5.6.0 installer downgrades vcruntime DLLs
The 5.6.0 installer includes ancient versions of vccorlib140.dll and vcruntime140.dll. After installing, these versions replace whatever previously existed in system32. I have not looked too closely, but I suspect that since they were built in early 2018, they may have acquired a few CVEs. Also, there may be compatibility issues with software built for the 2017 or 2019 runtimes suddenly encountering a 2015 version (although I have not been able to find one yet).
Running the current vcredist installer does not restore the current versions; an explicit repair of the installed package is required.
I have two suggestions for fixing this:
-
Instead of using the merge modules, include the latest vcredist package and run it as part of the installation. This will avoid downgrading shared components.
-
Do not set REINSTALLMODE=amus (reinstall "a"ll files) in tortoisehg.wxs. The default value of this property is "omus", i.e. overwrite only "o"lder files. From the repo history it is not clear why this property is being set this way. It is definitely a bad idea.