[alerickson]

PR Summary

Update dependencies to the latest stable releases:

• Upgrade NuGet packages from 6.14.3 to 7.9.0.
• Upgrade System.Text.Json from 8.0.6 to 10.0.13.
• Upgrade System.Security.Cryptography.Pkcs from 6.0.5 to 10.0.13.
• Upgrade Azure.Identity from 1.17.2 to 1.21.0.

Allow newer bundled dependencies to satisfy older version requests. After the package update, Publish-PSResource to a container registry failed with:

FileNotFoundException: Could not load file or assembly 'System.Text.Json, Version=10.0.0.3, ...'

Azure.Core and System.Memory.Data are built against System.Text.Json 10.0.0.3, but the module now ships 10.0.0.13. The module's assembly resolver only accepted an exact match on the full assembly name, including the version, so it rejected the newer bundled DLL. PowerShell has no binding redirects for module dependencies, so the load failed. The same mismatch affected other upgraded dependencies, such as Microsoft.Bcl.AsyncInterfaces and Microsoft.Extensions.*.

With the changes in ModuleInitAndCleanup.cs, bundled dependencies are now indexed by simple name instead of full name. A requested assembly is resolved from the bundle when the bundled copy has the same name, the same or a higher version, the same culture, the same public key token. Requests for versions newer than the bundled copy, or with a different public key token, are still rejected. The requesting assembly must still be this module or one of its bundled dependencies, matched exactly as before.

Adapt publishing to NuGet 7’s required allowInsecureConnections parameter, preserving existing support for registered HTTP repositories and add the Boolean -AllowInsecureConnection parameter to Publish-PSResource, allowing users to control whether publishing to HTTP NuGet repositories is permitted while preserving the default value of false. This parameter was added due to a new parameter, allowInsecureConnections being added to PushRunner.Run(), which comes the NuGet.Commands package. Documentation on this can be found here: https://learn.microsoft.com/en-us/nuget/consume-packages/nuget-https-everywhere#allowing-insecure-http-feeds-opt-out

PR Context

PR Checklist

• PR has a meaningful title
  • Use the present tense and imperative mood when describing your changes
• Summarized changes
• Make sure all .h, .cpp, .cs, .ps1 and .psm1 files have the correct copyright header
• This PR is ready to merge and is not Work in Progress.
  • If the PR is work in progress, please add the prefix WIP: or [ WIP ] to the beginning of the title (the WIP bot will keep its status check at Pending while the prefix is present) and remove the prefix when the PR is ready.
• Breaking changes
  • None
  • OR
  • Documentation needed
    • Issue filed:
• User-facing changes
  • Not Applicable
  • OR
  • Documentation needed
    • Issue filed:
• Testing - New and feature
  • N/A or can only be tested interactively
  • OR
  • Make sure you've added a new test if existing tests do not effectively test the code changed
• Tooling
  • I have considered the user experience from a tooling perspective and don't believe tooling will be impacted.
  • OR
  • I have considered the user experience from a tooling perspective and enumerated concerns in the summary.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[alerickson]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[Copilot]

🔵 Needs a closer look

Major dependency upgrades and assembly packaging changes need build and packaged-module validation across supported PowerShell runtimes.

No open issues 🎉

What changed in this PR

Updates PSResourceGet’s dependencies and packaged assemblies, while preserving publishing support for registered HTTP repositories.

Changes:

• Upgrades NuGet libraries, Azure.Identity, System.Text.Json, and cryptography dependencies.
• Updates the assemblies included in the module package.
• Explicitly allows HTTP connections in the NuGet publish call.

File	Description
src/​code/​PublishHelper.cs	Preserves HTTP publishing support with the updated NuGet API.
src/​code/​Microsoft.PowerShell.PSResourceGet.csproj	Updates dependency versions.
doBuild.ps1	Adds required dependency assemblies and removes System.ValueTuple from packaging.

_{Review effort: Balanced}

[alerickson]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[alerickson]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[alerickson]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[alerickson]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).