diff --git a/SacsStandardBase/SacsStandardBase.csproj b/SacsStandardBase/SacsStandardBase.csproj index 7a1e0cb..174e3cd 100644 --- a/SacsStandardBase/SacsStandardBase.csproj +++ b/SacsStandardBase/SacsStandardBase.csproj @@ -7,7 +7,7 @@ - + diff --git a/docs/component-reviews.md b/docs/component-reviews.md index 9e55b6b..de843c8 100644 --- a/docs/component-reviews.md +++ b/docs/component-reviews.md @@ -7,7 +7,7 @@ table td { } -Last updated: 2026-09-11 +Last updated: 2026-09-12 | Component | Scope | Status | Date reviewed | Next steps | Notes | |---|---|---|---|---|---| @@ -15,5 +15,5 @@ Last updated: 2026-09-11 | `SacsMobileXamarin` | Migration disposition | Isolated; retained for reference | 2026-09-10 | Keep outside the supported build unless a separately scoped resurrection or migration is approved. | Source is unchanged and available through `SaCommonVS.LegacyXamarin.sln`; see `docs/legacy-xamarin.md`. | | [`SacsMobileMaui`](../SacsMobileMaui/docs/component-reviews.md) | Project | .NET 10 migration complete; tracked in project docs | 2026-09-11 | Validate Apple targets on a Mac and continue API cleanup in the project tracker. | The shared project and both active mobile consumers target .NET 10. Windows runtime smoke tests pass, and Windows and Android Debug builds complete with zero errors. | | `SacsStandardBase/Base/Procs/SaProcess_Base.cs` | Class | In progress | 2026-09-09 | Complete the Process Base actions recorded in `topics.md`; review derived processes separately for cooperative polling. | Lifecycle state ownership and cancellation lock ordering were changed. Five focused tests pass. Remaining concerns include mixed sync/async execution, durable cancellation outcome, cancellation exception handling, disposal, and status synchronization. | -| `SacsStandardBase/Base/Email/SaEmailConsole.cs` | Class | Dependency upgrade in progress; security action also required | 2026-09-11 | Upgrade MailKit/MimeKit against the new characterization tests. Separately restore SMTP certificate validation and require the configured TLS mode. | Message construction is now testable without SMTP and covered for addressing, bodies, attachments, content IDs, default filenames, and tags. The current SMTP client still accepts every server certificate. | +| `SacsStandardBase/Base/Email/SaEmailConsole.cs` | Class | Dependency upgrade complete; security action still required | 2026-09-12 | Separately restore SMTP certificate validation and require the configured TLS mode. | MailKit and MimeKit 4.17.0 pass the Common and downstream validation suites without vulnerability warnings. Message construction is covered for addressing, bodies, attachments, content IDs, default filenames, and tags. The current SMTP client still accepts every server certificate. | | `SacsStandardBase/Base/Helpers/SacsEncryptionHelper.cs` and `SacsStandardBase/Base/Data/SacsAesIvCrypter.cs` | Classes | Reviewed; action required | 2026-09-08 | Design a versioned authenticated-encryption format with legacy migration and tamper tests. | Current CBC encryption is unauthenticated; password-based key derivation uses a fixed salt and low iteration count. | diff --git a/docs/topics.md b/docs/topics.md index b5cd294..bdcad62 100644 --- a/docs/topics.md +++ b/docs/topics.md @@ -7,7 +7,7 @@ table td { } -Last updated: 2026-09-11 +Last updated: 2026-09-12 ## Prioritised Topics to Be Actioned @@ -38,7 +38,6 @@ Last updated: 2026-09-11 | Priority | Topic | Date noted | Date started | Next step | Notes | |---|---|---|---|---|---| -| P1 | Update vulnerable MailKit and MimeKit dependencies | 2026-09-10 | 2026-09-11 | Run the new email characterization tests, then select a patched compatible MailKit release and validate Common plus downstream consumers. | MailKit 4.13.0 and its MimeKit 4.13.0 dependency report `NU1902`. Focused tests now cover message addressing, text and HTML bodies, ordinary and inline attachments, default filenames, content-ID formatting, and dynamic tags without contacting an SMTP server. | | P1 | Review and harden `SaProcess_Base` lifecycle and cancellation | 2026-09-08 | 2026-09-08 | Address the prioritised Process Base findings above, beginning with prevention of mixed synchronous/asynchronous execution. | Task ownership, timeout retention, cancellation lock ordering, documentation, and initial lifecycle tests are complete. Cooperative polling in individual derived processes will be handled separately. | ## Completed Topics @@ -53,3 +52,4 @@ Last updated: 2026-09-11 | Isolate `SacsMobileXamarin` from the supported Common build | 2026-09-10 | 2026-09-10 | 2026-09-10 | Removed the project from `SaCommonVS.sln` while retaining all source. Added `SaCommonVS.LegacyXamarin.sln` and `docs/legacy-xamarin.md` for reference-only access. The project is outside the supported .NET 10 migration scope. | | Prepare Common libraries for the coordinated .NET 10 migration | 2026-09-10 | 2026-09-10 | 2026-09-10 | `SacsStandardBase`, `SacsStandardDbas`, `SacsStandardProc`, `SacsCoreWeb`, `SacsStandardAccounts`, and `SacsCoreUnitTests` now target `net8.0;net10.0`. The supported solution builds both targets with no errors; 94 of 94 tests pass on each target. BusinessMgr continues to build successfully on .NET 8 against the temporary compatible outputs. New .NET 10 warnings are tracked separately. | | Complete the Common .NET 10 migration | 2026-09-10 | 2026-09-11 | 2026-09-11 | Removed the temporary .NET 8 targets from all supported non-MAUI libraries and tests. The full supported solution restores and builds with zero errors, and 94 of 94 tests pass on .NET 10. BusinessMgr rebuilds successfully with 8 of 8 Control and 13 of 13 Portal tests passing; Sandtrap and Sandalwood build successfully for Windows and Android. The isolated Xamarin reference project remains unchanged on .NET 8. | +| Update vulnerable MailKit and MimeKit dependencies | 2026-09-10 | 2026-09-11 | 2026-09-12 | Updated the direct MailKit dependency from 4.13.0 to 4.17.0, which resolves MimeKit 4.17.0. NuGet reports no vulnerable packages for `SacsStandardBase`; the Common solution builds with zero errors and 101 of 101 tests pass. BusinessMgr builds with 8 of 8 Control and 13 of 13 Portal tests passing; Sandtrap and Sandalwood build successfully for Windows and Android. |