This page summarizes the current Microsoft Dataverse solution checker findings for Altus solutions. The results are grouped by solution and severity so that you can review the current state of the solutions deployed.
Findings by solution
ControlsV1 (SenseiControlsV1)
Critical finding: avoid-eval
The reported use of eval is a deliberate and constrained design decision made to work around a limitation in the Power Platform Custom Pages runtime. Custom Pages and the Xrm page environment use different React runtimes (React v16 vs React v17). Standard script injection evaluates code in the Xrm page scope, which causes React version conflicts and breaks the Custom Page at runtime. To maintain correct behavior, dynamically injected logic must remain within the Custom Page JavaScript scope and closure.
Custom Pages rely on an undocumented framework mechanism to load and inject dependencies while preserving that scope. Re-implementing or reverse-engineering that mechanism is not feasible or safe because it is undocumented and may change without notice. In this narrow scenario, eval is currently the only reliable method to inject and execute the required code while preserving scope isolation and runtime compatibility.
Risk assessment and mitigations
The eval usage is not user-driven and does not process untrusted input.
The evaluated code is static, controlled, and versioned as part of the solution.
No external input, configuration, or runtime data is passed into eval.
The usage is localized, documented, and intentionally isolated to this scenario.
Important
This finding is a deliberate exception while a supported alternative for scoped dependency injection in Custom Pages remains unavailable.