cisagov / ScubaGear

Automation to assess the state of your M365 tenant against CISA's baselines
https://www.cisa.gov/resources-tools/services/secure-cloud-business-applications-scuba-project
Creative Commons Zero v1.0 Universal
1.6k stars 217 forks source link

Test and update MS Graph PowerShell SDK module - v2.15.0 #930

Closed schrolla closed 7 months ago

schrolla commented 7 months ago

💡 Summary

Dependent module msgraph-sdk-powershell has released a new version v2.15.0 with a number of bug fixes. Test the new version for compatibility with ScubaGear and update compatible versions based on the results.

Motivation and context

The MS Graph SDK is used for interacting with several M365 services. The previous version (2.13.0-2.14.1) contained a bug that made it incompatible with ScubaGear. This new version is supposed to resolve that bug. Updating the versions supported by ScubaGear will make sure it has the latest available features and capabilities for querying M365 services.

Implementation notes

Please provide details for implementation, such as:

Acceptance criteria

How do we know when this work is done?

BohrenAn commented 7 months ago

The Microsoft.Graph and Microsoft.Graph.Beta Modules are updated about every two weeks. I don't think it's useful to limit it to 2.15.0

I propose to set it to (pass unless a new major Version is released) MaximumVersion = [version] '2.99.99999'

Kind Regards Andres

schrolla commented 7 months ago

The Microsoft.Graph and Microsoft.Graph.Beta Modules are updated about every two weeks. I don't think it's useful to limit it to 2.15.0

I propose to set it to (pass unless a new major Version is released) MaximumVersion = [version] '2.99.99999'

Kind Regards Andres

ScubaGear had taken this approach previously to allow the required dependency version to "float". Unfortunately, it led to compatibility issues with the MSGraph module when minor version releases introduced unexpected results that impacted ScubaGear functionality. Pinned versions help ensure that ScubaGear continues to function, while updated module dependencies are addressed after testing confirms that the newer module version is still compatible.

crutchfield commented 7 months ago

I tend to agree with implementing version to 2.99.9999 since that was my initial implementation. However, until we implement better mechanisms to rapidly detect and address breaking module changes I am going with pin major and minor and let the patch float. We can address further in the future.