How long will WiX v3 be supported?

[ArmorBearer]

I was searching for some post here about the projected End of Life (EOL) for WiX version 3, but I didn't find it. Is there a timeline about this? Or will v3 no longer be supported now that v4 is out...?

In our group we have 3 active versions of our code:

Long-term new development - installation hasn't even been thought about, yet
Near-term new development - installation will use WiX v4
Distributed version maintenance - installation uses WiX v3, and there is no plan to upgrade

We could easily be supporting our distributed version for another year. Therefore, if there is a report of a problem in that version, we will need to rebuild our software and create a patch. If the change turns out to be more extensive, we might need to build a new base installer, but that's rare.

The question is, will WiX v3 continue to be supported for another year, or is that already gone, or...?

[robmen]

These are all very good questions that deserve very clear answers.

I have been drafting those answers in my head for a while but shipping WiX v4 and everything surrounding that has been front of my mind. So, here are the current drafts of answers to your questions. The direction/sentiment is pretty set, even if I don't have all the best words to describe it yet (which means it'll get long). Feel free to ask questions on parts that are confusing.

Here for the Users

Quick aside: when I use the words "this" or "here", I mean specifically:

1. https://wixtoolset.org/
2. https://github.com/wixtoolset/
3. https://www.youtube.com/wixtoolset
4. (deprecated) wix-users/wix-devs mailing lists.

First and foremost, this is an Open Source project. This is a community focused on developing tools for "doing installation stuff". The people answering questions here do so voluntarily.

A User is one of the tens of thousands of people using the project without contributing to the community. This is fine. A User can use what is provided for free (while adhering to the license). A User can also contribute bug reports or feature ideas or ask for help here. But there are no guarantees made to Users. As a User, there is no support.

Quick aside: entitled Users are not welcome in this community. As a User, any rude and/or demanding behavior of those who contributed hundreds of thousands of lines of code, documentation, and answers will be called out as unacceptable.

So, how does one get support?

There are two different routes.

First, you can become a Member of the community. Members contribute to the community regularly enough that they become known. That may happen through solid code contributions. That may happen by answering many questions here. That may happen by regularly participating in WiX Online Meetings and providing feedback on topics covered there. Members naturally get more attention when they need help because they help others in the community.

Second, you can become a Customer. You pay for a contract that guarantees support. FireGiant offers support programs. FireGiant uses that money to pay its employees (like me!) to respond to your questions and fix your bugs on demand. FireGiant also uses that money to pay its employees (like me!) to spend time on WiX, which turns into new features that make everyone's life better.

Members and Customers move the WiX Toolset forward most.

Finally, answering the questions asked

So, let me talk about WiX v3 and WiX v4, and WiX v5 "support" since they are all at different points in their lifecycle.

WiX v3, all work done since WiX v3.11.0 (2017) was supported by FireGiant customers as community development was focused on WiX v4 (for a long, long, long time). If you depend on WiX v3, then you indirectly benefit from Customers of FireGiant's support program today, and (in my completely biased opinion) you should also consider supporting FireGiant by purchasing a support contract.

WiX v4 was released a few weeks ago. Despite six months of previews/release candidates being available for testing, a few serious bugs slipped through. So we will release a WiX v4.0.1 in the next six weeks but there are no plans to do another community release. Note, FireGiant already offers support for WiX v4.

For WiX v5, our goal is to NOT repeat the insanely long development times of previous WiX versions. Thus we are moving to a yearly release cadence similar to .NET. The plan is for 8 or 9 months of development time with 3 or 4 months of release candidates. This will be our focus for the next year.

What does this really mean?

The Open Source project is about moving forward. The people doing work here do so because they like building and talking about tools for "doing installation stuff". There is a lot of stuff to do. That does NOT mean we're going to ignore bugs in the project. As a community, we triage issues, and important issues are scheduled for the next release (today, that's WiX v5).

tl;dr

If you want to treat the WiX Toolset like a product with support, become a Customer.

Alternatively, consider regularly contributing to become a Member of the WiX Toolset, so when you need help, you are known to the community and thus more likely to get your questions answered.

Otherwise, you are a User using the Open Source project for free. Be respectful of the volunteers offering their expertise. If you hit an issue, provide a detailed bug report with a small repro to increase the chances the issue is picked up. Then get the issue approved and fix it yourself for a future release, or hope that someone takes an interest in it so it gets into a future release, or hold out hope that an existing Customer reports the same issue as you and it gets fixed sooner.

--

Feedback appreciated. I will refine this content and find a more public place for it soon.

[ssrmm]

Feedback appreciated. I will refine this content and find a more public place for it soon.

@robmen Has this happened yet? I couldn't find anything at least.

I'm also not entirely sure how to interpret the above. So I'll just ask the specific question that led me to this topic: Assuming there were a security issue to be found in the WiX toolset, for which of these cases would a security patch be made available?

• WiX v3 for FireGiant support customers
• WiX v3 publicly
• WiX v4 for FireGiant support customers
• WiX v4 publicly

And as a followup-question: If security patches were provided for WiX v3 (publicly or not), is there an end-date after which new patches won't be provided anymore?

The answers to that become increasingly more important due to upcoming security regulations like the Cyber Resilience Act,

[robmen]

I have not written more than this yet. I was waiting for additional feedback and the final decision on when exactly to officially declare WiX v3 unsupported. Now, to your questions.

First, security fixes in general:

1. FireGiant signs support contracts with customers. There are contract clauses about how bug fixes (including security fixes) are handled.
2. There are no guarantees made by the open source project. FireGiant does contribute significantly to the open source project. For example, it pays the salaries of the people who maintain the WiX toolset (but not just to maintain the project). So, it is likely a security fix at FireGiant would flow into the open source project. However, I want to be clear that there are no guarantees outside the MS-RL.

Second, security fixes for WiX v3:

1. FireGiant will decide how long they support WiX v3 based on their customer requirements. That isn't to suggest FireGiant will necessarily support WiX v3 forever, but I expect FireGiant support will outlast open source support.
2. As I noted above, we haven't decided when to declare WiX v3 unsupported officially, but I expect it will be a day in 2024. At that time, we'll archive the wix3 project and (over time) close any WiX v3-specific issues.

Finally, I've not read any CRA drafts, but based on some early discussions by open source legal people much smarter than me, it sounds very dire. On one extreme, I saw it suggested that open source licenses might need to be amended to no longer allow use in the EU. If that happens, then I'm sure FireGiant will find a way to continue supporting its EU customers.