WiX v7.0.1 is now available

Every Patch Tuesday, we look at the CVEs that Microsoft releases fixes for to see if any affect us—personally or professionally. Almost always, the answer is 'no.' But this month, the answer is 'yes.' It's not an actual vulnerability in WiX, but an affected assembly ships in WixToolset.Sdk, so we're releasing WiX v7.0.1 to avoid it.

WiX v7.0.1 is now available!

We are releasing WiX v7.0.1 in response to a security release in a .NET assembly that WiX includes. It turns out WiX doesn’t expose the vulnerability and, in fact, doesn’t even need the vulnerable assembly. WiX v7.0.1 avoids the vulnerable assembly and also includes the following fixes for customers:

Add the -nohardlinks switch to prevent WiX from using hard links to copy files during the build process. Copying files instead of using hard links can significantly add to build times for large payloads but some build systems get confused without physical copying.
Don’t complain about duplicate layout names in a bundle build if the payloads are identical files. The WIX8004 error was added in WiX v4 to prevent accidentally overwriting commonly-named files and breaking a bundle install. But if the files being laid out are identical, the bundle will install successfully, so WIX8004 is not an accurate error.

You can get the latest WiX MSBuild SDK, WiX .NET tool, or every last bit from the GitHub release.

Get started

Get started with an SDK-style .wixproj project:

<Project Sdk="WixToolset.Sdk/7.0.1">
</Project>

and simple package code in a .wxs file:

<Wix xmlns="http://wixtoolset.org/schemas/v4/wxs">
    <Package Id="Acme.HelloWorld" Name="HelloWorld" Version="7.0.1" Manufacturer="Acme">
        <Files Include="*" />
    </Package>
</Wix>

and run

dotnet build

to build it.