Complete release notes for WiX Toolset 5.0.0

[InkogNitO4all]

Hi,

due to the vulnerabilities found in version 4, we are currently under an extensive documentation obligation.

Unfortunately, no complete release notes for version 5.0.0 can be found. This raises the question during security audits as to whether the vulnerabilities have been fixed in version 5.0.0. The entries always refer to version 5.0.0-rc.X, but unfortunately it is not explicitly clear that version 5.0.0 is based on the rc variants.

It may sound a bit meticulous, but could you confirm that version 5.0.0 includes the fixes for the vulnerabilities (5.0.0-rc.1 and 5.0.0-rc.2) and that the releases build on each other?

Many thanks!

[robmen]

For customers with FireGiant support contracts, we provide previews and details about security issues under the contract terms.

For consumers of the Open Source project, the source code is provided "AS IS" so you can support yourself.

[InkogNitO4all]

Thank you for the interesting answer. I fully understand the approach, however, providing release notes for a binary variant provided by you is not part of a support contract for me.

However, if I sign a support contract, will you provide me with more comprehensive release notes? In which point of the support contract is this service included?

[robmen]

A support contract changes your relationship with the WiX Toolset. You become a customer, not just a consumer.

One of the key benefits of being a customer is that you get detailed answers to your questions. For example, if the release notes are not detailed enough, you can ask for more specifics about the changes included, and additional details will be provided. Another benefit is that if you hit a bug in the WiX Toolset, a fix will be made available to you. There are additional benefits like a yearly code review and access to all the FireGiant tools included as well. Finally, you are also funding the people who maintain the WiX Toolset.

In other words, you get to treat the WiX Toolset like a product instead of an OSS project.