Common-VS2019/docs/component-reviews.md

Component Review Register

<style> table th, table td { vertical-align: top; } </style>

Last updated: 2026-09-16

Component	Scope	Status	Date reviewed	Next steps	Notes
SacsStandardBase/Base/Utils/AssemblyUtil.cs	PE/COFF timestamp utility	Hardened and covered	2026-09-16	Retain the focused tests; use the non-throwing TryGetBuildDateTime API where an unavailable timestamp must be distinguished from DateTime.MinValue.	Exact primitive reads replace unchecked partial reads and marshaling. Five tests cover a known timestamp, invalid signature, truncated input, a loaded assembly, and null input. COFF timestamps are not presented as reliable physical build times for deterministic builds. Existing framework APIs already cover assembly identity, version, and metadata, so no duplicate convenience wrappers were added.
SaCommonVS.sln	.NET 10 migration build and tests	Migration complete; passing with warnings	2026-09-16	Continue the staged package review with the remaining framework-aligned and separately tested major updates.	All supported projects target .NET 10 only. The completed package and utility updates pass the complete validation. The solution builds with zero errors and all 185 tests pass; BusinessMgr builds with 15 Control and 13 Portal tests passing. Xamarin remains isolated and unchanged.
SacsStandardBase/Base/Utils/ImageUtils.cs	ImageSharp wrapper	Covered; package retained pending later functional review	2026-09-16	Leave ImageSharp 3.1.12 unchanged and revisit raster handling, licensing, and alternatives separately.	Five in-memory tests cover PNG and JPEG metadata, invalid and truncated input, SVG recognition, format-preserving encoding, proportional landscape and portrait resizing, no-upscale behavior, and invalid constraints. Later options are to license and upgrade to ImageSharp 4.1.2, retain a secure 3.x release, migrate to MIT-licensed SkiaSharp with its native assets and wrapper rewrite, or evaluate Magick.NET/ImageMagick for its broad format and processing support while accounting for native binaries and a heavier dependency footprint. This raster concern is distinct from BusinessMgr's Windows-only report printing.
SacsStandardBase JSON utilities and SysId converter	Newtonsoft.Json integration	Covered for package upgrades	2026-09-14	Retain the suite for future Newtonsoft.Json updates.	Six tests cover objects, arrays, nulls, serializer settings, valid and invalid parsing paths, dynamic access, SysId conversion, independent deep copies, nested collections, and constructor-value replacement.
SacsStandardDbas provider and parameter creation	Microsoft.Data.SqlClient, System.Data.Odbc, and registry integration	Providers aligned with .NET 10; broader coverage complete	2026-09-15	Add optional configured database integration tests when a suitable SQL Server or ODBC test database is available.	Microsoft.Data.SqlClient 7.0.3 and System.Data.Odbc 10.0.12 are covered by eleven database-free tests for provider selection, parsed SQL connection security and authentication settings, adapter creation, parameter order, scalar and null types, SQL DateTime2, ODBC DateTime, precision normalization, and sentinel dates. The suite explicitly verifies SqlClient 7's mandatory-encryption option.
SacsCoreUnitTests	Test framework, SDK, and coverage tooling	Migrated to NUnit; coverage verified	2026-09-15	Use NUnit constraint assertions with Assert.That wherever possible.	Uses Microsoft.NET.Test.Sdk 18.10.0, NUnit 4.6.1, NUnit3TestAdapter 6.3.0, NUnit.Analyzers 4.15.0, and coverlet collector 10.0.1. All 185 tests use NUnit's constraint assertion model, pass under NUnit, and produce a non-empty Cobertura report in the optional validation coverage mode.
SacsMobileXamarin	Migration disposition	Isolated; retained for reference	2026-09-10	Keep outside the supported build unless a separately scoped resurrection or migration is approved.	Source is unchanged and available through SaCommonVS.LegacyXamarin.sln; see docs/legacy-xamarin.md.
SacsMobileMaui	Project	.NET 10 migration complete; tracked in project docs	2026-09-11	Validate Apple targets on a Mac and continue API cleanup in the project tracker.	The shared project and both active mobile consumers target .NET 10. Windows runtime smoke tests pass, and Windows and Android Debug builds complete with zero errors.
SacsStandardBase/Base/Procs/SaProcess_Base.cs	Class	Primary lifecycle protections complete; deferred semantics remain	2026-09-17	Scope disposal/status synchronization separately and review derived processes for cooperative polling.	One lifecycle guard rejects cross-mode and duplicate starts. StopProcessAsync cancels an async worker or requests manual interruption for an inline worker, then awaits its completion. A read-only interruption record retains the first manual, cancellation, or OperationCanceledException reason until the next run. Cancellation remains visible after asynchronous cleanup, including when cancellation occurs before the worker delegate starts, and OperationCanceledException is not reported as an error. Twelve focused tests pass; no production RunAsync() consumers were found in the active sibling workspaces.
SacsStandardBase/Base/Email/SaEmailConsole.cs	Class	Dependency upgrade complete; security action still required	2026-09-15	Separately restore SMTP certificate validation and require the configured TLS mode.	MailKit 4.18.0 and its resolved MimeKit dependency pass the Common and downstream validation suites without vulnerability warnings. Message construction is covered for addressing, bodies, attachments, content IDs, default filenames, and tags. The current SMTP client still accepts every server certificate.
SacsStandardBase/Base/Helpers/SacsContentTypeHelper.cs	Class	Framework dependency modernised	2026-09-15	Retain the content-type tests for future framework updates.	Removed direct references to the obsolete ASP.NET Core 2.3 Http and StaticFiles packages and now consumes their APIs from the .NET 10 Microsoft.AspNetCore.App shared framework. Ten regression cases cover filename lookup, generic form-file fallback, defaults, and bidirectional MIME mappings.
SacsStandardBase/Base/Net/SacsHttpClient.cs	Class	Zstandard dependency upgraded and covered	2026-09-15	Retain the loopback response test for future HTTP and ZstdNet updates.	ZstdNet 1.5.7 replaces 1.4.5. An in-process HTTP test exercises the real response path with native Zstandard compression and verifies successful UTF-8 decompression without external network access.
SacsStandardProc/Proc/Excel/SaMsSpreadsheet_OpenXml.cs	Class	Dependency upgrade complete; implementation remains incomplete	2026-09-15	Scope functional completion and dedicated wrapper tests separately if this implementation is to be revived.	DocumentFormat.OpenXml 3.5.1 builds and passes the existing spreadsheet and downstream validation. The Open XML implementation contains numerous pre-existing unsupported or placeholder operations, so this update does not present it as production-complete.
SacsStandardProc/Proc/Excel/SaMsSpreadsheet_POI.cs	Class	Dependency upgrade complete	2026-09-12	Retain the focused spreadsheet suite for future NPOI updates; do not adopt NPOI 2.8.0 without an explicit licensing decision.	NPOI 2.7.6 is paired with an explicit System.Security.Cryptography.Xml 10.0.12 reference and NuGet reports no vulnerable packages for SacsStandardProc. Nullable date and indexed-colour API changes were adapted. Ten focused tests and all 111 Common tests pass; BusinessMgr builds and its 21 tests pass.
SacsAuthenticatedEncryption, SacsEncryptionHelper, and SacsAesGcmCrypter	Authenticated-encryption migration	Clean-break migration implemented	2026-09-16	Retain the focused suite; later move embedded application keys to protected configuration and add key rotation.	The SACSENC2. envelope uses AES-GCM with a fresh 12-byte nonce, a 16-byte tag, and purpose-bound associated data. Existing in-code keys are retained by decision, while CBC, fixed/session IVs, legacy reads, and plaintext fallback are removed. Thirty focused tests pass. See authenticated-encryption-migration.md.
eng/validate.ps1	Repository validation	Complete; passing	2026-09-16	Use as the standard validation entry point and extend it when repository-wide checks change.	Builds serially, runs the 11-test focused SQL/ODBC-provider suite, the 10-test focused NPOI suite, and all 185 Common tests; audits both package-owning projects; verifies changed-file line endings and diffs; then invokes BusinessMgr validation.