When not to run automatic updates

Tuesday, February 13th, 2007

Automatic Update to Visual Studio 2005 Service Pack 1 may break your installs

As you probably know Microsoft are pushing their Windows Update service - actually now called Microsoft Update - primarily to ensure that your computer is updated to most secure environment possible.

However Microsoft have for the first time ever pushed - via the Microsoft Update service - an update to a development tool - namely the Microsoft Visual Studio 2005 Service Pack 1 (VS2005SP1). If you have Visual Studio 2005 installed and you have tuned Microsoft/Windows Updates on automatically you may already have VS2005SP1 on your computer.  You can go into the About box and see whether the service pack has been applied.

What does this mean for you?

Well as a developer you probably know that to ensure proper development/testing environment you must absolutely be sure what you build/compile with - what versions of compilers are you using and what do you link to with respect to runtime libraries - those should fit - ultimately - to your customers/end-users target environment.

However the VS2005SP1 is not backward compatible with previous C++/MFC runtime libraries so when you compile your applications using VS2005SP1 or with any of the underlying compilers (e.g. the C++ compiler cl.exe) it will actually generate manifests that require that you redistribute the proper new updated runtime libraries. So do you necessarily know that or want that?

No - you want to keep control of your environment - and that is why the automatic update to VS2005SP1 is a very dangerous thing for Microsoft and I expect that they will receive a lot of heat for that.

The quick solution is that your install programs must include new updated merge modules which will redistribute the new runtime libraries. If you build from inside VS2005 this may already be the case because your installs may include the proper merge modules - however not necessarily. You must be sure that it does.

If you have a customer base running your VS2005 build applications you may not easily be able to reproduce problems reported by your customers because your VC2005 is automatically updated (may be even quietly/secretly behind your back) to VS2005SP1 - not an ideal situation.

Sorry Microsoft but making VS2005SP1 available from Microsoft Update was not a wise decision.

Updated February 14th, 2007 with additional links:

• Aaron Stebners blog: Does an application built in VS 2005 SP1 require deploying the SP1 VC runtime files?
• Aaron Stebners blog: Visual Studio 2005 SP1 failures can break existing applications
• Aaron Stebners blog: Updated VC 8.0 runtime redistributable packages are included in Visual Studio 2005 SP1

Updated July 11th, 2007: An lesson learned here after approximately half-a-year later is actually that the automatic update indeed forced all - and I mean all - developers to update. Basically the problem only occurred in a very short time span - and until we upgraded own installs. Interesting way to force updates of software. I reckon that we will see some more on this. But it will piss of people (at least for a couple of days).