Common-VS2019/docs/component-reviews.md

Component Review Register

<style> table th, table td { vertical-align: top; } </style>

Last updated: 2026-09-12

Component	Scope	Status	Date reviewed	Next steps	Notes
SaCommonVS.sln	.NET 10 migration build and tests	Migration complete; passing with warnings	2026-09-11	Address the separately tracked dependency, security, and .NET 10 warnings.	All supported projects target .NET 10 only. The complete solution builds with zero errors, and 94 of 94 tests pass. BusinessMgr, Sandtrap, and Sandalwood rebuild successfully against the final Common targets. Xamarin remains isolated and unchanged.
SacsMobileXamarin	Migration disposition	Isolated; retained for reference	2026-09-10	Keep outside the supported build unless a separately scoped resurrection or migration is approved.	Source is unchanged and available through SaCommonVS.LegacyXamarin.sln; see docs/legacy-xamarin.md.
SacsMobileMaui	Project	.NET 10 migration complete; tracked in project docs	2026-09-11	Validate Apple targets on a Mac and continue API cleanup in the project tracker.	The shared project and both active mobile consumers target .NET 10. Windows runtime smoke tests pass, and Windows and Android Debug builds complete with zero errors.
SacsStandardBase/Base/Procs/SaProcess_Base.cs	Class	In progress	2026-09-09	Complete the Process Base actions recorded in topics.md; review derived processes separately for cooperative polling.	Lifecycle state ownership and cancellation lock ordering were changed. Five focused tests pass. Remaining concerns include mixed sync/async execution, durable cancellation outcome, cancellation exception handling, disposal, and status synchronization.
SacsStandardBase/Base/Email/SaEmailConsole.cs	Class	Dependency upgrade complete; security action still required	2026-09-12	Separately restore SMTP certificate validation and require the configured TLS mode.	MailKit and MimeKit 4.17.0 pass the Common and downstream validation suites without vulnerability warnings. Message construction is covered for addressing, bodies, attachments, content IDs, default filenames, and tags. The current SMTP client still accepts every server certificate.
SacsStandardProc/Proc/Excel/SaMsSpreadsheet_POI.cs	Class	Characterization baseline complete; dependency upgrade pending	2026-09-12	Upgrade to NPOI 2.7.6 with an explicit patched cryptography dependency and rerun the focused and downstream suites.	Ten tests exercise lifecycle, worksheets, XLSX byte/stream/file round trips, typed values, formulas, dimensions, active cells, and legacy XLS. Automatic worksheet naming, typed text reads, and XLS fallback stream rewinding were corrected; all specifications now pass. NPOI 2.8.0 introduces a maintenance-fee EULA; 2.7.6 remains Apache-2.0.
SacsStandardBase/Base/Helpers/SacsEncryptionHelper.cs and SacsStandardBase/Base/Data/SacsAesIvCrypter.cs	Classes	Reviewed; action required	2026-09-08	Design a versioned authenticated-encryption format with legacy migration and tamper tests.	Current CBC encryption is unauthenticated; password-based key derivation uses a fixed salt and low iteration count.