Our findings that the top ten Docker images contain over 8,000 paths to vulnerabilities, coupled with the observation that for almost every dependency present in these images a vulnerabilities was added, make a strong case for using minimal base images.  

Here’s what’s new in this preview release:

• Smaller SignalR, Blazor Server, and MessagePack scripts
• Enable Redis profiling sessions
• HTTP/3 endpoint TLS configuration
• Initial .NET Hot Reload support
• Razor compiler no longer produces a separate Views assembly
• Shadow-copying in IIS
• Vcpkg port for SignalR C++ client
• Reduced memory footprint for idle TLS connections
• Remove slabs from the SlabMemoryPool
• BlazorWebView controls for WPF & Windows Forms 

• A bug is fixed in loop unroller which might lead to wrong condition codes being generated in the unrolled loop.
• Fixed a bug that caused ServiceHub.Host.CLR.x64 to stop working.
• Fixes issue in Chinese version of compiler errors C4533 and C2362 which resulted in incorrect order of string substitution for those languages.
• Improved stability of the Diagnostic Tools and Performance Profiler.
• Code generation problem causing crash with pure virtual destructor in const object
• Fixed a constant evaluation regression from 16.5 Preview 2
• Fixed an issue where MacOS couldn't be paired.
• Fixed an issue where the Diagnostic Tools while debugging and Performance Profiler fail to launch on XBox devices. 

.NET and .NET Core (and Windows!) have been getting better and better with Docker. I run Docker for Windows as it supports both Linux Containers and Windows Containers. They have both a Stable and Edge channel. The Edge (Beta) channel is regularly updated and, as a rule, gets better and better in the year I've been running it. 

CommunityToolkit/dotnet: .NET Community Toolkit is a collection of helpers and APIs that work for all .NET developers and are agnostic of any specific UI platform. The toolkit is part of the .NET Foundation. 

A Microsoft exec has warned that Internet Explorer is a ‘compatibility solution’ and should only be used selectively. Preaching to the choir here, and this is, we suspect, the very end of IE's long story for us.

Here are some of the reasons why nullable reference types are less than ideal:

• Invoking a member on a null value will issue a System.NullReferenceException exception, and every invocation that results in a System.NullReferenceException in production code is a bug. Unfortunately, however, with nullable reference types we “fall in” to doing the wrong thing rather than the right thing. The “fall in” action is to invoke a reference type without checking for null.
• There’s an inconsistency between reference types and value types (following the introduction of Nullable<T>) in that value types are nullable when decorated with  “?” (for example, int? number); otherwise, they default to non-nullable. In contrast, reference types are nullable by default. This is “normal” to those of us who have been programming in C# for a long time, but if we could do it all over, we’d want the default for reference types to be non-nullable and the addition of a “?” to be an explicit way to allow nulls.
• It’s not possible to run static flow analysis to check all paths regarding whether a value will be null before dereferencing it, or not. Consider, for example, if there were unmanaged code invocations, multi-threading, or null assignment/­replacement based on runtime conditions. (Not to mention whether analysis would include checking of all library APIs that are invoked.)
• There’s no reasonable syntax to indicate that a reference type value of null is invalid for a particular declaration.
• There’s no way to decorate parameters to not allow null.