What Happened in PowerShell Up Till July

Time for the next sweep. The spring roundup stopped at the April patch wave, so this one picks up from there and runs to the end of July. The biggest single release in this window was Pester 6.0, so that goes first.

Pester 6.0

Pester 6.0.0 was released on July 7, about two years after the first 6.0 alpha. It’s the biggest change to PowerShell’s testing framework since v5, and the full walkthrough with examples is in its own post. The short version:

• New Should-* assertions (Should-Be, Should-BeString, Should-HaveType, …) with much better failure messages. The classic Should -Be keeps working, so existing tests don’t need rewriting
• Should-BeEquivalent, a deep comparison of whole objects that reports every differing property with its full path. Honestly, this one alone is a great reason to switch
• Soft assertions, so a test can report every failed assertion instead of stopping at the first one
• Discovery and run per file, which enables experimental parallel runs
• Breaking changes worth checking before you update a pipeline: Assert-MockCalled and the legacy v4 Invoke-Pester parameters are gone, an empty -ForEach now fails, and mocks no longer fall through to the real command
• Supported versions: Windows PowerShell 5.1 and PowerShell 7.4+

The same day, Pester 5.9.0 moved v5 into maintenance mode: critical bug fixes and security updates only. So if you’re learning Pester or moving anyway, go for 6. The move from 4.x to 5.x was the big syntax change; from 5.x to 6.x is a lot easier.

Update (October 2026): two feature releases followed: Pester 6.1 on August 11 (write your own Should-* assertions, experimental global mocks) and Pester 6.2 on September 9 (setup files that cascade down your test folders, and multiple BeforeAll blocks allowed again). The next roundup has the summary.

PowerShell 7 is heading inbox on Windows Server

On the May 21 community call, Artem Pronichkin from the Windows Server team announced that, in the words of the call notes, “PowerShell 7 will be installed by default in the next version of Windows Server.” An Insider preview is meant to follow, and feedback goes through the Windows Server Insiders forum.

A small but important caveat: as far as I can find, the community call notes are the only source for this. There’s no Windows Server blog post or Learn page announcing it yet. The June call mentioned an “inboxing working group” with internal and external participants, and by the July call the status was “We have nothing to announce right now”. So treat it as a stated direction, not a shipped feature.

For me personally it’s not that big of a deal anymore — I don’t do much work on Windows Server these days. But if you do infrastructure management, I can imagine this being a big one: no more installing PowerShell 7 first, or checking whether it’s there before your scripts can use it.

A PSResourceGet roadmap with supply-chain advice

Sydney Smith published PowerShell PSResource Roadmap and Best Practices on May 20, and the best-practices half deserves more attention than it got. The headline advice: “it is not recommended to use the PowerShell Gallery directly from production systems.” Instead:

• Treat the PowerShell Gallery as an intake source, not a runtime dependency
• Promote the modules you actually use into a private feed (Azure Artifacts or a private container registry)
• Use the Microsoft Artifact Registry (MAR) as the trusted source for Microsoft-owned modules

If you’ve ever had a pipeline fail because the Gallery was having a bad day, or quietly picked up a new module version mid-sprint, none of this will be news — but it’s good to see it written down by the team itself.

On the roadmap side: MAR as a default repository, concurrent installs, a native DSC v3 resource, support for any OCI registry (GitHub Container Registry is named as a goal), and cross-repository dependencies in module manifests (RFC 412, still in design).

The same day, PSResourceGet 1.3.0-preview1 was published with the first pieces: MAR registered as a default repository, concurrent Install-PSResource, and the DSC v3 resource.

One thing to plan for: PSResourceGet drops Windows PowerShell 5.1 support starting with 1.3. The 1.2.x line keeps working there, but if you still run module installs from 5.1 (and plenty of build agents do), that’s something to keep in mind. For the background on PSResourceGet itself, see the 1.2.0 post.

7.7 previews 2 and 3

Two more 7.7 previews were published in this window, both built on .NET 11 previews.

7.7.0-preview.2 (May 27) is mostly plumbing: PowerShell can now run inside Windows AppContainers, telemetry now respects the Windows “diagnostics and feedback” setting, argument completers handle empty and $null results better, and there’s an ARM Debian package. It also bundles the PSResourceGet 1.3 preview mentioned above.

7.7.0-preview.3 (July 20) has the one change you might actually trip over. New-Guid now generates version 7 UUIDs by default instead of version 4. From the What’s New in PowerShell 7.7 page:

"New-Guid now generates Version 7 (time-sortable) UUIDs by default instead of Version 4 (random). The output format is unchanged. Scripts that depend on fully random GUIDs should use [guid]::NewGuid() directly."

A version 7 UUID starts with a timestamp, so GUIDs generated one after the other sort in creation order — nice for database keys and log correlation. The flip side is that part of the value is now predictable, so if you were (ab)using New-Guid as a source of randomness for tokens or temporary passwords, switch to [guid]::NewGuid() or, better, a proper random generator.

You can see the difference in the version digit — the first character of the third group:

$PSVersionTable.PSVersion
(New-Guid).ToString()[14]
([guid]::NewGuid()).ToString()[14]

Major  Minor  Patch  PreReleaseLabel BuildLabel
-----  -----  -----  --------------- ----------
7      7      0      preview.3
7
4

Also in preview.3: the progress bar now renders double-width Unicode characters correctly, and install-powershell.ps1 lost its -Daily switch.

macOS packages are now notarized

Small one, but if you’ve ever helped a Mac user through the “cannot be opened because the developer cannot be verified” dialog: as of May 21 the PowerShell .pkg and tarball are notarized by Apple and use the hardened runtime. No more xattr workarounds. It covers 7.4 and later, and shipped in practice with 7.6.2. Per the post, it closes “more than 14 long-standing GitHub issues.”

SecretManagement is feature complete

This one happened without a blog post, so it’s easy to miss. The SecretManagement and SecretStore repositories were archived on June 22. The README now says the team “has decided that Microsoft.PowerShell.SecretManagement is feature complete”, with 1.1.2 as the last feature release (SecretStore: 1.0.6). The reasoning is that the future is passwordless — passkeys, federated credentials like Entra ID workload identities, hardware keys — and that’s not something the module can meaningfully support in its current form. Security fixes will still be made.

Nothing breaks today; the modules keep working. But if you’re designing something new, it’s a good nudge to ask whether you need a stored secret at all, or whether a managed identity or federated credential can do the job.

I used SecretManagement myself to store personal access tokens (PATs), back when those were still required to reach some services. I’ve recently switched to accessing those through Entra instead, so I don’t rely on it much anymore.

VS Code extension previews

No new stable release of the PowerShell extension for VS Code (the latest stable is still 2025.4.0), but two previews:

• 2026.1.1-preview (May 16) — rename for variables and functions, finally. The rename provider in PowerShell Editor Services 4.6 is by @Razmo99, with the extension-side settings by Justin Grote.
• 2026.1.2-preview (June 25) — PowerShell language model tools for Copilot, a redesigned Command Explorer, and Show Help now opens in an editor pane. Also: the Pester 5 CodeLens is now the default instead of the legacy one, just in time for Pester 6.

Az 16.0.0

Az 16.0.0 is the yearly breaking-change release (on the Gallery since June 2). Read the release notes before you update a pipeline. The changes I’d check first:

• Az.KeyVault — Get-AzKeyVaultKey and Get-AzKeyVaultSecret no longer return certificate-backed items; use Get-AzKeyVaultCertificate
• Az.Resources — role definition cmdlets now use a Permissions array with per-permission conditions
• Az.PolicyInsights — output types were renamed, and Start-AzPolicyRemediation/Stop-AzPolicyRemediation changed their default behavior (there’s a new -NoWait)
• Az.Sql — EnableSoftDelete was removed from New-AzSqlServer and Set-AzSqlServer

Az 16.1.0 followed on July 7. On the Graph side, the Microsoft Graph PowerShell SDK moved from 2.36.1 to 2.38.1 in this window.

The patch waves (and an end-of-support date)

Three servicing rounds, each covering all supported branches, mostly .NET SDK and packaging updates:

7.6.2 is the interesting one: it backports AppContainer support, the telemetry setting, and the macOS notarization.

While you’re looking at those versions, put this in your calendar: according to the support lifecycle page, both PowerShell 7.4 (LTS) and 7.5 reach end of support on November 10, 2026. 7.6 LTS is supported until November 2028. If you’re still on 7.4, now is a good time to start testing 7.6.

Smaller notes

• Plaster is back — the module scaffolding tool has been revived under PowerShell.org. 2.1.x was published in May and June, supporting the original XML templates plus a new JSON format. Relevant if you liked my Sampler and module template posts, since Sampler builds on Plaster.
• Intelligent Terminal 0.1 — announced on June 2: an experimental fork of Windows Terminal with built-in agent integration (GitHub Copilot CLI by default). When a command fails, it can pull the error into an agent pane. It installs side by side with your regular Windows Terminal.
• platyPS 1.0.2 and 1.0.3 — help-authoring fixes, including -ExcludeDontShow on New-MarkdownCommandHelp.
• DSC — v3.2.1 to v3.2.3 patched the v3.2 release from my DSC v3.2 post, and the v3.3 previews renamed “MCP mode” to “Server mode” (the old dsc mcp keeps working as an alias).
• RFCs — two worth following: Linux *-Service cmdlets via D-Bus and the cross-feed dependencies one mentioned above.

Wrap

The release of this stretch is Pester 6.0: new assertions, Should-BeEquivalent, soft assertions and parallel runs, and an upgrade from v5 that’s a lot friendlier than the last one. If you write tests for your PowerShell code — or have been meaning to — start there.

Around it, a busy stretch for direction: PowerShell 7 heading inbox, a supply-chain stance on the Gallery, and SecretManagement being retired in favor of passwordless. And with 7.4 and 7.5 both retiring in November, the rest of the year is a good moment to get onto 7.6.

Happy scripting 😊