Reference System.Management.Automation from the oldest supported PowerShell - #3021
Merged
Conversation
…rShell The net8.0 assembly referenced System.Management.Automation 7.4.5.0, because the package reference was bumped to 7.4.6 to avoid a security advisory. .NET resolves an assembly reference forward to a newer version, but never backward to an older one, so on PowerShell 7.4.0 to 7.4.5 that reference cannot be satisfied and the import fails. The error does not say that. Import fails on the first type that inherits from a type in System.Management.Automation, which is PesterConfigurationDeserializer, and Update-TypeData reports 'Cannot convert "PesterConfigurationDeserializer" from String to Type'. PesterConfiguration itself derives from System.Object, so it still resolves and the existing version guard in Pester.psm1 passes. The advisory does not apply to this reference. We ship Pester.dll and nothing else, System.Management.Automation comes from the host PowerShell, so raising the number here patches nothing for anyone, it only drops support for the patch releases below it. Put the reasoning in the csproj next to the reference so it does not get bumped again. Added a test that reads the reference off the loaded assembly. 6.0.0 and 6.1.0 both shipped with 7.4.5.0 and nothing caught it. Fix #3013 🤖
nohwnd
enabled auto-merge (squash)
September 5, 2026 07:55
The 7.4.6 bump was avoiding CVE-2024-38095 in System.Formats.Asn1, which System.Management.Automation 7.4.0 pulls in transitively at 8.0.0. Restoring 7.4.0 brings that package back, so pin System.Formats.Asn1 to 8.0.1, which is the patched version. NuGet audit is clean again, and it does not change what we ship, the built Pester.dll does not reference System.Formats.Asn1 at all. Also fix the wording. Microsoft only supports the latest patch of a line, so 7.4.0 itself is not a supported PowerShell, 7.4.19 is. 7.4.0 is the baseline of the 7.4 line and that is why we reference it, not because it is supported. Referencing it means Pester still loads for people who are behind on their PowerShell updates, which is deliberate, and does not ship them anything vulnerable. 🤖
This was referenced Sep 5, 2026
nohwnd
added a commit
that referenced
this pull request
Sep 5, 2026
* Write the 6.2.0-alpha2 release notes pass Covers the four user visible pull requests merged since alpha1. #3025 and #3021 were already in the file. Should-BeFasterThan and Should-BeSlowerThan rejecting what they cannot measure is a behavior change, not a fix. A test that passed on a string or an int was not asserting anything and it fails now. 🤖 * Bump the manifest to alpha2 The notes heading moved to 6.2.0-alpha2 but src/Pester.psd1 still said alpha1, so the built module would have published as 6.2.0-alpha1 again. Prerelease and the ReleaseNotes link follow the heading. ModuleVersion and RequiredAssemblyVersion stay at 6.2.0, only the prerelease label changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fix #3013
The
net8.0assembly referencedSystem.Management.Automation7.4.5.0. .NET resolves an assembly reference forward to a newer version, but never backward to an older one, so on PowerShell 7.4.0 to 7.4.5 that reference cannot be satisfied and the import fails.The error does not say any of that:
Update-TypeData -TypeConverter 'PesterConfigurationDeserializer'resolves the type from a string, and that is the first type we touch that inherits from something inSystem.Management.Automation(PSTypeConverter).PesterConfigurationderives fromSystem.Object, so it still resolves and the version guard inPester.psm1passes, which is why the import gets that far before it breaks.This affected 6.0.0 as well, both releases shipped with 7.4.5.0.
Why 7.4.0
We ship
Pester.dlland nothing else.System.Management.Automationcomes from the host PowerShell, this is only a compile time reference, so it should sit at the baseline of the oldest PowerShell line we support and let the runtime supply anything newer. That is how it used to be here, before the net8 move this referenced 7.1.7, which was older than 7.2.0.7.4.0 is not itself a supported PowerShell. Microsoft only supports the latest patch of a line, so the 7.4 line is supported until 10-Nov-2026 but the supported patch is 7.4.19. Referencing the baseline anyway means Pester still loads for people who are behind on their updates. That is deliberate. Whether their PowerShell is patched is their decision, a compile time reference is the wrong place to enforce it, and an unreadable load error is a bad way to enforce anything.
The advisory the bump was avoiding
Versions older than 7.4.6 have security vulnerabilities.was the reason given, and it was a real one, just not inSystem.Management.Automationitself. 7.4.0 pulls inSystem.Formats.Asn18.0.0 transitively, which has CVE-2024-38095 (high, DoS parsing X.509). WithNuGetAuditMode=all:We do not ship that assembly either, so it never reaches anyone through Pester, but there is no reason to keep it in the build graph. Pinned to 8.0.1, which is the patched version. Audit is clean and the shipped
Pester.dlldoes not referenceSystem.Formats.Asn1at all.Verification
Builds clean on
net8.0andnet462, 0 warnings, 0 errors. Restore is clean underNuGetAuditMode=all -p:NuGetAuditLevel=low. Emitted reference:Added a test in
tst/Pester.Tests.ps1that reads the reference off the loaded assembly. It fails against 6.0.0 and 6.1.0, which is the point, nothing caught this twice in a row.I could not run a real 7.4.0 to confirm the import, my machine is on 7.5.5. If CI has a 7.4.0 job that would close it properly.
🤖