WiX v3.14.1 is the latest recommended maintenance release of WiX v3; it contains mitigations in all versions of WiX v3 for a vulnerability affecting all bundles and a WiX custom action. We recommend upgrading to WiX v3.14.1--or the latest WiX v4.0--as soon as possible.

For more information about the vulnerability, see the FireGiant blog.

Files

• wix314.exe is the installer for the WiX Toolset build tools.
• wix314exe.zip contains the wix311.exe installer inside a .zip file, useful if your IT department prevents direct downloading of .exe files.
• wix314-binaries.zip contains the files that make up the WiX Toolset and is useful if you don't want to install the toolset -- for example, if you're just checking WiX into source control.
• wix314-debug.zip contains a reference copy of the WiX source code and symbol (.pdb) files, both of which are useful when debugging problems with WiX.

WiX v3.14 is the latest recommended maintenance release of WiX v3; it contains mitigations in all versions of WiX v3 for a vulnerability affecting all bundles. We recommend upgrading to WiX v3.14--or WiX v4.0--as soon as possible.

For more information about the vulnerability, see WiX Security Releases Available.

Files

• wix314.exe is the installer for the WiX Toolset build tools.
• wix314exe.zip contains the wix311.exe installer inside a .zip file, useful if your IT department prevents direct downloading of .exe files.
• wix314-binaries.zip contains the files that make up the WiX Toolset and is useful if you don't want to install the toolset -- for example, if you're just checking WiX into source control.
• wix314-debug.zip contains a reference copy of the WiX source code and symbol (.pdb) files, both of which are useful when debugging problems with WiX.

WiX v3.11.2 is the latest recommended maintenance release of WiX v3.11; it contains mitigations in WiX v3.11 for a vulnerability affecting Microsoft.Deployment.Compression.Cab.dll and Microsoft.Deployment.Compression.Zip.dll. We recommend upgrading to WiX v3.11.2 if your code references those assemblies.

For more information about the vulnerability, see WiX v3.11.2 released.

The following bugs were fixed:

• DTF vulnerable to "Zip Slip" #6075 with fix by @robmen

Files

• wix311.exe is the installer for the WiX Toolset build tools.
• wix311exe.zip contains the wix311.exe installer inside a .zip file, useful if your IT department prevents direct downloading of .exe files.
• wix311-binaries.zip contains the files that make up the WiX Toolset and is useful if you don't want to install the toolset -- for example, if you're just checking WiX into source control.
• wix311-debug.zip contains a reference copy of the WiX source code and symbol (.pdb) files, both of which are useful when debugging problems with WiX.

WiX v3.11.1 is the latest recommended maintenance release of WiX v3.11; it contains the mitigations in WiX v3.11 for a vulnerability affecting all bundles. We strongly recommend upgrading to WiX v3.11.1 so you can ship safe bundles.

For more information about the vulnerability, see WiX v3.10.4 and v3.11.1 released.

The following bugs were fixed:

• DLL Hijack Clean Room Bundle. #5724 with fix by @robmen

Files

• wix311.exe is the installer for the WiX Toolset build tools.
• wix311exe.zip contains the wix311.exe installer inside a .zip file, useful if your IT department prevents direct downloading of .exe files.
• wix311-binaries.zip contains the files that make up the WiX Toolset and is useful if you don't want to install the toolset -- for example, if you're just checking WiX into source control.
• wix311-debug.zip contains a reference copy of the WiX source code and symbol (.pdb) files, both of which are useful when debugging problems with WiX.

WiX v3.10.4 is the latest recommended maintenance release of WiX v3.10; it contains the mitigations in WiX v3.10.3 for a vulnerability affecting all bundles. We strongly recommend upgrading to WiX v3.10.4 so you can ship safe bundles.

For more information about the vulnerability, see WiX v3.10.4 and v3.11.1 released.

The following bugs were fixed:

• DLL Hijack Clean Room Bundle. #5724 with fix by @robmen

Files

• wix310.exe is the installer for the WiX Toolset and is required for integration into Visual Studio.
• wix310exe.zip contains the wix310.exe installer inside a .zip file, useful if your IT department prevents direct downloading of .exe files.
• wix310-binaries.zip contains the files that make up the WiX Toolset and is useful if you don't need Visual Studio integration -- for example, if you're just checking WiX into source control.
• wix310-debug.zip contains a reference copy of the WiX source code and symbol (.pdb) files, both of which are useful when debugging problems with WiX.

Changes

Visual Studio 2017 and MSBuild v15

• barnson added support for building WiX with Visual Studio 2017 per issue 5484.
• robmen moved Votive from WiX to .vsix packages and its own [repo][wixvs].
• robmen updated the WiX MSBuild tasks and targets to work with the new isolated MSBuild v15 in Visual Studio 2017.
• [heaths][heaths] added support for detecting Visual Studio 2017.
• barnson fixed [bug 5535][bug5535] by ensuring TargetPath project reference variables don't get multiple identical items due to a change in Visual Studio 2017.
• barnson fixed [bug 5537][bug5537] by ensuring TargetDir project reference variables end in a backslash due to a change in Visual Studio 2017.

Burn and WixStandardBootstrapperApplication

• rickpmartin made the WixMbaPrereqLicenseUrl variable in WixNetFxExtension overridable.
• rseanhall fixed bug 4810 by ensuring the pre-req mode of WixStdBA only handles installation and help.
• hshiozawa formatted LaunchWorkingFolder in WixStdBA per the documentation.
• aleksandr-grechko fixed bug 4094 in WixStdBA to slightly better support MSI packages with DisplayInternalUI="yes".
• barnson fixed bug 4876 to keep Burn running on really old hardware.
• barnson fixed bug 5318 by updating a null check in Burn.
• jchoover fixed bug 4943 to support per-user bundle updates.
• barnson fixed bug 4933 by adding an optional loc string for Windows XP users in WixStdBA.
• robmen fixed [bug 5307][bug5307] by correctly setting SystemFolder and System64Folder Burn variables.
• [BMurri][BMurri] fixed [bug 4499][bug4499] by adding support for UI languages to WixStdBA.
• [BMurri][BMurri] implemented [issue 5285][bug5285] to add a built-in UserUILanguageID variable to Burn.
• rseanhall fixed [bug 5435][bug5435] by letting a bootstrapper application load DLLs from its own directory.
• rseanhall fixed [bug 5512][bug5512] by applying some COM interop goo to IBootstrapperApplication.OnDetectCompatiblePackage.
• rseanhall fixed [bug 5521][bug5521] by adding Microsoft.Tools.WindowsInstallerXml.Bootstrapper.ErrorType.Apply.

Extensions and custom actions

• phillHgl fixed bug 5331 by fixing the ConfigureSmbUninstall custom action to handle file share descriptions larger than 72 characters.
• nathan-alden added support for .NET Framework 4.6.2, as requested (by nathan-alden no less) in issue 5370.
• nirbar fixed bug 5217 by fixing the ConfigureUsers custom action's error checking.
• barnson fixed the CreateUser custom action's error checking.
• fyodorkor fixed bug 4956 by hiding custom action data that could contain sensitive data.
• [jabo2][jabo2] added support for icons in WixUtilExtension's InternetShortcut.
• barnson fixed [bug 5522][bug5522] by making WixUtilExtension's InternetShortcut icons optional, implementing the custom action, and adding a shortcut to wixtoolset.org so we always have a way of testing it all.

WiX native and managed SDKs

• barnson taught the DUtil function FileVersionFromStringEx to handle "vVersion" syntax.
• jchoover fixed bug 5334 by having the DUtil function BundleEnumRelatedBundle return the bundle id rather than the bundle provider key.
• rseanhall fixed [bug 4929][bug4929] by adding a limited number of retries when a log file can't be created in Burn (or any code using the DUtil PathCreateTimeBasedTempFile function).

Core toolset

• barnson fixed bug 5294 by adding a warning when reserved properties are used.
• barnson fixed bug 5306 by adding a warning when ServiceConfig is used.
• robmen fixed bug 4797 by blocking reserved file names.
• robmen fixed bugs 4812 and 4813 by properly modularizing columns in WixIisExtension tables.
• robmen fixed bug 5270 by making nullable columns nullable.
• robmen fixed bug 5438 by correcting a typo.
• woachk and rseanhall fixed the broken-because-we-don't-build-it ARM build.
• robmen fixed [bug 5265][bug5265] by adding warnings when payloads try to "escape" their cache locations.

Heat

• apmorton fixed bug 4335 in Heat's project harvester.
• sjswoboda fixed bug 5457 in Heat's performance category harvester.

Visual Studio Extension

• ddv239 fixed bug 5444 in Votive.

Localization

• piccoloaiutante added an Italian translation for strings in WixUtilExtension.
• sGeeK44 added French and Spanish translations for strings in WixUtilExtension.
• zakred added a Spanish translation for strings in WixFirewallExtension.
• MarcSchaetz added a German translation for strings in WixSqlExtension.
• ujdhesa contributed an Albanian translation for WixUIExtension.

Documentation

• MichaWiedenmann fixed bug 5210 by cleaning up WixNetFxExtension documentation.
• Daniel15 did some cleanup on WiX how-to documentation.
• NPatch added documentation for the Insignia MSBuild task.
• barnson fixed some how-to documentation per bug 4869.
• barnson added version numbers to some documentation to clarify in which versions of WiX some functionality was introduced.
• [Tiberriver256][Tiberriver256] fixed [bug 5552][bug5552] by correcting a typo in a how-to.

WiX bundle and bootstrapper application

• jchoover fixed bug 4847 by adding status information to the WiX bootstrapper application.
• barnson fixed bug 5474 by adding license.txt to the binaries .zip.
• barnson updated the splash screen for the WiX bundle.
• barnson fixed the WiX bundle's detection of the .NET 3.5.1 prerequisite.
• rseanhall fixed the WiX bootstrapper application so you don't need two clicks when one should suffice.
• barnson fixed [bug 5527][bug5527] by adding UI support in the WiX bootstrapper application for layout mode.
• rseanhall implemented [issue 5510][bug5510] by adding a hyperlink to the WiX bundle bootstrapper application.
• barnson fixed [bug 5538][bug5538] by adding the native SDK for Visual Studio 2017 to the WiX bundle.

Files

• wix311.exe is the installer for the WiX Toolset build tools.
• wix311exe.zip contains the wix311.exe installer inside a .zip file, useful if your IT department prevents direct downloading of .exe files.
• wix311-binaries.zip contains the files that make up the WiX Toolset and is useful if you don't want to install the toolset -- for example, if you're just checking WiX into source control.
• wix311-debug.zip contains a reference copy of the WiX source code and symbol (.pdb) files, both of which are useful when debugging problems with WiX.