[vartaxe]

Summary

• Add Windows 11 26H2 (26300) and 26H1 (28000) recognition, with validated DisplayVersion fallback for future releases.
• Add opt-in virtual-machine driver deployment while retaining default VM rejection, with guarded VMware, Hyper-V, Parallels, Nutanix AHV, VirtualBox, QEMU/KVM, and Xen/Citrix detection and explicit virtual-package labels.
• Improve OEM and package matching for Panasonic, Fujitsu null-SKU systems, Arm64 fallback packages, exact SKU tokens, XML deployment modes, and bracketed model values.
• Fix DriverUpdate exit propagation, PreCache archive behavior, WIM duplicate processing/cleanup, and DISM quoting/logging.
• Remove privileged runtime PowerShell Gallery module installation and replace permissive TLS validation with direct OAuth acquisition and temporary exact leaf-certificate pinning.
• Prohibit XML DTD/external entity resolution and fail closed for ambiguous or unsupported DriverPackage.* archive layouts.
• Add a standalone Windows PowerShell regression suite and current ADK/WinPE, VM servicing, Secure Boot, and AdminService security guidance.

Validation

• Windows PowerShell 5.1 parser: passed.
• tests/Invoke-CMApplyDriverPackage.Tests.ps1: passed.
• PSScriptAnalyzer: 0 errors; remaining warnings/information are established Windows PowerShell 5.1 compatibility/style findings.
• git diff --check: passed.
• Independent post-fix security review: no vulnerabilities found.
• Cross-checked against current Microsoft Windows 11 release information, Windows ADK downloads, Configuration Manager ADK support, AdminService HTTPS guidance, and Microsoft identity ROPC limitations.
• Reviewed all 79 upstream forks and their unique commits; incorporated the only additional current, bounded improvements (Parallels and Nutanix AHV detection) and rejected obsolete or superseded variants.

Scope notes

The VM opt-in supports extracted INF driver packages only; guest-tools installers, VM firmware, host servicing, and Secure Boot certificate rotation remain separate lifecycle operations. Physical-vendor BIOS and firmware orchestration also remain outside this driver-package script.

This update includes fixes corresponding to #328, #332, #334, and #342.

[Copilot]

Copilot review overview

🟡 Changes recommended

Parallels VM detection is incomplete, documentation is missing, and the additional OS support and version banner need reconciliation.

Review effort: Balanced
Findings: 1

Open (1)

• Document and validate Windows 11 26H2 support separately · New

What changed in this PR

Adds opt-in virtual-machine driver package support while retaining default VM rejection.

Changes:

• Adds -AllowVirtualMachine and VM-specific package filtering.
• Filters primary and fallback package results.
• Also adds Windows 11 26H2 support.

File	Description
Invoke-CMApplyDriverPackage.ps1	Adds VM detection/filtering and Windows 11 26H2 mappings.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.