The 1.6.3 (1.6.241114003) installers contain binaries built from older source code

[nickkhyl]

Describe the bug

The most recent stable Windows App SDK installers (1.6.3 / 1.6.241114003) appear to be built from code older than the corresponding tag / GitHub release.

As an example, the installed MRM.dll does not include the buffer overrun fix, is still causing crashes, and appears to be built from this commit in the release/1.6-stable branch rather than the v1.6.3 tag.

Steps to reproduce the bug

1. Download and install the most recent stable Windows App SDK 1.6.3.
2. Check the version, Authenticode timestamp, or commit hash of the MRM.dll in the package directory (e.g., C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.6_6000.318.2304.0_arm64__8wekyb3d8bbwe).
3. Run an app that uses it, and you'll encounter a crash that was supposed to be fixed. If you're lucky and it doesn't crash immediately, use Application Verifier with a debugger attached.

Expected behavior

1. The MRM.dll and other binaries included in the 1.6.3 (1.6.241114003) SDK are built from the 1.6.3 source code.
2. The app doesn't crash.

Screenshots

No response

NuGet package version

Windows App SDK 1.6.3: 1.6.241114003

Packaging type

Unpackaged

Windows version

No response

IDE

Visual Studio 2022

Additional context

No response

[tpoint75]

I recently noticed that all these runtime installers have a wrong version number btw.