My antivirus or driver-updater software says I need to update PowerShell Core (x64) to version 7.6.4.0. However, clicking the version takes me to a GitHub account belonging to jshigetomi instead of an official Microsoft or PowerShell download page. Is this account trustworthy, and what is the safest way to verify or install the update?
4 Answers
The account itself may belong to a legitimate PowerShell contributor, but a personal fork is not the same thing as the official PowerShell project. For software updates, use the official PowerShell repository and its release page rather than downloading from an individual fork. The updater recommending that link is the more concerning part.
An older PowerShell version can genuinely need an update because newer releases fix security vulnerabilities. That does not necessarily mean the computer is infected, but the update should come from Microsoft’s official release page or a trusted package manager—not from a random link supplied by an antivirus utility.
The simplest option on Windows is usually WinGet. You can inspect the package first with `winget show --id Microsoft.PowerShell --exact`, then update it with `winget update --id Microsoft.PowerShell --exact --source winget`. If PowerShell was installed another way and WinGet cannot update it, uninstall the old version and reinstall it through the official Microsoft-supported method.
Check the official PowerShell project at github.com/PowerShell/PowerShell and compare the release information there. Avoid downloading installers from unrelated repositories. You can also use Microsoft's official installation instructions to verify the correct package and version.
Thanks. I use Avast, so I’ll avoid that GitHub link and verify the update through the official PowerShell source instead.