9.0 - πr²

Before upgrading: SPE 9.0 requires Sitecore 10.0 or later and .NET Framework 4.8. Sitecore 8.x and 9.x are no longer supported. This release was tested on Sitecore 10.4 and 10.5.

Breaking Changes

• #1499 : Peek at a script's output from the Runner while it runs - @AdamNaj
• #1497 : Respect Sitecore.Packages.Disabled: hide packaging scripts and refuse Install-Package - @AdamNaj
• #1454 : Add setting to reject query-string credentials - @michaellwest
• #1414 : Remove Invoke-RemoteScriptAsync (dead code) - @michaellwest
• #1410 : Upgrade .NET Framework target to 4.8 and drop Sitecore 8 support - @michaellwest

Release Highlights

• #1508 : Edit image field values in Read-Variable - @AdamNaj
• #1503 : Let Show-ListView set the export file name - @AdamNaj
• #1501 : Redesign the ISE progress indicator so it no longer covers the script output - @AdamNaj
• #1500 : Resize SPE windows from a grip in the bottom-right corner - @AdamNaj
• #1499 : Peek at a script's output from the Runner while it runs - @AdamNaj
• #1498 : Long-running scripts should not lose their window when the browser puts the tab to sleep - @AdamNaj
• #1497 : Respect Sitecore.Packages.Disabled: hide packaging scripts and refuse Install-Package - @AdamNaj
• #1486 : Stream Verbose / Information / Progress / Warning records from -AsJob scripts via Wait-RemoteScriptSession - @michaellwest
• #1478 : ISE: Ctrl+Click / Ctrl+F12 to open the script referenced by Import-Function and Invoke-Script - @AdamNaj
• #1476 : Re-implement OAuth bearer support from PR #1475 on feature/remoting - @iamandycohen @michaellwest
• #1474 : Remoting: long-poll wait endpoint (with session ownership enforcement) - @michaellwest
• #1472 : ISE reload should rehydrate terminal output from the surviving session - @AdamNaj
• #1468 : Ribbon restructure: dedicated Context tab for context-related controls - @AdamNaj
• #1464 : Terminal UX: error colors, background legibility, output spacing (inspired by Windows ISE) - @AdamNaj
• #1462 : ISE and Console: unify ISE terminal with editor, inline busy spinner, streaming Write-Host -NoNewline - @AdamNaj
• #1461 : ISE: Persist and restore open tabs across sessions - @AdamNaj
• #1460 : Variable Preview Sidebar to show variable values in a prominent way. (requested in #1361) - @AdamNaj @peplau
• #1459 : Clear-Host support in ISE and Console terminals - @AdamNaj
• #1458 : ISE: Replace output rendering with jQuery Terminal for virtualized display and interactive command line - @AdamNaj @michaellwest
• #1435 : Add setting to toggle key=value vs JSON log output format - @michaellwest
• #1427 : Add SearchBuilder extension library for idiomatic Find-Item queries - @michaellwest
• #1426 : Remoting Policies - item-based CLM, command allowlists, and approved scripts for SPE remoting - @AdamNaj @michaellwest
• #1419 : Add Constrained Language Mode and token scoping for MCP remoting sessions - @michaellwest
• #1416 : Add Dialog Builder fluent API as opt-in extension module - @michaellwest
• #1415 : Add JSON output format for remoting - @michaellwest

Security

• #1507 : OAuth remoting: rate-limit JWKS refetches and make client matching case-exact - @AdamNaj @michaellwest
• #1485 : OAuth bearer hardening: replay cache, strict at+jwt, azp enforcement, JWKS hardening - @michaellwest
• #1483 : OAuth remoting: route by issuer to support multiple IdPs - @michaellwest
• #1480 : Extend Elevated Session ItemSave gate to Access subtree (Delegated Access, Remoting Clients, Remoting Policies) - @michaellwest
• #1456 : Rollback plan: allowlist restriction profiles and ItemPathRestrictions removal - @michaellwest
• #1455 : Add source tag to Write-Log cmdlet output to prevent log forgery - @AdamNaj @michaellwest
• #1454 : Add setting to reject query-string credentials - @michaellwest
• #1452 : SecureCompare.FixedTimeEquals leaks length via early return - @michaellwest
• #1451 : New-Jwt should include iat claim by default; enforce when MaxTokenLifetimeSeconds is set - @michaellwest
• #1450 : Reorder JWT validation: verify signature before claims - @michaellwest
• #1449 : Command help dialog renders unsanitized HTML from server - @michaellwest
• #1448 : Path traversal in Export-User and Export-Role cmdlets - @AdamNaj @michaellwest
• #1447 : Gate X-Forwarded-Proto and X-Forwarded-For behind a TrustForwardedHeaders setting - @michaellwest
• #1446 : DelegatedAccessManager cache has no TTL - stale elevation in multi-server environments - @michaellwest
• #1445 : Add explicit algorithm allowlist to JWT validation - @michaellwest
• #1444 : Log injection via attacker-controlled JWT claims and unsanitized URL logging - @michaellwest
• #1443 : Absolute path bypass in file upload/download API - @michaellwest
• #1442 : Non-thread-safe Dictionary in ScriptTrustRegistry under concurrent invalidation - @michaellwest
• #1441 : Token tooltip innerHTML XSS via unencoded PSCustomObject property names - @michaellwest
• #1440 : Add RemoteErrorVerbosity setting to gate detailed error info in responses - @michaellwest
• #1439 : Race condition in TryApiKeyAuthentication mutates singleton SharedSecret - @michaellwest
• #1434 : Delegated Access: thread-safety, null-guard, and audit improvements - @michaellwest
• #1422 : Add configurable CORS support for web API services - @michaellwest
• #1420 : Enhance JWT authentication for MCP server compatibility - @michaellwest
• #1413 : PR #1412 breaks Emmet: underscore update accidentally deletes entire Emmet core library - @michaellwest
• #1409 : Fix bugs in RemoteAutomation.asmx.cs: empty Aggregate, O(n^2) concat, path traversal, style - @michaellwest
• #1401 : [SAST][Medium] Permissive Cross-domain Policy - @alan-null @michaellwest
• #1400 : [SAST] DOM-based Cross-site Scripting (XSS) - @alan-null @michaellwest
• #1399 : [SAST][Medium] Outdated JavaScript Library - @alan-null @michaellwest

Improvements

• #1512 : Show a completion dropdown in the Console and ISE terminal - @AdamNaj
• #1511 : Show where an item is stored with an ItemSource property - @AdamNaj
• #1510 : Open PowerShell Toolbox in the start menu like the other submenus - @AdamNaj
• #1509 : Edit General Link field values in Read-Variable - @AdamNaj
• #1502 : Combine the report export formats into one split button that remembers the last format - @AdamNaj
• #1487 : Jittered backoff and safe-transport retry for remoting client - @michaellwest
• #1482 : Scripted source for single-item pickers (droplink/droplist/groupeddroplink/groupeddroplist) - @michaellwest
• #1479 : ISE autocomplete: curated completion sources and path replacement that respects token boundaries - @AdamNaj
• #1477 : ISE: autocomplete Invoke-Script -Path with Script Library paths - @AdamNaj
• #1473 : ISE: Clear Output button in status bar - @michaellwest
• #1471 : Show-Result -Text and HTML output use the #1464 terminal colors - @AdamNaj
• #1470 : ISE: Session dropdown styling and per-session kill button - @AdamNaj
• #1469 : ISE: Remoting Policy picker in the Context ribbon - @AdamNaj
• #1467 : Open Script dropdown overhaul - @AdamNaj
• #1466 : Reorganize module item tree under Settings - @michaellwest
• #1465 : Show-Result -Text: support -Title, -Icon, and -Description parameters - @AdamNaj
• #1463 : Local development tooling: build tasks, deploy junctions, Playwright UI tests - @AdamNaj
• #1438 : Add missing tooltip descriptions to custom SPE template fields - @michaellwest
• #1436 : Standardize PowerShellLog messages to Splunk-parseable format - @michaellwest
• #1432 : Add ISE split orientation toggle (horizontal/vertical) - @michaellwest
• #1429 : Reconcile DialogBuilder API with SearchBuilder conventions - @michaellwest
• #1425 : Add structured error format for JSON remoting responses - @michaellwest
• #1403 : Messages logged to SPE file should be more descriptive - @michaellwest
• #1396 : [Wish] Middle mouse click on a tab should close it. - @AdamNaj
• #1393 : Extend Find-Item with most frequent criteria being accessible through accelerator parameters - @AdamNaj
• #1374 : Question: Remoting, serialization optimization? - @Antonytm @michaellwest

Bugs Fixed

• #1506 : SPE 9.0: SPE Remoting can break SPE for all users until Sitecore restarts - @AdamNaj @coreyasmith
• #1504 : Show the full -Title in a modal Show-ListView - @AdamNaj
• #1496 : Show-ListView: pressing Enter in the Filter box reloads the view after a row was selected - @AdamNaj
• #1495 : SPE 8.0: Script rule execution result class is missing - @AdamNaj @coreyasmith
• #1494 : SPE 8.0: Script Runner throws FileLoadException for Newtonsoft.Json 13.0.0.0 on Sitecore 9.0 - 10.1.3 - @AdamNaj @coreyasmith
• #1492 : Remoting: handled errors return 424 (Failed Dependency) - @michaellwest
• #1489 : Item not refreshed automatically after elevated unlock - @alan-null @michaellwest
• #1481 : Read-Variable: droplink/droplist/grouped variants not pre-selected - @michaellwest
• #1457 : ISE keyboard shortcuts blocked by Ace editor built-in bindings - @michaellwest
• #1437 : ISE splitter panes can be dragged to extreme positions - @michaellwest
• #1430 : Fix Ace autocomplete tooltip positioning in ISE - @michaellwest
• #1423 : Fix bugs in serialized PowerShell scripts - @michaellwest
• #1421 : SharedSecretAuthenticationProvider returns 500 instead of 401 for auth failures - @michaellwest
• #1406 : Broken links SPE report return no results - @AkahnDEG @michaellwest
• #1405 : Cannot use PowerShell remoting in Sitecore XM Cloud - @michaellwest @yuanweilei
• #1404 : EditConditionClick blocked for Read-Variable - @michaellwest
• #1398 : Incorrect Sitecore version in $PSVersionTable - @AdamNaj @alan-null @michaellwest
• #1397 : [ISE] Autocomplete in XMC - @AdamNaj @alan-null
• #1379 : Reports queried with SQL ignore IAR content - @AdamNaj @coreyasmith @michaellwest

Maintenance

• #1491 : Refactor RemoteScriptCall.ashx.cs into per-route processor classes - @michaellwest
• #1433 : Move deprecated Sitecore serialization APIs behind VersionSpecific abstraction layer - @michaellwest
• #1431 : Upgrade Ace editor from v1.4.7 to v1.43.6 - @michaellwest
• #1414 : Remove Invoke-RemoteScriptAsync (dead code) - @michaellwest
• #1411 : Migrate from Unicorn to Sitecore Content Serialization (SCS) - @AdamNaj @michaellwest
• #1410 : Upgrade .NET Framework target to 4.8 and drop Sitecore 8 support - @michaellwest
• #1407 : Refactor: SPE module optimizations and code cleanup - @michaellwest
• #1381 : Reports : Review access - @AdamNaj @michaellwest

Pull Requests

• #1505 : Read database from scriptDb parameter in gutters rather than scriptId - @coreyasmith
• #1493 : Update compatibility script to fix Launchpad icons on Sitecore 10.0 - @coreyasmith

New Contributors

• @avwolferen made their first contribution in #1417

Full Changelog: 8.0...9.0

File Hashes

2026-11-06: both .scwdp.zip packages were replaced. The originals didn't deploy with Web Deploy. If you downloaded them before this date, download them again. The hashes below are for the new files.

Sitecore.PowerShell.Extensions-9.0-IAR

SHA256 for Sitecore.PowerShell.Extensions-9.0-IAR.zip
233D5733CFF324490A7A1CF4DDA9D4DEA5C87D1A47FB7C52711BC095F09A9587

SHA256 for Sitecore.PowerShell.Extensions-9.0-IAR.scwdp.zip
20F9B53A2D7B3FC259CA6E751BF1EB55FF74C18612DC78C3383475D72114A435

Sitecore.PowerShell.Extensions-9.0

SHA256 for Sitecore.PowerShell.Extensions-9.0.zip
891F9E7A11A5D2C9227517C2EE3EB097F40F168BDF732187C1A830222722CE8E

SHA256 for Sitecore.PowerShell.Extensions-9.0.scwdp.zip
BC44358A923F82205E43DCBF806DE94A896C16518DD4E71098AAEF9ED343BD48

SHA256 for SPE.Minimal-9.0.zip
22DBCD40C5AF0D77AC189F96485BF99E24C49FF273537D3FDB8AF47F67E0FAB2

.