pester · nohwnd · Sep 5, 2026 · Sep 5, 2026 · Sep 5, 2026
diff --git a/docs/NEXT-RELEASE.md b/docs/NEXT-RELEASE.md
@@ -1,4 +1,4 @@
-<!--
+<!--
   Release notes for the version in development.
 
   These are written once, for the first alpha, which is usually already close to feature
@@ -437,6 +437,12 @@ Three of these come with the `Pester.BeforeContainer.ps1` cascade above.
 
 ## <a id="6.2.0-other-improvements-and-fixes"></a>Other improvements and fixes
 
+- Pester imports again on PowerShell 7.4.0 to 7.4.5. The `net8.0` assembly referenced
+  `System.Management.Automation` 7.4.5.0, and .NET resolves such a reference forward to a newer
+  version but never backward to an older one, so on any 7.4.x below 7.4.5 the import failed with
+  `Cannot convert "PesterConfigurationDeserializer" from String to Type`. The reference is on
+  7.4.0 now, the baseline of the 7.4 line, so it loads on every 7.4.x. This affected 6.0.0 and
+  6.1.0.
 - The `Run.Parallel` help no longer claims that enabling `CodeCoverage` falls back to a
   sequential run. It has not since workers started measuring their own file and the parent
   started merging the hits. The fallback that was actually missing from the list is now there,

diff --git a/src/csharp/Pester/Pester.csproj b/src/csharp/Pester/Pester.csproj
@@ -17,10 +17,38 @@
     <InternalsVisibleTo Include="PesterTests" />
   </ItemGroup>
 
-  <!-- PowerShell 7.4.x is the oldest supported PowerShell version. That version is built using net8.0.  -->
+  <!-- PowerShell 7.4 is the oldest supported PowerShell line, supported until 10-Nov-2026. It is
+  built on net8.0.
+
+  This reference must stay at the BASELINE of that line, 7.4.0, not at whatever the newest patch is.
+
+  We ship Pester.dll and nothing else. System.Management.Automation is never in the package, at
+  runtime Pester binds to the one the host PowerShell already loaded. So this is a compile time
+  reference assembly, and .NET resolves such a reference forward to a newer version, never backward
+  to an older one. Referencing 7.4.6 means the module cannot load on 7.4.0 through 7.4.5, because
+  System.Management.Automation 7.4.0.0 does not satisfy a reference to 7.4.5.0.
+
+  The failure is hard to read: import fails on the first type that inherits from a type in
+  System.Management.Automation, which is PesterConfigurationDeserializer, and Update-TypeData
+  reports 'Cannot convert "PesterConfigurationDeserializer" from String to Type'. See #3013.
+
+  Microsoft only supports the latest patch of a line, so 7.4.0 itself is not a supported PowerShell,
+  7.4.19 is. Referencing the baseline anyway means Pester still loads for people who are behind on
+  their PowerShell updates. That is deliberate. Whether their PowerShell is patched is their
+  decision, and a compile time reference is the wrong place to enforce it, especially when the way
+  it enforces it is an unreadable load error. We are not shipping them anything vulnerable.
+
+  This is how it used to be done here. Before the net8 move this referenced 7.1.7, which was
+  older than 7.2.0, the oldest supported PowerShell at the time. -->
   <ItemGroup Condition="'$(TargetFramework)' == 'net8.0'">
-    <!-- Versions older than 7.4.6 have security vulnerabilities. -->
-    <PackageReference Include="System.Management.Automation" Version="7.4.6" />
+    <PackageReference Include="System.Management.Automation" Version="7.4.0" />
+
+    <!-- System.Management.Automation 7.4.0 drags in System.Formats.Asn1 8.0.0, which has
+    CVE-2024-38095, https://github.com/advisories/GHSA-447r-wph3-92pm. That is what the bump to
+    7.4.6 was avoiding. We do not ship that assembly either, so it never reaches anyone through
+    Pester, but there is no reason to keep a package with a known advisory in the build graph.
+    Pin the patched version, restore is clean again and it does not change what we ship. -->
+    <PackageReference Include="System.Formats.Asn1" Version="8.0.1" />
   </ItemGroup>
 
   <!-- Windows PowerShell 5.1 is the only Windows PowerShell that is still in support, and it is built using .NET Framework 4.5.2.

diff --git a/src/csharp/Pester/packages.lock.json b/src/csharp/Pester/packages.lock.json
@@ -24,26 +24,31 @@
       }
     },
     "net8.0": {
+      "System.Formats.Asn1": {
+        "type": "Direct",
+        "requested": "[8.0.1, )",
+        "resolved": "8.0.1",
+        "contentHash": "XqKba7Mm/koKSjKMfW82olQdmfbI5yqeoLV/tidRp7fbh5rmHAQ5raDI/7SU0swTzv+jgqtUGkzmFxuUg0it1A=="
+      },
       "System.Management.Automation": {
         "type": "Direct",
-        "requested": "[7.4.6, )",
-        "resolved": "7.4.6",
-        "contentHash": "RxrDUOJuLC7Sd2RaUHf52ujP5VpdfSVTv75nwgEVAROCfYV4IcSd5mL4mLrKa+6LjkXGli7aUs853UyCwidl1A==",
+        "requested": "[7.4.0, )",
+        "resolved": "7.4.0",
+        "contentHash": "nWsPB750tBAA6+08kcRY9fiV2eiRK6JYmySL4/IllocnA+gCUP2+sHX1enzy4uQ5DHE4SgFNv9yW+7tKX7uqsw==",
         "dependencies": {
           "Microsoft.ApplicationInsights": "2.21.0",
           "Microsoft.Management.Infrastructure": "3.0.0",
-          "Microsoft.PowerShell.CoreCLR.Eventing": "7.4.6",
+          "Microsoft.PowerShell.CoreCLR.Eventing": "7.4.0",
           "Microsoft.PowerShell.Native": "7.4.0",
           "Microsoft.Security.Extensions": "1.2.0",
           "Microsoft.Win32.Registry.AccessControl": "8.0.0",
           "Newtonsoft.Json": "13.0.3",
-          "System.Configuration.ConfigurationManager": "8.0.1",
-          "System.Diagnostics.DiagnosticSource": "8.0.1",
+          "System.Configuration.ConfigurationManager": "8.0.0",
+          "System.Diagnostics.DiagnosticSource": "8.0.0",
           "System.DirectoryServices": "8.0.0",
-          "System.Formats.Asn1": "8.0.1",
           "System.Management": "8.0.0",
-          "System.Security.AccessControl": "6.0.1",
-          "System.Security.Cryptography.Pkcs": "8.0.1",
+          "System.Security.AccessControl": "6.0.2-mauipre.1.22102.15",
+          "System.Security.Cryptography.Pkcs": "8.0.0",
           "System.Security.Permissions": "8.0.0",
           "System.Text.Encoding.CodePages": "8.0.0"
         }
@@ -77,10 +82,10 @@
       },
       "Microsoft.PowerShell.CoreCLR.Eventing": {
         "type": "Transitive",
-        "resolved": "7.4.6",
-        "contentHash": "z8XYESoGwJYT/L60192dE+n1dS7HRvbh2VinadhD3/zA6fDC/lu0VhQc42c56K4JiIMsLfHUUtaPJEa1JPaNBg==",
+        "resolved": "7.4.0",
+        "contentHash": "WHcqfVoaP2dZuf93GS7dk117+/CuLNCqiJN8JUhMthtJuA/lvIzblIzUf3yiEppm1QnINvF1wjy4sB1nXUuGqQ==",
         "dependencies": {
-          "System.Diagnostics.EventLog": "8.0.1"
+          "System.Diagnostics.EventLog": "8.0.0"
         }
       },
       "Microsoft.PowerShell.Native": {
@@ -110,33 +115,28 @@
       },
       "System.Configuration.ConfigurationManager": {
         "type": "Transitive",
-        "resolved": "8.0.1",
-        "contentHash": "gPYFPDyohW2gXNhdQRSjtmeS6FymL2crg4Sral1wtvEJ7DUqFCDWDVbbLobASbzxfic8U1hQEdC7hmg9LHncMw==",
+        "resolved": "8.0.0",
+        "contentHash": "JlYi9XVvIREURRUlGMr1F6vOFLk7YSY4p1vHo4kX3tQ0AGrjqlRWHDi66ImHhy6qwXBG3BJ6Y1QlYQ+Qz6Xgww==",
         "dependencies": {
-          "System.Diagnostics.EventLog": "8.0.1",
+          "System.Diagnostics.EventLog": "8.0.0",
           "System.Security.Cryptography.ProtectedData": "8.0.0"
         }
       },
       "System.Diagnostics.DiagnosticSource": {
         "type": "Transitive",
-        "resolved": "8.0.1",
-        "contentHash": "vaoWjvkG1aenR2XdjaVivlCV9fADfgyhW5bZtXT23qaEea0lWiUljdQuze4E31vKM7ZWJaSUsbYIKE3rnzfZUg=="
+        "resolved": "8.0.0",
+        "contentHash": "c9xLpVz6PL9lp/djOWtk5KPDZq3cSYpmXoJQY524EOtuFl5z9ZtsotpsyrDW40U1DRnQSYvcPKEUV0X//u6gkQ=="
       },
       "System.Diagnostics.EventLog": {
         "type": "Transitive",
-        "resolved": "8.0.1",
-        "contentHash": "n1ZP7NM2Gkn/MgD8+eOT5MulMj6wfeQMNS2Pizvq5GHCZfjlFMXV2irQlQmJhwA2VABC57M0auudO89Iu2uRLg=="
+        "resolved": "8.0.0",
+        "contentHash": "fdYxcRjQqTTacKId/2IECojlDSFvp7LP5N78+0z/xH7v/Tuw5ZAxu23Y6PTCRinqyu2ePx+Gn1098NC6jM6d+A=="
       },
       "System.DirectoryServices": {
         "type": "Transitive",
         "resolved": "8.0.0",
         "contentHash": "7nit//efUTy1OsAKco2f02PMrwsR2S234N0dVVp84udC77YcvpOQDz5znAWMtgMWBzY1aRJvUW61jo/7vQRfXg=="
       },
-      "System.Formats.Asn1": {
-        "type": "Transitive",
-        "resolved": "8.0.1",
-        "contentHash": "XqKba7Mm/koKSjKMfW82olQdmfbI5yqeoLV/tidRp7fbh5rmHAQ5raDI/7SU0swTzv+jgqtUGkzmFxuUg0it1A=="
-      },
       "System.Management": {
         "type": "Transitive",
         "resolved": "8.0.0",
@@ -147,13 +147,16 @@
       },
       "System.Security.AccessControl": {
         "type": "Transitive",
-        "resolved": "6.0.1",
-        "contentHash": "IQ4NXP/B3Ayzvw0rDQzVTYsCKyy0Jp9KI6aYcK7UnGVlR9+Awz++TIPCQtPYfLJfOpm8ajowMR09V7quD3sEHw=="
+        "resolved": "6.0.2-mauipre.1.22102.15",
+        "contentHash": "ny0SrGGm/O1Q889Zzx1tLP8X0UjkOHjDPN0omy3onMwU1qPrPq90kWvMY8gmh6eHtRkRAGzlJlEer64ii7GMrg=="
       },
       "System.Security.Cryptography.Pkcs": {
         "type": "Transitive",
-        "resolved": "8.0.1",
-        "contentHash": "CoCRHFym33aUSf/NtWSVSZa99dkd0Hm7OCZUxORBjRB16LNhIEOf8THPqzIYlvKM0nNDAPTRBa1FxEECrgaxxA=="
+        "resolved": "8.0.0",
+        "contentHash": "ULmp3xoOwNYjOYp4JZ2NK/6NdTgiN1GQXzVVN1njQ7LOZ0d0B9vyMnhyqbIi9Qw4JXj1JgCsitkTShboHRx7Eg==",
+        "dependencies": {
+          "System.Formats.Asn1": "8.0.0"
+        }
       },
       "System.Security.Cryptography.ProtectedData": {
         "type": "Transitive",

diff --git a/src/csharp/PesterTests/packages.lock.json b/src/csharp/PesterTests/packages.lock.json
@@ -82,10 +82,10 @@
       },
       "Microsoft.PowerShell.CoreCLR.Eventing": {
         "type": "Transitive",
-        "resolved": "7.4.6",
-        "contentHash": "z8XYESoGwJYT/L60192dE+n1dS7HRvbh2VinadhD3/zA6fDC/lu0VhQc42c56K4JiIMsLfHUUtaPJEa1JPaNBg==",
+        "resolved": "7.4.0",
+        "contentHash": "WHcqfVoaP2dZuf93GS7dk117+/CuLNCqiJN8JUhMthtJuA/lvIzblIzUf3yiEppm1QnINvF1wjy4sB1nXUuGqQ==",
         "dependencies": {
-          "System.Diagnostics.EventLog": "8.0.1"
+          "System.Diagnostics.EventLog": "8.0.0"
         }
       },
       "Microsoft.PowerShell.Native": {
@@ -174,22 +174,22 @@
       },
       "System.Configuration.ConfigurationManager": {
         "type": "Transitive",
-        "resolved": "8.0.1",
-        "contentHash": "gPYFPDyohW2gXNhdQRSjtmeS6FymL2crg4Sral1wtvEJ7DUqFCDWDVbbLobASbzxfic8U1hQEdC7hmg9LHncMw==",
+        "resolved": "8.0.0",
+        "contentHash": "JlYi9XVvIREURRUlGMr1F6vOFLk7YSY4p1vHo4kX3tQ0AGrjqlRWHDi66ImHhy6qwXBG3BJ6Y1QlYQ+Qz6Xgww==",
         "dependencies": {
-          "System.Diagnostics.EventLog": "8.0.1",
+          "System.Diagnostics.EventLog": "8.0.0",
           "System.Security.Cryptography.ProtectedData": "8.0.0"
         }
       },
       "System.Diagnostics.DiagnosticSource": {
         "type": "Transitive",
-        "resolved": "8.0.1",
-        "contentHash": "vaoWjvkG1aenR2XdjaVivlCV9fADfgyhW5bZtXT23qaEea0lWiUljdQuze4E31vKM7ZWJaSUsbYIKE3rnzfZUg=="
+        "resolved": "8.0.0",
+        "contentHash": "c9xLpVz6PL9lp/djOWtk5KPDZq3cSYpmXoJQY524EOtuFl5z9ZtsotpsyrDW40U1DRnQSYvcPKEUV0X//u6gkQ=="
       },
       "System.Diagnostics.EventLog": {
         "type": "Transitive",
-        "resolved": "8.0.1",
-        "contentHash": "n1ZP7NM2Gkn/MgD8+eOT5MulMj6wfeQMNS2Pizvq5GHCZfjlFMXV2irQlQmJhwA2VABC57M0auudO89Iu2uRLg=="
+        "resolved": "8.0.0",
+        "contentHash": "fdYxcRjQqTTacKId/2IECojlDSFvp7LP5N78+0z/xH7v/Tuw5ZAxu23Y6PTCRinqyu2ePx+Gn1098NC6jM6d+A=="
       },
       "System.DirectoryServices": {
         "type": "Transitive",
@@ -211,23 +211,22 @@
       },
       "System.Management.Automation": {
         "type": "Transitive",
-        "resolved": "7.4.6",
-        "contentHash": "RxrDUOJuLC7Sd2RaUHf52ujP5VpdfSVTv75nwgEVAROCfYV4IcSd5mL4mLrKa+6LjkXGli7aUs853UyCwidl1A==",
+        "resolved": "7.4.0",
+        "contentHash": "nWsPB750tBAA6+08kcRY9fiV2eiRK6JYmySL4/IllocnA+gCUP2+sHX1enzy4uQ5DHE4SgFNv9yW+7tKX7uqsw==",
         "dependencies": {
           "Microsoft.ApplicationInsights": "2.21.0",
           "Microsoft.Management.Infrastructure": "3.0.0",
-          "Microsoft.PowerShell.CoreCLR.Eventing": "7.4.6",
+          "Microsoft.PowerShell.CoreCLR.Eventing": "7.4.0",
           "Microsoft.PowerShell.Native": "7.4.0",
           "Microsoft.Security.Extensions": "1.2.0",
           "Microsoft.Win32.Registry.AccessControl": "8.0.0",
           "Newtonsoft.Json": "13.0.3",
-          "System.Configuration.ConfigurationManager": "8.0.1",
-          "System.Diagnostics.DiagnosticSource": "8.0.1",
+          "System.Configuration.ConfigurationManager": "8.0.0",
+          "System.Diagnostics.DiagnosticSource": "8.0.0",
           "System.DirectoryServices": "8.0.0",
-          "System.Formats.Asn1": "8.0.1",
           "System.Management": "8.0.0",
-          "System.Security.AccessControl": "6.0.1",
-          "System.Security.Cryptography.Pkcs": "8.0.1",
+          "System.Security.AccessControl": "6.0.2-mauipre.1.22102.15",
+          "System.Security.Cryptography.Pkcs": "8.0.0",
           "System.Security.Permissions": "8.0.0",
           "System.Text.Encoding.CodePages": "8.0.0"
         }
@@ -242,13 +241,16 @@
       },
       "System.Security.AccessControl": {
         "type": "Transitive",
-        "resolved": "6.0.1",
-        "contentHash": "IQ4NXP/B3Ayzvw0rDQzVTYsCKyy0Jp9KI6aYcK7UnGVlR9+Awz++TIPCQtPYfLJfOpm8ajowMR09V7quD3sEHw=="
+        "resolved": "6.0.2-mauipre.1.22102.15",
+        "contentHash": "ny0SrGGm/O1Q889Zzx1tLP8X0UjkOHjDPN0omy3onMwU1qPrPq90kWvMY8gmh6eHtRkRAGzlJlEer64ii7GMrg=="
       },
       "System.Security.Cryptography.Pkcs": {
         "type": "Transitive",
-        "resolved": "8.0.1",
-        "contentHash": "CoCRHFym33aUSf/NtWSVSZa99dkd0Hm7OCZUxORBjRB16LNhIEOf8THPqzIYlvKM0nNDAPTRBa1FxEECrgaxxA=="
+        "resolved": "8.0.0",
+        "contentHash": "ULmp3xoOwNYjOYp4JZ2NK/6NdTgiN1GQXzVVN1njQ7LOZ0d0B9vyMnhyqbIi9Qw4JXj1JgCsitkTShboHRx7Eg==",
+        "dependencies": {
+          "System.Formats.Asn1": "8.0.0"
+        }
       },
       "System.Security.Cryptography.ProtectedData": {
         "type": "Transitive",
@@ -276,7 +278,8 @@
       "pester": {
         "type": "Project",
         "dependencies": {
-          "System.Management.Automation": "[7.4.6, )"
+          "System.Formats.Asn1": "[8.0.1, )",
+          "System.Management.Automation": "[7.4.0, )"
         }
       }
     }

diff --git a/tst/Pester.Tests.ps1 b/tst/Pester.Tests.ps1
@@ -19,6 +19,19 @@ Describe 'Pester manifest' {
     }
 }
 
+Describe 'Pester assembly' {
+    # The reference must stay at the oldest PowerShell we support. .NET resolves an assembly
+    # reference forward to a newer version but never backward to an older one, so referencing a
+    # higher patch makes the module fail to import on every 7.4.x below it. See #3013 and the
+    # notes in src/csharp/Pester/Pester.csproj.
+    It 'references System.Management.Automation from the oldest supported PowerShell' -Skip:($PSVersionTable.PSVersion.Major -lt 7) {
+        $reference = [PesterConfiguration].Assembly.GetReferencedAssemblies() |
+            Where-Object { $_.Name -eq 'System.Management.Automation' }
+
+        $reference.Version | Should -Be ([version] '7.4.0.0')
+    }
+}
+
 Describe 'Clean treatment of the $error variable' {
     BeforeAll {
         $error.Clear()