Merge to master

.github/workflows/builddocsite.yml

@@ -4,9 +4,14 @@ on:
   workflow_dispatch:
   schedule:
   - cron: '0 2 * * *'
+
+permissions: read-all
+
 jobs:
   documentation:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write      
     steps:
       - name: Wait for actions to finish
         uses: softprops/turnstyle@v1

.github/workflows/buildexternalhelp.yml

@@ -7,6 +7,8 @@ on:
       - dev
     paths: 'documentation/**'
 
+permissions: read-all
+
 jobs:
   build:
 

.github/workflows/buildpr.yml

@@ -7,14 +7,12 @@ on:
       - dev
     paths: 
       - 'src/**'
-  #push: 
-  #  branches:
-  #    - dev
-  #  paths:
-  #    - 'src/**'
+
+permissions: read-all
+
 jobs:
   build_dev_branch:
-    runs-on: ubuntu-latest
+    runs-on: macos-latest
     steps:
     - name: Checkout PnP.Framework
       uses: actions/checkout@v4
@@ -55,5 +53,5 @@ jobs:
       run: dotnet restore -p:PnPFrameworkPath="..\..\..\pnpframework\src\lib\" -p:PnPCoreSdkPath="..\..\..\pnpcore\src\sdk\"
       working-directory: powershell/src
     - name: Build PnP.PowerShell
-      run: dotnet build --configuration Debug --no-restore -p:PnPFrameworkPath="/home/runner/work/powershell/powershell/pnpframework/src/lib/" -p:PnPCoreSdkPath="/home/runner/work/powershell/powershell/pnpcore/src/sdk/"
+      run: dotnet build --configuration Debug --no-restore -p:PnPFrameworkPath="/Users/runner/work/powershell/powershell/pnpframework/src/lib/" -p:PnPCoreSdkPath="/Users/runner/work/powershell/powershell/pnpcore/src/sdk/"
       working-directory: powershell/src

.github/workflows/checkdocumentationbuild.yml

@@ -7,6 +7,9 @@ on:
     paths:
       - 'documentation/**'
       - 'pages/**'
+
+permissions: read-all
+
 jobs:
   docfx:
 

.github/workflows/cleanupnightlyreleases.yml

@@ -4,6 +4,8 @@ on:
   workflow_dispatch:
   schedule:
     - cron: '0 3 * * *'
+
+permissions: read-all
 
 jobs:
   # This workflow contains a single job called "cleanup"

.github/workflows/closestaleissues.yml

@@ -3,6 +3,8 @@ on:
   schedule:
   - cron: "30 1 * * *"
 
+permissions: read-all
+
 jobs:
   stale:
     runs-on: ubuntu-latest

.github/workflows/codeql.yml

@@ -0,0 +1,62 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ dev ]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [ dev ]
+  schedule:
+    - cron: '36 19 * * 2'
+
+permissions: read-all
+
+
+jobs:  
+  analyze:
+    name: Analyze
+    runs-on: windows-latest
+    permissions:
+      security-events: write
+      contents: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'csharp' ]        
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v3
+      with:
+        languages: ${{ matrix.language }}            
+
+    - name: Setup .NET Core
+      uses: actions/setup-dotnet@v4
+      with:
+        dotnet-version: | 
+          6.x
+          7.x          
+    - name: Install dependencies
+      run: dotnet restore
+      working-directory: src/Commands
+    - name: Build ⚙
+      run:  dotnet build PnP.PowerShell.csproj --nologo --configuration debug --no-incremental --verbosity diagnostic --disable-build-servers --force
+      working-directory: src/Commands  
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v3

.github/workflows/nightlyrelease.yml

@@ -4,6 +4,9 @@ on:
   workflow_dispatch:
   schedule:
   - cron: '30 2 * * *'
+
+permissions: read-all
+
 jobs:
   build:
 
@@ -73,14 +76,14 @@ jobs:
     - name: Build an image
       run: |
         VERSION=$(cat ./version.txt)-nightly
-        docker build --build-arg "PNP_MODULE_VERSION=$VERSION" --build-arg "BASE_IMAGE_SUFFIX=alpine-3.14" --build-arg "INSTALL_USER=root" --build-arg "SKIP_PUBLISHER_CHECK=False" ./docker -f ./docker/pnppowershell.dockerFile --tag ${{ secrets.DOCKER_ORG }}/powershell:$VERSION-alpine-3.14;
+        docker build --build-arg "PNP_MODULE_VERSION=$VERSION" --build-arg "BASE_IMAGE_SUFFIX=alpine-3.17" --build-arg "INSTALL_USER=root" --build-arg "SKIP_PUBLISHER_CHECK=False" ./docker -f ./docker/pnppowershell.dockerFile --tag ${{ secrets.DOCKER_ORG }}/powershell:$VERSION-alpine-3.17;
     - name: Tag the image
       run: |
         VERSION=$(cat ./version.txt)-nightly
-        docker image tag ${{ secrets.DOCKER_ORG }}/powershell:$VERSION-alpine-3.14 ${{ secrets.DOCKER_ORG }}/powershell:nightly
+        docker image tag ${{ secrets.DOCKER_ORG }}/powershell:$VERSION-alpine-3.17 ${{ secrets.DOCKER_ORG }}/powershell:nightly
     - name: Push the image
       run: |
         VERSION=$(cat ./version.txt)-nightly
         docker login -u ${{ secrets.DOCKER_USERNAME }} -p '${{ secrets.DOCKER_PASSWORD }}'
-        docker push ${{ secrets.DOCKER_ORG }}/powershell:$VERSION-alpine-3.14
+        docker push ${{ secrets.DOCKER_ORG }}/powershell:$VERSION-alpine-3.17
         docker push ${{ secrets.DOCKER_ORG }}/powershell:nightly

.github/workflows/release.yml

@@ -4,6 +4,9 @@ on:
   workflow_dispatch:
   schedule:
   - cron: '30 3 * * *'
+
+permissions: read-all
+
 jobs:
   publish-docker-windows-2022:
     runs-on: windows-2022
@@ -31,4 +34,4 @@ jobs:
       shell: pwsh
       run: |
         $securedPassword = ConvertTo-SecureString "${{ secrets.DOCKER_PASSWORD }}" -AsPlainText -Force
-        ./docker/Publish-UnpublishedImage.ps1 PnP.PowerShell ${{ secrets.DOCKER_USERNAME }} ${{ secrets.DOCKER_ORG }} powershell $securedPassword "root" $false "alpine-3.14"
+        ./docker/Publish-UnpublishedImage.ps1 PnP.PowerShell ${{ secrets.DOCKER_USERNAME }} ${{ secrets.DOCKER_ORG }} powershell $securedPassword "root" $false "alpine-3.17"

.github/workflows/scorecard.yml

@@ -0,0 +1,58 @@
+name: Scorecard analysis workflow
+on:
+  push:
+    # Only the default branch is supported.
+    branches:
+    - dev
+  schedule:
+    # Weekly on Saturdays.
+    - cron:  '30 1 * * 6'
+
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed for Code scanning upload
+      security-events: write
+      # Needed for GitHub OIDC token if publish_results is true
+      id-token: write
+
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
+        with:          
+          ref: ${{ github.event.inputs.branch }}
+          path: ${{ github.sha }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          # Scorecard team runs a weekly scan of public GitHub repos,
+          # see https://github.com/ossf/scorecard#public-data.
+          # Setting `publish_results: true` helps us scale by leveraging your workflow to
+          # extract the results instead of relying on our own infrastructure to run scans.
+          # And it's free for you!
+          publish_results: true
+
+      # Upload the results as artifacts (optional). Commenting out will disable
+      # uploads of run results in SARIF format to the repository Actions tab.
+      # https://docs.github.com/en/actions/advanced-guides/storing-workflow-data-as-artifacts
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard (optional).
+      # Commenting out will disable upload of results to your repo's Code Scanning dashboard
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@8f596b4ae3cb3c588a5c46780b86dd53fef16c52 # v3.25.2
+        with:
+          sarif_file: results.sarif

.vscode/settings.json

@@ -0,0 +1,3 @@
+{
+    "dotnet.defaultSolution": "src/PnP.PowerShell.sln"
+}

CHANGELOG.md

@@ -10,8 +10,76 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/).
 
 ### Added
 
+- Added `New-PnPLibraryFileVersionBatchDeleteJob` and `New-PnPSiteFileVersionBatchDeleteJob` cmdlets to queue a job for deleting the file versions based on age. [#3799](https://github.com/pnp/powershell/pull/3799)
+- Added `New-PnPLibraryFileVersionExpirationReportJob` and `New-PnPSiteFileVersionExpirationReportJob` cmdlets to queue a job for generating a file version expiration report for all files in a document library or site. [#3799](https://github.com/pnp/powershell/pull/3799)
+- Added `Remove-PnPLibraryFileVersionBatchDeleteJob` and `Remove-PnPSiteFileVersionBatchDeleteJob` cmdlets to cancel the job for deleting file versions based on age. [#3799](https://github.com/pnp/powershell/pull/3799)
+- Added `Get-PnPLibraryFileVersionExpirationReportJobProgress` and `Get-PnPSiteFileVersionExpirationReportJobProgress` cmdlets to getting the progress for the job for file versions based on age. [#3799](https://github.com/pnp/powershell/pull/3799)
+- Added `-UseVersionExpirationReport` parameter to `Get-PnPFileVersion` cmdlet to get the version expiration report for a single file. [#3799](https://github.com/pnp/powershell/pull/3799)
+- Added `-DelayDenyAddAndCustomizePagesEnforcement` parameter to `Set-PnPTenant` cmdlet which allows delay of the change to custom script set on the Tenant until mid-November 2024. [#3815](https://github.com/pnp/powershell/pull/3815)
+- Added additional permissions for Graph application permission validate sets. [#3835](https://github.com/pnp/powershell/issues/3835)
+- Added the ability to upload entire local folders with files and optionally subfolders to SharePoint Online into 'Copy-PnPFolder' [#3850](https://github.com/pnp/powershell/pull/3850)
+- Added `LoopDefaultSharingLinkRole`, `DefaultShareLinkScope`, `DefaultShareLinkRole`, `LoopDefaultSharingLinkScope` and `DefaultLinkToExistingAccessReset` parameters to `Set-PnPTenant` cmdlet. [#3874](https://github.com/pnp/powershell/pull/3874)
+- Added `Unlock-PnPSensitivityLabelEncryptedFile` which allows the encryption to be removed from a file [#3864](https://github.com/pnp/powershell/pull/3864)
+- Added `Get-PnPLibraryFileVersionBatchDeleteJobStatus` and `Get-PnPSiteFileVersionBatchDeleteJobStatus` to check on the status of applying file based version expiration based on age on a library and site level [#3828](https://github.com/pnp/powershell/pull/3828)
+- Added support for `Get-PnPSiteCollectionAppCatalog` and `Get-PnPTenantSite` to be used with vanity domain tenants [#3895](https://github.com/pnp/powershell/pull/3895)
+- Added support for using vanity domain tenants with `Grant-PnPTenantServicePrincipalPermission`, `Revoke-PnPTenantServicePrincipalPermission`, `Set-PnPWebTheme`, `Invoke-PnPListDesign`, `Set-PnPSite`, `Add-PnPSiteDesignTask`, `Get-PnPSiteDesignRun`, `Get-PnPSiteDesignTask` and `Invoke-PnPSiteDesign` cmdlets [#3898](https://github.com/pnp/powershell/pull/3898)
+- Added `-Detailed` to `Get-PnPMicrosoft365Group` which allows retrieval of the AllowExternalSenders, IsSubscribedByMail and AutoSubscribeNewMembers properties of the group [#3958](https://github.com/pnp/powershell/pull/3958)
+- Added `-RequireSenderAuthenticationEnabled` and `-AutoSubscribeNewMembers` to `Set-PnPMicrosoft365Group` which allows setting these properties on a group [#3958](https://github.com/pnp/powershell/pull/3958)
+- Added `Get-PnPContainerType` cmdlet to retrieve the list of Container Types created for a SharePoint Embedded Application in the tenant. [#3946](https://github.com/pnp/powershell/pull/3946)
+- Added `-RecycleBinRetentionPeriod`,`-OneDriveBlockGuestsAsSiteAdmin`,`-OneDriveDefaultShareLinkRole`,`-OneDriveDefaultShareLinkScope` and `-OneDriveDefaultLinkToExistingAccess` parameters to the `Set-PnPTenant` cmdlet. [#3977](https://github.com/pnp/powershell/pull/3977)
+- Added `Get-PnPTenantRestrictedSearchMode` and `Set-PnPTenantRestrictedSearchMode` cmdlets to enable and set up Restricted SharePoint Search. [#3976](https://github.com/pnp/powershell/pull/3976)
+- Added `Get-PnPTenantInternalSetting` cmdlet to retrieve internal tenant settings not exposed via CSOM SDK. [#3902](https://github.com/pnp/powershell/pull/3902)
+- Added `Add-PnPHomeSite` cmdlet to add a home site to your tenant. [#3989](https://github.com/pnp/powershell/pull/3989)
+- Added `Get-PnPPageSchedulingEnabled` cmdlet to get the state of the modern page schedule feature in the library. [PR](https://github.com/pnp/powershell/commit/4ac757fc2072233529b38b2b39c36ea6b941e003)
+- Added `-IncludeSensitivityLabels` parameter to `Get-PnPMicrosoft365Group` cmdlet to retrieve sensitivity labels assigned to M365 Groups. [#3991](https://github.com/pnp/powershell/pull/3991)
+- Added `Get-PnPFileSensitivityLabelInfo` cmdlet to retrieve sensitivity label information about a file in a SharePoint site. [#3994](https://github.com/pnp/powershell/pull/3994)
+- Added `Get-PnPTenantRestrictedSearchAllowedList` cmdlet to retrieve existing list of URLs in the allowed list. [#3997](https://github.com/pnp/powershell/pull/3997)
+- Added `-IsSharePointAddInsDisabled` to the `Set-PnPTenant` cmdlet which allows disabling SharePoint Add-ins [#4032](https://github.com/pnp/powershell/pull/4032)
+- Added `-RestrictContentOrgWideSearch`, `-ReadOnlyForUnmanagedDevices` and `-InheritVersionPolicyFromTenant` parameters to `Set-PnPTenantSite` cmdlet. [#4024](https://github.com/pnp/powershell/pull/4024)
+
+### Fixed
+
+- Fixed `Get-PnPChangeLog -Version 2.3.0` not returning the changelog for that version [#3804](https://github.com/pnp/powershell/pull/3804)
+- Fixed `Get-PnPFlow` cmdlet throwing time out error due to incorrect URL used in HTTP request. [#3820](https://github.com/pnp/powershell/pull/3820)
+- Fixed `Copy-PnPList` cmdlet to better handle lookup columns. [#3870](https://github.com/pnp/powershell/pull/3870)
+- Fixed NullDereferenceException happening when an exception is logged in PnPConnectedCmdlet but the connection passed through -Connection parameter is not the last one. [#3885](https://github.com/pnp/powershell/pull/3885)
+- Fixed NullDereferenceException in `Get-PnPUserProfileProperty` cmdlet when the user profile doesn't exist, showing a better error message. [#3891](https://github.com/pnp/powershell/pull/3891)
+- Fixed the dev build process on Mac OS devices. [#3907](https://github.com/pnp/powershell/pull/3907)
+- Fixed `Get-PnPContainer` cmdlet to also handle pagination in case of large no. of containers in a tenant. [#3990](https://github.com/pnp/powershell/pull/3990)
+- Fixed `New-PnPTeamsTeam` cmdlet to better handle error specifically such as `Conflict (409): Team already exists`. [#3992](https://github.com/pnp/powershell/pull/3992)
+- Fixed `Remove-PnPTeamsChannel` issue where it was throwing incorrect exception. [#4036](https://github.com/pnp/powershell/pull/4036)
+
+### Changed
+- Renamed `Get-PnPSiteFileVersionExpirationReportJobProgress` to `Get-PnPSiteFileVersionExpirationReportJobStatus` [#3828](https://github.com/pnp/powershell/pull/3828)
+- Renamed `Get-PnPSiteVersionPolicyProgress` to `Get-PnPSiteVersionPolicyStatus` [#3828](https://github.com/pnp/powershell/pull/3828)
+- `Remove-PnPGroupMember` cmdlet now supports removing members from pipeline. [#3955](https://github.com/pnp/powershell/pull/3955)
+- Changed `Set-PnPTenantCdnPolicy` cmdlet to allow PolicyValue parameter to be an empty string or $null, while still being mandatory. [#3937](https://github.com/pnp/powershell/pull/3937)
+- Marked `UserVoiceForFeedbackEnabled` as obsolete in `Set-PnPTenant` cmdlet as Microsoft doesn't support this. [#3985](https://github.com/pnp/powershell/pull/3985)
+- `Get-PnPTenantSite` cmdlet now returns additional properties like `ArchiveStatus`, `EnableAutoExpirationVersionTrim` and many more. [#3987](https://github.com/pnp/powershell/pull/3987)
+- `Add-PnPListFoldersToSiteTemplate` cmdlet now wont export RoleBindings which are `Limited Access`. It caused issues while applying the template. [#3918](https://github.com/pnp/powershell/pull/3918)
+
+### Removed
+
+- Removed `UserVoiceForFeedbackEnabled` property from `Get-PnPTenant` as it is deprecated. [PR](https://github.com/pnp/powershell/commit/190ef864d2e20249658eff93feadf0effb24882d)
+
 ### Contributors
 
+- Maxime Hazebroucq [mhazebroucq]
+- Paolo Pialorsi [PaoloPia]
+- Marc Studer [Studermarc]
+- Mark Gort [markgort86]
+- Christian Veenhuis [ChVeen]
+- Tobias Maestrini [tmaestrini]
+- WCONFR [WCONFR]
+- Jenny Wu [msjennywu]
+- Reshmee Auckloo [reshme011]
+- Aimery Thomas [a1mery]
+- Arleta Wanat [PowershellScripts]
+- Giacomo Pozzoni [jackpoz]
+- [blarrywangmsft]
+- Koen Zomers [koenzomers]
+- Erwin van Hunen [erwinvanhunen]
+
 ## [2.4.0]
 
 ### Added

LICENSE

@@ -1,10 +1,6 @@
-Microsoft 365 Patterns and Practices (PnP)
+MIT License
 
-The MIT License (MIT)
-
-Copyright (c) Microsoft Corporation
-
-All rights reserved.
+Copyright (c) 2024 Microsoft 365 & Power Platform Community
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

README.md

@@ -6,6 +6,8 @@ Last version | Last nightly version
 -------------|---------------------
 [![PnP.PowerShell](https://img.shields.io/powershellgallery/v/pnp.powershell)](https://www.powershellgallery.com/packages/PnP.PowerShell/) | [![PnP.PowerShell](https://img.shields.io/powershellgallery/v/pnp.powershell?include_prereleases)](https://www.powershellgallery.com/packages/PnP.PowerShell/)
 
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/pnp/powershell/badge)](https://scorecard.dev/viewer/?uri=github.com/pnp/powershell)
+
 This module is a successor of the [PnP-PowerShell](https://github.com/pnp/pnp-powershell) module. The original cmdlets only work on Windows and Windows PowerShell and supports SharePoint On-Premises (2013, 2016 and 2019) and SharePoint Online. This version of the cmdlets is cross-platform (i.e it works on Windows, MacOS and Linux) but it will only support SharePoint Online. Going forward we will only be **actively maintaining the cross-platform PnP PowerShell** module.
 
 For more information about installing or upgrading to this module, please refer to [the documentation](https://pnp.github.io/powershell/articles/index.html).

SECURITY.md

@@ -0,0 +1,18 @@
+# Security Policy
+
+## Disclaimer
+
+**ALL CODE IN THIS REPOSITORY IS PROVIDED *AS IS* WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING ANY IMPLIED WARRANTIES OF FITNESS FOR A PARTICULAR PURPOSE, MERCHANTABILITY, OR NON-INFRINGEMENT.**
+
+---
+
+## Supported Versions
+
+The only supported version is the latest one.
+
+
+## Reporting a Vulnerability
+
+To report a vulnerability, please [create an issue](https://github.com/pnp/powershell/issues/new/choose) and tag the issue as `vulnerability-suspected`.
+
+Upon receipt of the issue, we will flag it as having a suspected vulnerability and request the support from the community to identify and resolve, if possible, the issue.

build/Build-Debug.ps1

@@ -126,10 +126,13 @@ if ($LASTEXITCODE -eq 0) {
 		# Load the Module in a new PowerShell session
 		$scriptBlock = {
 			$documentsFolder = [environment]::getfolderpath("mydocuments");
-
-			if ($IsLinux -or $isMacOS) {
+			
+			if ($IsLinux) {
 				$destinationFolder = "$documentsFolder/.local/share/powershell/Modules/PnP.PowerShell"
 			}
+			elseif ($IsMacOS) {
+				$destinationFolder = "~/.local/share/powershell/Modules/PnP.PowerShell"
+			}
 			else {
 				$destinationFolder = "$documentsFolder/PowerShell/Modules/PnP.PowerShell"
 			}