PowerShell 7.7 Has Been Released

I'm Shibata.

PowerShell 7.7 was released together with the recent .NET 11 release.
The announcement from the PowerShell Team Blog is here.

https://devblogs.microsoft.com/powershell/announcing-powershell-7-7/

In this article, I'd like to cover the new features and other changes based on publicly available information.

Release Type and Support Lifecycle

PowerShell 7.7 is built on .NET 11, and its support lifecycle follows that of .NET 11.
As of today, the support schedule is as follows.

Since .NET 11 is a non-LTS version, PowerShell 7.7 is a Stable release.
The documentation had not been updated at the time this article was published, but support is expected to last until around November 14, 2028, when .NET 11 support ends.

Also, please note that support for PowerShell 7.4, the previous LTS, ended just recently.

How to Get and Update PowerShell 7.7

Regarding how to get PowerShell 7.7, the MSI installer that was traditionally the main distribution on Windows has been discontinued, and using the MSIX package (.msixbundle) is now recommended.

https://devblogs.microsoft.com/powershell/powershell-msi-deprecation/

This change was first announced on the PowerShell Team Blog at the release of PowerShell 7.7-preview.1. Naturally, the community strongly opposed it (and it is still somewhat of a flame war), but Microsoft has given no particularly clear response and the situation remains as is.
I personally feel it is no exaggeration to call this a forced release.

The official rationale is to "abolish the legacy MSI installer and switch to the more secure, newer MSIX package," but the MSIX package version of PowerShell has several functional limitations, and these limitations have not been resolved even as of the PowerShell 7.7 release.

Limitations of MSIX PowerShell

The limitations of MSIX PowerShell are summarized on the following page.

• Limitations of a MSIX-based installation

Put simply, MSIX PowerShell is the same as a Microsoft Store application, so there are restrictions on changing settings at the system level.
The main ones are:

• Only per-user installation is basically supported
• PowerShell Remoting cannot be used
• AllUsers profiles that require writing to $PSHOME ($PROFILE.AllUsersAllHosts, $PROFILE.AllUsersCurrentHost) are not supported
• The following commands that require writing to $PSHOME are not supported
  • Register-PSSessionConfiguration
  • Update-Help -Scope AllUsers
  • Enable-ExperimentalFeature -Scope AllUsers
  • Set-ExecutionPolicy -Scope LocalMachine

In addition, there is also the following limitation:

• Cannot be installed on Server Core, which does not support MSIX

Besides Microsoft's documentation, there are also several issues and discussions on GitHub, so I'll introduce them here.

• Deprecation of MSI and EXE based installers in lieu of MSIX #27292
• Tracking: MSIX packaging gaps for PowerShell 7 #27565

Installing MSIX PowerShell

The quickest way to install MSIX PowerShell is to install it from the Microsoft Store or use WinGet.

• PowerShell on Microsoft Store

Especially when using WinGet, the MSI version was provided up to PowerShell 7.6 and it changed to the MSIX version from PowerShell 7.7, so you need to uninstall the MSI version first.

# Winget cannot perform updates that change the installation method, so first uninstall the existing MSI version
winget uninstall --id Microsoft.PowerShell
# Install the MSIX version after uninstalling the MSI version
winget install --id Microsoft.PowerShell

Also, although unofficial, Devolutions, which sells Remote Desktop Manager and other products, has forked PowerShell and provides its own MSI installer.

• Unofficial distribution: Devolutions/pwsh-distro

Other Platforms

The installation methods on macOS and Linux are almost the same as before.

• Install PowerShell on Windows, Linux, and macOS

The updates are probably that an RPM package for Azure Linux 4 and a DEB package for Arm64 Debian have been newly added.

PowerShell 7.7 New Features and Breaking Changes

According to the PowerShell Team blog, PowerShell 7.7 focuses mainly on security hardening and feature improvements.
Looking at What's new as well, my impression is that there are many improvements to validation in the cmdlets and the script engine.

https://learn.microsoft.com/en-us/powershell/scripting/whats-new/what-s-new-in-powershell-77?view=powershell-7.7

In this article, I'll mainly explain the content announced on the PowerShell Team blog.

Updates to Bundled Modules

In PowerShell 7.7, the bundled modules have been updated to the following versions.

• Microsoft.PowerShell.PSResourceGet v1.3.1
• PSReadLine v2.4.5

New Cmdlets and Cmdlet Improvements

PowerShell 7.7 newly adds New-TemporaryDirectory.
Until now there was New-TemporaryFile, which creates a temporary file; this is a command that creates a temporary directory.

# Creates a temporary directory and returns a DirectoryInfo object. An arbitrary prefix can be added with the -Prefix parameter
PS C:\> $tempDir = New-TemporaryDirectory -Prefix build
PS C:\> $tempDir.FullName
C:\Users\xxxxxxxx\AppData\Local\Temp\buildujfgi5jm.nda

# Delete it when no longer needed
PS C:\> Remove-Item -LiteralPath $tempDir.FullName -Recurse

In addition, the PowerShell Team Blog announces the following improvements.

• Added the -Extension parameter to Join-Path
• Added -ExcludeProperty to Format-Table, Format-List, and Format-Custom
• Added the SubjectAlternativeName property to the return value of the Get-AuthenticodeSignature command
  • However, using -ExcludeProperty disables the format definitions specified in ps1xml, and in some cases it actually resulted in more properties being displayed...
• Added the ToRegex() method to the System.Management.Automation.WildcardPattern class

Simple examples of each are as follows.

# Add the extension exe with Join-Path
PS C:\> Join-Path $env:TEMP 'pwsh' -Extension exe
C:\Users\xxxxxxxx\AppData\Local\Temp\pwsh.exe

# -ExcludeProperty has been added to the Format-* commands
PS C:\> [PSCustomobject]@{Key="key";Value="Value"} | Format-List -ExcludeProperty key

Value : Value

# SubjectAlternativeName has been added to the Signature object returned by Get-AuthenticodeSignature
# I didn't have a suitable certificate, so I used an MSI file instead
PS C:\> Get-AuthenticodeSignature C:\temp\AWSCLIV2.msi | Get-Member

   TypeName:System.Management.Automation.Signature

Name                   MemberType Definition
----                   ---------- ----------
Equals                 Method     bool Equals(System.Object obj)
GetHashCode            Method     int GetHashCode()
GetType                Method     type GetType()
ToString               Method     string ToString()
IsOSBinary             Property   bool IsOSBinary {get;}
Path                   Property   string Path {get;}
SignatureType          Property   System.Management.Automation.SignatureType SignatureType {get;}
SignerCertificate      Property   System.Security.Cryptography.X509Certificates.X509Certificate2 SignerCertificate {ge…
Status                 Property   System.Management.Automation.SignatureStatus Status {get;}
StatusMessage          Property   string StatusMessage {get;}
SubjectAlternativeName Property   string[] SubjectAlternativeName {get;}
TimeStamperCertificate Property   System.Security.Cryptography.X509Certificates.X509Certificate2 TimeStamperCertificat…

# Convert a wildcard pattern to a regular expression
PS C:\> $pattern = [System.Management.Automation.WildcardPattern]::new("*.txt")
PS C:\> $regex = $pattern.ToRegex()
PS C:\> $regex.IsMatch("file.txt")
True

Security Hardening

PowerShell 7.7 reportedly made the following security-related changes.
However, the release notes do not directly describe the changes, and it was difficult to find the details.

• Strengthened restrictions in Constrained language mode
  • Reportedly so... but I could not find the specific changes.
• Strengthened validation of runtime arguments in PowerShell Remoting
• Strengthened validation of communication frames in PowerShell Remoting
  • It seems that validation of the frame header length was added
• Strengthened CDXML schema (XSD) validation in CIM cmdlets
• Strengthened validation of commands implicitly executed in PowerShell Remoting
• Strengthened validation of updatable help files (CAB files)
• Strengthened permission checks on the temporary HOME directory used as a fallback when the HOME environment variable cannot be found on UNIX platforms
• Added the -FetchExternalReference parameter to the Test-Json command, so explicit permission is now required to reference external URLs within a JSON schema
  • It seems this was also backported to PowerShell 7.6.10, tucked into another pull request

Other Changes

Here are some of the other changes that caught my attention.

• Fixed incorrect results of Resolve-Path -Relative for names starting with a dot (#28087)
• Fixed a bug where Get-Command -UseFuzzyMatching returned duplicate results (#26593)
• Fixed Clear-Host failing when remotely connecting from a non-Windows environment to Windows (#28115)
• Fixed broken display of progress that includes full-width characters (#26185)

Breaking Changes

According to the PowerShell Team Blog and What's new, there are only the following four breaking changes.

1. The IDs generated by the New-Guid command have been updated from the traditional UUID v4 to UUID v7

   • If you want to generate a UUID v4, use [Guid]::NewGuid()

2. The -Property parameter of the Format-Table, Format-List, and Format-Custom commands no longer allows null or empty strings

3. The exception thrown when parameters are specified incorrectly while creating a [System.Management.Automation.CompletionResult] object was changed from System.Management.Automation.PSArgumentNullException to System.ArgumentException

   • It was pointed out that a "null exception" is inappropriate for the exception raised when an empty string is specified for a String-type parameter, so it was changed to an "empty string exception"

4. Changed the evaluation when specifying conditions in the form -[operator]:$false in Where-Object

   • For the detailed behavior, please see the GitHub issue, but frankly, I honestly don't think anyone would write such a specification.

These are mostly very minor behavioral changes, but New-Guid alone seems likely to have a fairly large impact.

# New-Guid now returns a UUID v7 ID
PS C:\> (New-Guid).Version
7

PS C:\> New-Guid

Guid
----
01a1d31d-c0c7-7282-af4b-5b238c9fd708

# Use [Guid]::NewGuid() if you want a UUID v4
PS C:\> [Guid]::NewGuid().Version
4

PS C:\> [Guid]::NewGuid()

Guid
----
be4868be-2f85-4a42-8778-1a470fa3dd1c

Experimental Features

No features were promoted in PowerShell 7.7, and the following three features continue to be provided as experimental features.

• PSLoadAssemblyFromNativeCode
• PSSerializeJSONLongEnumAsNumber
• PSProfileDSCResource

Final Thoughts

That's all.

I think the discontinuation of the MSI installer is by far the biggest change.
Personally, I feel it was "premature," and unfortunately I can't evaluate it positively...

That said, the situation won't change immediately, so it will come down to either switching to the MSIX version or waiting and seeing until PowerShell 7.8, the next LTS.
Please decide as appropriate.