Hello,
We are currently using version 4.0.6. Is it mandatory for us to upgrade to 4.1.7?
Are there any truly critical security vulnerabilities that should not be overlooked?
Or are these mainly issues related to certain bugs, meaning that upgrading to 4.1.7 is not essential in our situation?
Thank you for your assistance.
Whether you upgrade should be down to your own assessment of the risks.
There are major security enhancements in version 4.1.x that may sway your decision to move to a newer, better version.
The most obvious security enhancement is to stop using ServiceUI.exe (usually used when you want to run the install in the SYSTEM context to show dialogs or messaging to the user(s) logged onto the machine).
ServiceUI is a great tool, but using it to deploy applications can run the risk of your users being able to interrupt the Installation / PowerShell process and gaining elevated rights to perform actions they should not have rights to do - i.e. Your security risk.
To help guide your decision(s), you can read all the release notes for v4.1.0 to 4.1.5 here:
N.B. Release Notes for 4.1.6 are here: Release PSAppDeployToolkit 4.1.6 · PSAppDeployToolkit/PSAppDeployToolkit · GitHub
and 4.1.7 are here: Release PSAppDeployToolkit 4.1.7 · PSAppDeployToolkit/PSAppDeployToolkit · GitHub
Ok thank's for your answer 
Just to extend on what's been said, there's no known security flaws or issues with 4.0.x, however the usage of ServiceUI with any version of the toolkit, while a means to an end, is not great from a security standpoint because you're presenting UI elements running as SYSTEM to the user.
If you're not using ServiceUI, maybe this isn't a problem for you, but as a developer I'm interested to know why you wouldn't move to the current release?
Because if my environment requires updating all packages from version 4.0.6 to 4.1.X, it becomes complicated in my banking environment where security is essential.
There is a procedure that must be followed, and it takes time. This is why I want to be absolutely certain before moving forward with the implementation of this project.embarking on this project.
So if you need to package a new application, you will use v4.06?!?
I would not go back and redo all of the prior packages as that seems a bit silly from my perspective. Banking, Medical, and other corporations all see security as essential.
However, as a security conscious organization, once you know of a vulnerability of any kind within your organization, you should evaluate what your response to that will be.
I would like to point out, the older version of PSAppDeployToolkit did not ship with ServiceUI Either. If that is in place in your environment, then it is a vulnerability you or your teams added. However, the use of ServiceUI was extremely widespread as it was required for any notifications of any kind to the logged on user from a system based install. The new version simply does that without requiring ServiceUI. So on that note, it is more of a feature addition to the product than a vulnerability remediation as that vulnerability wasn't coming directly from the toolkit.
I would however move all future packaging or repackaging of old software to the newer version.