pull · Sep 21, 2026 · Sep 21, 2026 · Sep 21, 2026 · Sep 21, 2026 · Sep 21, 2026
diff --git a/.github/workflows/analyze-reusable.yml b/.github/workflows/analyze-reusable.yml
@@ -41,13 +41,13 @@ jobs:
       with:
         fetch-depth: '0'
 
-    - uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
+    - uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
       with:
         global-json-file: ./global.json
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v3.29.5
+      uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v3.29.5
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -74,4 +74,4 @@ jobs:
       shell: pwsh
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v3.29.5
+      uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v3.29.5
diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
@@ -22,7 +22,7 @@ jobs:
 
     - name: Verify PR has label starting with 'cl-'
       id: verify-labels
-      uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       with:
         script: |
           const labels = context.payload.pull_request.labels.map(label => label.name.toLowerCase());

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
@@ -172,7 +172,7 @@ jobs:
       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
         fetch-depth: 1000
-    - uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
+    - uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
       with:
         global-json-file: ./global.json
     - name: Bootstrap packaging
@@ -231,7 +231,7 @@ jobs:
         testResultsFolder: "${{ runner.workspace }}/testResults"
     - name: Upload package artifact
       if: always()
-      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: macos-package
         path: "*.pkg"

diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
@@ -59,14 +59,14 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: SARIF file
           path: results.sarif
           retention-days: 5
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v3.29.5
+        uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v3.29.5
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/windows-packaging-reusable.yml b/.github/workflows/windows-packaging-reusable.yml
@@ -64,7 +64,7 @@ jobs:
         shell: pwsh
 
       - name: Setup .NET
-        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
+        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
         with:
           global-json-file: ./global.json
 
@@ -84,7 +84,7 @@ jobs:
 
       - name: Upload Build Artifacts
         if: always()
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: windows-packaging-${{ matrix.architecture }}-${{ matrix.channel }}
           path: |

diff --git a/.github/workflows/xunit-tests.yml b/.github/workflows/xunit-tests.yml
@@ -28,7 +28,7 @@ jobs:
           fetch-depth: 1000
 
       - name: Setup .NET
-        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
+        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
         with:
           global-json-file: ./global.json
 
@@ -49,7 +49,7 @@ jobs:
           Write-Host "Completed xUnit test run."
 
       - name: Upload xUnit results
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()
         with:
           name: ${{ inputs.test_results_artifact_name }}

diff --git a/.pipelines/MSIXBundle-vPack-Official.yml b/.pipelines/MSIXBundle-vPack-Official.yml
@@ -22,6 +22,26 @@ parameters: # parameters are shown up in ADO UI in a build queue time
     - R1
     - Netlock
   default: "R1"
+- name: IsEarlyAccess
+  type: boolean
+  default: false
+- name: EarlyAccessFeed
+  displayName: Early Access Feed
+  type: string
+  default: 'net11'
+  values:
+    - 'net8'
+    - 'net9'
+    - 'net10'
+    - 'net11'
+- name: DOTNET_RUNTIME_VERSION
+  displayName: Runtime version of early access build
+  type: string
+  default: ' '
+- name: DOTNET_SDK_VERSION
+  displayName: SDK version of early access build
+  type: string
+  default: ' '
 
 name: msixbundle_vPack_$(Build.SourceBranchName)_Prod.True_Create.${{ parameters.createVPack }}_$(date:yyyyMMdd).$(rev:rr)
 
@@ -48,9 +68,19 @@ variables:
     value: ${{ parameters.ReleaseTagVar }}
   - name: netiso
     value: ${{ parameters.netiso }}
+  - name: IsEarlyAccess
+    value: ${{ parameters.IsEarlyAccess }}
+  - name: EARLY_ACCESS_FEED
+    value: ${{ parameters.EarlyAccessFeed }}
+  - name: DOTNET_RUNTIME_VERSION
+    value: ${{ parameters.DOTNET_RUNTIME_VERSION }}
+  - name: DOTNET_SDK_VERSION
+    value: ${{ parameters.DOTNET_SDK_VERSION }}
   - group: certificate_logical_to_actual # used within signing task
   - group: MSIXSigningProfile
   - group: msixTools
+  - ${{ if eq(parameters.IsEarlyAccess, true) }}:
+    - group: DotNetPrivateBuildAccess
   - group: mscodehub-feed-read-general
   - group: mscodehub-feed-read-akv
 
@@ -95,9 +125,33 @@ extends:
       tsaOptionsFile: .config/tsaoptions.json
 
     stages:
+    - stage: prep
+      displayName: 'Prepare early access .NET'
+      dependsOn: []
+      jobs:
+      - ${{ if eq(parameters.IsEarlyAccess, true) }}:
+        - template: /.pipelines/templates/downloadDotnetEarlyAccess.yml@self
+          parameters:
+            DotnetRuntimeVersion: ${{ parameters.DOTNET_RUNTIME_VERSION }}
+            DotnetSdkVersion: ${{ parameters.DOTNET_SDK_VERSION }}
+      - ${{ else }}:
+        - job: skip_download_dotnet_early_access
+          displayName: 'Skip early access .NET download'
+          pool:
+            type: windows
+          variables:
+          - name: ob_outputDirectory
+            value: '$(Build.ArtifactStagingDirectory)/ONEBRANCH_ARTIFACT'
+          - name: ob_signing_setup_enabled
+            value: false
+          - name: ob_sdl_codeSignValidation_enabled
+            value: false
+          steps:
+          - pwsh: Write-Host 'IsEarlyAccess is false; skipping early access .NET download.'
+
     - stage: Build_MSIX_Package
       displayName: 'Build and create MSIX packages'
-      dependsOn: []
+      dependsOn: [prep]
       jobs:
       - job: Build
         pool:
@@ -114,6 +168,10 @@ extends:
           ArtifactPlatform: 'windows'
           ob_outputDirectory: '$(BUILD.SOURCESDIRECTORY)\out'
           ob_artifactBaseName: drop_build_$(Architecture)
+          IsEarlyAccess: ${{ parameters.IsEarlyAccess }}
+          EARLY_ACCESS_FEED: ${{ parameters.EarlyAccessFeed }}
+          DOTNET_RUNTIME_VERSION: ${{ parameters.DOTNET_RUNTIME_VERSION }}
+          DOTNET_SDK_VERSION: ${{ parameters.DOTNET_SDK_VERSION }}
 
         steps:
         - checkout: self
@@ -210,6 +268,9 @@ extends:
             Write-Verbose -Verbose "Completed building PowerShell for '$env:BuildConfiguration' configuration"
           displayName: 'Build Windows Universal - $(Architecture)-$(BuildConfiguration) Symbols folder'
           env:
+            ${{ if eq(parameters.IsEarlyAccess, true) }}:
+              __DOTNET_RUNTIME_FEED_KEY: $(RUNTIME_SOURCEFEED_KEY)
+              VSS_NUGET_EXTERNAL_FEED_ENDPOINTS: $(VSS_NUGET_EXTERNAL_FEED_ENDPOINTS)
             ob_restore_phase: true # Set ob_restore_phase to run this step before '🔒 Setup Signing' step.
 
         # Add CodeQL Finalize task right after your 'Build' step.

diff --git a/.pipelines/NonOfficial/PowerShell-Coordinated_Packages-NonOfficial.yml b/.pipelines/NonOfficial/PowerShell-Coordinated_Packages-NonOfficial.yml
@@ -13,6 +13,7 @@ parameters:
       - 'net8'
       - 'net9'
       - 'net10'
+      - 'net11'
   - name: ReleaseTagVar
     displayName: Release Tag
     type: string

diff --git a/.pipelines/NonOfficial/PowerShell-Packages-NonOfficial.yml b/.pipelines/NonOfficial/PowerShell-Packages-NonOfficial.yml
@@ -38,6 +38,7 @@ parameters: # parameters are shown up in ADO UI in a build queue time
       - 'net8'
       - 'net9'
       - 'net10'
+      - 'net11'
   - name: DOTNET_RUNTIME_VERSION
     displayName: Runtime version of early access build
     type: string

diff --git a/.pipelines/NonOfficial/PowerShell-Release-NonOfficial.yml b/.pipelines/NonOfficial/PowerShell-Release-NonOfficial.yml
@@ -36,6 +36,7 @@ parameters: # parameters are shown up in ADO UI in a build queue time
       - 'net8'
       - 'net9'
       - 'net10'
+      - 'net11'
   - name: IsEarlyAccess
     type: boolean
     default: false

diff --git a/.pipelines/PowerShell-Coordinated_Packages-Official.yml b/.pipelines/PowerShell-Coordinated_Packages-Official.yml
@@ -40,6 +40,7 @@ parameters:
       - 'net8'
       - 'net9'
       - 'net10'
+      - 'net11'
   - name: DOTNET_RUNTIME_VERSION
     displayName: Runtime version of early access build
     type: string
@@ -121,4 +122,3 @@ extends:
         DOTNET_SDK_VERSION: ${{ parameters.DOTNET_SDK_VERSION }}
         EarlyAccessFeed: ${{ parameters.EarlyAccessFeed }}
         IsEarlyAccess: ${{ parameters.IsEarlyAccess }}
-
diff --git a/.pipelines/PowerShell-Packages-Official.yml b/.pipelines/PowerShell-Packages-Official.yml
@@ -38,6 +38,7 @@ parameters: # parameters are shown up in ADO UI in a build queue time
       - 'net8'
       - 'net9'
       - 'net10'
+      - 'net11'
   - name: DOTNET_RUNTIME_VERSION
     displayName: Runtime version of early access build
     type: string
@@ -120,4 +121,3 @@ extends:
         DOTNET_RUNTIME_VERSION: ${{ parameters.DOTNET_RUNTIME_VERSION }}
         DOTNET_SDK_VERSION: ${{ parameters.DOTNET_SDK_VERSION }}
         EarlyAccessFeed: ${{ parameters.EarlyAccessFeed }}
-
diff --git a/.pipelines/PowerShell-Release-Official.yml b/.pipelines/PowerShell-Release-Official.yml
@@ -36,6 +36,7 @@ parameters: # parameters are shown up in ADO UI in a build queue time
       - 'net8'
       - 'net9'
       - 'net10'
+      - 'net11'
   - name: IsEarlyAccess
     type: boolean
     default: false

diff --git a/.pipelines/PowerShell-vPack-Official.yml b/.pipelines/PowerShell-vPack-Official.yml
@@ -29,6 +29,26 @@ parameters: # parameters are shown up in ADO UI in a build queue time
     - R1
     - Netlock
   default: "R1"
+- name: IsEarlyAccess
+  type: boolean
+  default: false
+- name: EarlyAccessFeed
+  displayName: Early Access Feed
+  type: string
+  default: 'net11'
+  values:
+    - 'net8'
+    - 'net9'
+    - 'net10'
+    - 'net11'
+- name: DOTNET_RUNTIME_VERSION
+  displayName: Runtime version of early access build
+  type: string
+  default: ' '
+- name: DOTNET_SDK_VERSION
+  displayName: SDK version of early access build
+  type: string
+  default: ' '
 
 name: vPack_$(Build.SourceBranchName)_Prod_Create.${{ parameters.createVPack }}_Name.${{ parameters.vPackName}}_$(date:yyyyMMdd).$(rev:rr)
 
@@ -38,6 +58,10 @@ variables:
       debug: ${{ parameters.debug }}
       ReleaseTagVar: ${{ parameters.ReleaseTagVar }}
       netiso: ${{ parameters.netiso }}
+      IsEarlyAccess: ${{ parameters.IsEarlyAccess }}
+      EarlyAccessFeed: ${{ parameters.EarlyAccessFeed }}
+      DOTNET_RUNTIME_VERSION: ${{ parameters.DOTNET_RUNTIME_VERSION }}
+      DOTNET_SDK_VERSION: ${{ parameters.DOTNET_SDK_VERSION }}
 
 resources:
   repositories:
@@ -85,3 +109,7 @@ extends:
       parameters:
         createVPack: ${{ parameters.createVPack }}
         vPackName: ${{ parameters.vPackName }}
+        IsEarlyAccess: ${{ parameters.IsEarlyAccess }}
+        EarlyAccessFeed: ${{ parameters.EarlyAccessFeed }}
+        DOTNET_RUNTIME_VERSION: ${{ parameters.DOTNET_RUNTIME_VERSION }}
+        DOTNET_SDK_VERSION: ${{ parameters.DOTNET_SDK_VERSION }}
diff --git a/.pipelines/apiscan-gen-notice.yml b/.pipelines/apiscan-gen-notice.yml
@@ -15,6 +15,7 @@ parameters:
       - 'net8'
       - 'net9'
       - 'net10'
+      - 'net11'
   - name: DOTNET_RUNTIME_VERSION
     displayName: Runtime version of early access build
     type: string

diff --git a/.pipelines/templates/insert-nuget-config-azfeed.yml b/.pipelines/templates/insert-nuget-config-azfeed.yml
@@ -68,6 +68,7 @@ steps:
             'net8' { 'https://pkgs.dev.azure.com/powershell-rel/PowerShell/_packaging/powershell-net-8-early-access/nuget/v3/index.json' }
             'net9' { 'https://pkgs.dev.azure.com/powershell-rel/PowerShell/_packaging/powershell-net-9-early-access/nuget/v3/index.json' }
             'net10' { 'https://pkgs.dev.azure.com/powershell-rel/PowerShell/_packaging/powershell-net-10-early-access/nuget/v3/index.json' }
+            'net11' { 'https://pkgs.dev.azure.com/powershell-rel/PowerShell/_packaging/powershell-net-11-early-access/nuget/v3/index.json' }
             default { throw "Unknown early access feed URL: $earlyAccessFeed" }
         }
       $powerShellRepoUri = 'https://pkgs.dev.azure.com/powershell/PowerShell/_packaging/PowerShell/nuget/v3/index.json'

diff --git a/.pipelines/templates/release-validate-sdk.yml b/.pipelines/templates/release-validate-sdk.yml
@@ -99,6 +99,7 @@ jobs:
                   'net8' { 'https://pkgs.dev.azure.com/powershell-rel/PowerShell/_packaging/powershell-net-8-early-access/nuget/v3/index.json' }
                   'net9' { 'https://pkgs.dev.azure.com/powershell-rel/PowerShell/_packaging/powershell-net-9-early-access/nuget/v3/index.json' }
                   'net10' { 'https://pkgs.dev.azure.com/powershell-rel/PowerShell/_packaging/powershell-net-10-early-access/nuget/v3/index.json' }
+                  'net11' { 'https://pkgs.dev.azure.com/powershell-rel/PowerShell/_packaging/powershell-net-11-early-access/nuget/v3/index.json' }
                   default { throw "Unknown early access feed URL: $earlyAccessFeed" }
               }
           }

diff --git a/.pipelines/templates/stages/PowerShell-Release-Stages.yml b/.pipelines/templates/stages/PowerShell-Release-Stages.yml
@@ -71,6 +71,7 @@ stages:
       IsEarlyAccess: ${{ parameters.IsEarlyAccess }}
       DOTNET_RUNTIME_VERSION: ${{ parameters.DOTNET_RUNTIME_VERSION }}
       DOTNET_SDK_VERSION: ${{ parameters.DOTNET_SDK_VERSION }}
+      EarlyAccessFeed: ${{ parameters.EarlyAccessFeed }}
       dotnetArch: 'osx-x64'
 
   - template: /.pipelines/templates/release-validate-sdk.yml@self
@@ -82,6 +83,7 @@ stages:
       IsEarlyAccess: ${{ parameters.IsEarlyAccess }}
       DOTNET_RUNTIME_VERSION: ${{ parameters.DOTNET_RUNTIME_VERSION }}
       DOTNET_SDK_VERSION: ${{ parameters.DOTNET_SDK_VERSION }}
+      EarlyAccessFeed: ${{ parameters.EarlyAccessFeed }}
       dotnetArch: 'linux-x64'
 
 - stage: gbltool
-Original file line number
+Diff line change
@@ Expand Up / @@ -13,6 +13,7 @@ parameters: @@
           - 'net8'
           - 'net9'
           - 'net10'
+          - 'net11'
       - name: ReleaseTagVar
         displayName: Release Tag
         type: string
@@ Expand Down @@