Microsoft Pumps Out Weekly VS 2022 Previews, Open Sources SBOM Tool

As July winded down, Microsoft started pumping out weekly previews of Visual Studio 2022 v17.3, along with open sourcing a tool to generate a software bill of materials (SBOM), instrumental to government cybersecurity best practices guidance.

Since the dev team gave the Microsoft Teams Development Tools (Teams Toolkit) an overhaul in v17.3 Preview 3 on July 12, the pace has quickened with weekly updates that just tweak and fix things. In fact, after the first three previews shipped two or three weeks apart, Microsoft has since pushed out three previews in 14 days as things get polished up for an expected August GA debut.

The release notes for this week's Preview 5 included these items:

  • Fixed a crash in the dialog that prompts users to sign in on first launch and when an upgrade requires an account to be reauthenticated.
  • Updated the side by side Dev 16.11 C++ Toolset to version 14.29.30145.00. The latest version of the Dev 16.11 C++ Toolset contains important bug fixes, including fixing all remaining C++20 defect reports. For information about bug fixes, including C++20 defect reports in Dev 16.11, please see

The update also fixed four items reported by users on the Developer Community feedback site.

Preview 4 featured some .NET MAUI servicing updates and several fixes:

  • Fix for an issue causing WinForms designer launch to fail for .NET projects on ARM64 machines.
  • Fixes the contrast between the background color and a hyperlink in a dialog.
  • Improve translation of text in first launch sign in dialog.
  • Fixed a bug where Top Insights in the CPU Usage tool were not being localized

As versions 17.0 through 17.2 shipped roughly three months apart, with the latter landing May 10, v17.3 will probably arrive within the next few weeks.

SBOM Generation Tool
Meanwhile, July saw Microsoft open source its software bill of materials (SBOM) generation tool. The U.S. government defines an SBOM as a list of ingredients that make up software components.

A Generated SBOM
[Click on image for larger view.] A Generated SBOM (source: Microsoft).

It figures prominently in President Joe Biden's Executive Order on Improving the Nation's Cybersecurity that was issued last year, directing agencies to take security measures such as advancing the move to Zero Trust.

The order dictated that the government produce best practices guidance including standards, procedures or criteria regarding "providing a purchaser a Software Bill of Materials (SBOM) for each product directly or by publishing it on a public website," along with many other actions.

"Our SBOM tool is a general purpose, enterprise-proven, build-time SBOM generator," Microsoft said earlier this month in an engineering blog post. "It works across platforms including Windows, Linux, and Mac, and uses the standard Software Package Data Exchange (SPDX) format."

That SPDX specification provides the foundation for the four main SBOM sections of the open source tool:

  • Document creation information: General information about the SBOM document, such as software name, SPDX license, SPDX version, who created the document, when it was created, etc.
  • Files section: A list of files that compose the piece of software. Each file has some properties including the hashes of its content (SHA-1, SHA-256).
  • Packages section: A list of packages used when building the software. Each package has additional properties such as name, version, supplier, hashes (SHA-1, SHA-256) and a Package URL (purl) software identifier.
  • Relationships section: A list of relationships between the different elements of the SBOM, such as files and packages.

"Open sourcing our SBOM tool is an important step towards fostering collaboration and innovation within our community, and we believe this will enable more organizations to generate SBOMs as well as contribute to its development," Microsoft said.

About the Author

David Ramel is an editor and writer for Converge360.

comments powered by Disqus


  • AI for GitHub Collaboration? Maybe Not So Much

    No doubt GitHub Copilot has been a boon for developers, but AI might not be the best tool for collaboration, according to developers weighing in on a recent social media post from the GitHub team.

  • Visual Studio 2022 Getting VS Code 'Command Palette' Equivalent

    As any Visual Studio Code user knows, the editor's command palette is a powerful tool for getting things done quickly, without having to navigate through menus and dialogs. Now, we learn how an equivalent is coming for Microsoft's flagship Visual Studio IDE, invoked by the same familiar Ctrl+Shift+P keyboard shortcut.

  • .NET 9 Preview 3: 'I've Been Waiting 9 Years for This API!'

    Microsoft's third preview of .NET 9 sees a lot of minor tweaks and fixes with no earth-shaking new functionality, but little things can be important to individual developers.

  • Data Anomaly Detection Using a Neural Autoencoder with C#

    Dr. James McCaffrey of Microsoft Research tackles the process of examining a set of source data to find data items that are different in some way from the majority of the source items.

  • What's New for Python, Java in Visual Studio Code

    Microsoft announced March 2024 updates to its Python and Java extensions for Visual Studio Code, the open source-based, cross-platform code editor that has repeatedly been named the No. 1 tool in major development surveys.

Subscribe on YouTube