I have been evaluating the new merge modules that come with VFP9 (and am using them with Installshield 5.0 full version). My observations:

Vfp9Runtime.msm - no issues.

VFP_GDIPlus.msm – this contains a version of gdiplus.dll (5.1.3102.1360) that addresses the security vulnerability reported in 2004 and is a dependency of Vfp9Runtime.msm (i.e. it cannot be de-selected). It should installed its dll in either the application folder or C:\Program Files\Common Files\Microsoft Shared\VFP folder. The trouble is (a) this msm does not do this and (b) it has been authored in such a way that you cannot access the properties dialog to change the destination folder.

VC_User_CRT71_RTL_X86_---.msm – this contains a copy of msvcr71.dll (7.10.3052.4) and is a dependency of Vfp9Runtime.msm (i.e. it cannot be de-selected). Microsoft’s KB article 326922 says it should be installed in the application folder. (C:\Program Files\Common Files\Microsoft Shared\VFP folder would probably also be fine.) Again the default destination appears to be neither of these locations, but luckily you can access the properties dialog to change the destination folder to, say, [INSTALLDIR].

msxml3_wim32.msm & msxml3inf_wim32.msm – these new packages put the msxml3 runtimes on your system. Two problems: (i) they are installed into the application folder instead of the winsys folder where they should go and (ii) they are NOT removed on uninstall as they should be. Luckily the regular old msxml3.msm appears to do the trick and to behave properly (I think).

I am still testing - any comments?
John Burton