[Anam Navied (anamnavi)]

PR Summary

Bring in fixes from 1.3.0 and 1.3.1 releases

PR Context

PR Checklist

• PR has a meaningful title
  • Use the present tense and imperative mood when describing your changes
• Summarized changes
• Make sure all .h, .cpp, .cs, .ps1 and .psm1 files have the correct copyright header
• This PR is ready to merge and is not Work in Progress.
  • If the PR is work in progress, please add the prefix WIP: or [ WIP ] to the beginning of the title (the WIP bot will keep its status check at Pending while the prefix is present) and remove the prefix when the PR is ready.
• Breaking changes
  • None
  • OR
  • Documentation needed
    • Issue filed:
• User-facing changes
  • Not Applicable
  • OR
  • Documentation needed
    • Issue filed:
• Testing - New and feature
  • N/A or can only be tested interactively
  • OR
  • Make sure you've added a new test if existing tests do not effectively test the code changed
• Tooling
  • I have considered the user experience from a tooling perspective and don't believe tooling will be impacted.
  • OR
  • I have considered the user experience from a tooling perspective and enumerated concerns in the summary.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Anam Navied (anamnavi)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[Copilot]

🟡 Changes recommended

Unchecked package-version suffixes can allow writes outside the temporary directory, while credential-confirmation gates can bypass consent and incorrectly turn publish dry runs into terminating errors.

4 open issues

• Unchecked prerelease versions enable temporary-path traversal · New
• Medium-impact ShouldProcess skips the required credential confirmation · New
• Single wildcard patterns bypass multi-repository confirmation · New
• WhatIf turns a skipped publish into a terminating error · New

What changed in this PR

Brings the 1.3.0 and 1.3.1 release fixes into PSResourceGet, focusing on credential handling, package-name validation, and XML parsing safeguards.

Changes:

• Updates the module manifest to stable version 1.3.1.
• Separates repository-resolved credentials from explicitly supplied credentials and adds confirmation gates.
• Adds remote package-name checks and restrictive XML reader settings.

File	Description
src/​Microsoft.PowerShell.PSResourceGet.psd1	Sets version 1.3.1 and adds release-note headings.
src/​code/​V2ServerAPICalls.cs	Hardens XML parsing for result counts.
src/​code/​V2ResponseUtil.cs	Hardens V2 response XML parsing.
src/​code/​Utils.cs	Adds remote-name validation and hardens nuspec parsing.
src/​code/​UpdatePSResource.cs	Adds a credential-use confirmation gate.
src/​code/​SavePSResource.cs	Adds a credential-use gate and raises confirmation impact.
src/​code/​PublishPSResource.cs	Adds a gate for credentials with an implicit repository.
src/​code/​NuGetServerResponseUtil.cs	Hardens NuGet.Server response XML parsing.
src/​code/​NuGetServerAPICalls.cs	Hardens XML parsing for result counts.
src/​code/​LocalServerApiCalls.cs	Hardens local nuspec XML parsing.
src/​code/​InstallPSResource.cs	Adds a credential-use confirmation gate.
src/​code/​InstallHelper.cs	Isolates repository credentials and validates package names.
src/​code/​FindPSResource.cs	Enables confirmation support and adds a credential-use gate.
src/​code/​FindHelper.cs	Prevents repository-resolved credentials from carrying between feeds.

_{Review effort: Balanced}