WixToolset and maven updates

[yura-kit]

Hi, we are currently using org.wixtoolset:wix-toolset from the Maven repository.
Due to a new vulnerability, how can we switch to version 4.0.4?
It seems that version 4.0.4 is not available in the Maven repository.
https://mvnrepository.com/artifact/org.wixtoolset/wix-toolset

[robmen]

You'll need to talk to the keepers of the Maven repository. We don't maintain those.

[chrpai]

If you look at the 3.11 version you'll see a couple Maven devs (one with an email) who you probably want to talk to. FWIW, wix 4/5 probably doesn't need to be in maven since really all you need to do is use dotnet to install them. The latest 3.14.1 is what you probably want to ask them to include. It's not radically different like 4/5 is so it should be easier for them to oblige you and much less backwards compatibility changes.

[yura-kit]

Does the latest 3.14.1 contains fix for CVE-2024-24810?
Thank you for your quick answer!

[chrpai]

If you read the link you posted you'll see it was fixed in 3.14.0 so yes 3.14.1 contains it also.