames are no longer changed; the file is
placed under its original name in the install directory
- Alias names (`--rename`, `Commands`, `PortableCommandAlias`) are
satisfied by creating a hardlink in the install directory next to the
original executable
- Symlinks in the Links directory continue to point to the original
executable path
- For archive portables, hardlinks for nested executables are placed
alongside the original extracted file; a `fileHashes` map avoids
re-reading files from disk to obtain the SHA256

**Updated portable installer**
(`src/AppInstallerCLICore/PortableInstaller.cpp`):
- Verify, install, and remove logic now handles
`PortableFileType::Hardlink` entries (fallback to file copy if hardlinks
are not supported by the volume)
- `RemoveFromPathVariable` gains an `onlyIfEmpty` parameter to correctly
handle partial-uninstall scenarios where the Links directory still
contains symlinks from other packages
- Symlink-creation logic correctly transitions the
`InstallDirectoryAddedToPath` ARP state: adds install dir to PATH on
failure, removes it again when a subsequent symlink succeeds on upgrade
- ARP state reconstruction (`InitializeExpectedEntries`) now detects and
tracks hardlink aliases so they are removed during uninstall even when
state is rebuilt from ARP values

**New E2E test manifests**
(`src/AppInstallerCLIE2ETests/TestData/Manifests/`):
- `TestZipInstaller_Portable_PathFallbackToSymlink` (v1, v2) — package
that switches from PATH-based install to symlink on upgrade
- `TestZipInstaller_Portable_SymlinkToPathFallback` (v1, v2) — package
that switches from symlink to PATH-based install on upgrade

**Updated E2E tests**:
- `InstallCommand.cs`: 3 new tests verifying hardlink creation for
`--rename`, `Commands`, and archive `PortableCommandAlias`
- `UninstallCommand.cs`: 3 new tests verifying hardlink cleanup, correct
retention/removal of the Links PATH entry when multiple packages share
it, and PATH cleanup for archive portables with
`ArchiveBinariesDependentOnPath`
- `UpgradeCommand.cs`: 2 new tests verifying PATH/symlink state is
correctly re-evaluated when a package switches between symlink and
PATH-based aliasing across versions
- `TestCommon.cs`: minor helper additions
- Removed unused `testResult` variable in existing uninstall test

**Updated release notes** (`doc/ReleaseNotes.md`)

### User-visible behavior

- Portable originals are no longer renamed; the original executable
exists alongside its alias in the install directory.
- Alias names are provided as hardlinks, so commands work in
non-symlinked (PATH-based) scenarios.
- When symlink creation fails, the install directory is added to PATH as
a fallback; if a subsequent upgrade can create a symlink, the install
directory is removed from PATH automatically.
- The Links directory is only removed from PATH when it becomes empty
(i.e., no other symlinked packages remain).

…6402)

## 📖 Description

Strengthens contributor guidance to better support `Help-Wanted`
contributions. Addresses the four sub-issues tracked under #6393:

- Adds an explicit testing policy to `CONTRIBUTING.md` specifying when
unit and E2E tests are expected, when they may be omitted, and how to
run them.
- Adds `doc/Standards.md`, a new coding conventions reference covering
file formatting, brace style, naming (C++ and C#), error handling
(`WIL`/`AICLI_*` macros), casts, `std::move()` usage, and resource
string requirements.
- Adds an AI-assisted contributions policy to `CONTRIBUTING.md`
clarifying that contributors are fully accountable for AI-generated code
and must disclose material AI use in their PR.
- Updates `.github/PULL_REQUEST_TEMPLATE.md` to add an evidence prompt
in the Validation section, a tests checkbox, and an AI Assistance
disclosure section.
- Updates `doc/Developing.md` to cross-reference `doc/Standards.md` and
add a dedicated "Running End-to-End Tests" section.
- Updates `.github/copilot-instructions.md` to document PR expectations
for AI-assisted work and normalize trailing whitespace.

cc @denelon

## 🔗 References

- Relates to #6393
- Resolves #6394
- Resolves #6395
- Resolves #6396
- Resolves #6397

## 🔍 Validation

Documentation-only changes. All cross-references and Markdown anchor
links verified. No functional code changed.

## ✅ Checklist

- [x] Signed the [Contributor License
Agreement](https://cla.opensource.microsoft.com)
- [x] Linked to an issue
- [ ] Updated [Release Notes](../doc/ReleaseNotes.md) (if applicable)
- [x] Updated documentation (if applicable)
- [x] Added or updated tests (or noted why not applicable —
documentation-only change)
- [x] Updated [Copilot instructions](.github/copilot-instructions.md)
(if build, architecture, or conventions changed)

## 🤖 AI Assistance

- [x] AI assistance was used and has been disclosed in this PR

GitHub Copilot assisted in authoring all documentation additions in this
PR: the new `doc/Standards.md` file, the AI-assisted contributions
policy, the expanded testing guidance in `CONTRIBUTING.md`, the "Running
End-to-End Tests" section in `doc/Developing.md`, and the PR template
updates. I have reviewed and revised the submitted content.

## 📋 Issue Type

- [ ] Bug fix
- [ ] Feature
- [x] Task

###### Microsoft Reviewers: [Open in
CodeFlow](https://microsoft.github.io/open-pr/?codeflow=https://github.com/microsoft/winget-cli/pull/6402)

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

## 📖 Description
Excludes generated `*.lock.yml` workflow files under
`.github/workflows/` from the Check Spelling action. These files are
compiled artifacts (e.g. from GitHub Agentic Workflows) rather than
authored source content, and they introduce dozens of unrelated
third-party/tooling terms (`openai`, `claude`, `gpt`, `zizmor`,
certificate-authority names, etc.) into spell-check results for
unrelated pull requests.

Adds a new pattern `^\.github/workflows/.*\.lock\.yml$` to
`.github/actions/spelling/excludes.txt`, alongside the existing
`spelling*.yml` exclusion.

## 🔗 References
Resolves #6547

## 🔍 Validation
Manually reviewed `.github/actions/spelling/excludes.txt` for correct
regex syntax and placement consistent with existing patterns. The
pattern matches `issue-closure-recommendation.lock.yml` and
`duplicate-surfacing.lock.yml`, the two `*.lock.yml` files currently
present under `.github/workflows/`. No automated spelling-check run was
performed locally since the Check Spelling action only runs in CI; the
change will be validated by the workflow on this PR.

## ✅ Checklist
- [x] Signed the [Contributor License
Agreement](https://cla.opensource.microsoft.com)
- [x] Linked to an issue
- [ ] Updated [Release Notes](../doc/ReleaseNotes.md) (if applicable) —
not applicable; this is a repository CI/tooling change with no
product-facing behavior
- [ ] Updated documentation (if applicable)
- [ ] Updated [Copilot instructions](.github/copilot-instructions.md)
(if build, architecture, or conventions changed)

## 📋 Issue Type
- [x] Task

---
This PR was drafted with assistance from GitHub Copilot.

###### Microsoft Reviewers: [Open in
CodeFlow](https://microsoft.github.io/open-pr/?codeflow=https://github.com/microsoft/winget-cli/pull/6548)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

## 📖 Description
Adds a new schema version with support for generating and consuming
delta databases. When using the new schema, the general flow is:

1. Update the index as normal; when appropriate, mark a baseline.
2. When making future updates, provide the baseline and delta output
locations before packaging prep.
3. This will produce the normal package ready index and a delta from the
baseline.

This allows the existing flow to be maintained while also producing
deltas. A future change will introduce the public surface to do those
interactions.

The spec (#6500) has more details, but the basic concept is that we
record the difference between the baseline and the new index, keeping
package rows fixed so that we can merge them easily at runtime. The
delta uses new table names and creates views that merge the tables from
the delta and baseline. This means that the code to read the index
doesn't need to change.

## 📖 Description
Move the pipeline jobs for building, testing and PowerShell to templates
so that they can be more flexible.