Disable Access to Non-global Apex Controller Methods in Managed Packages (Critical Update, Postponed)

This critical update is postponed to Summer ’21. Released in Summer ’17, it was scheduled for auto-activation in Winter ’20. The critical update corrects access controls on Apex controller methods in managed packages. When this update is enabled, only methods marked with the global access modifier are accessible by Aura components from outside the package namespace. These access controls prevent you from using unsupported API methods that the package author didn’t intend for global access.

Where: This change applies to orgs with Aura components in Lightning Experience, Salesforce Classic, and all versions of the Salesforce app.

When: This critical update is enforced when a sandbox or production org is upgraded to Summer ’21. Enforcement starts on April 4, 2021 and takes effect when your instance is upgraded to Summer ’21. To find the exact activation date for your instance, refer to https://status.salesforce.com.

Why: When added to a managed package, only Apex controller methods marked global are accessible by Aura components outside of that managed package’s namespace. Methods marked public in their Apex definitions are accessible only to Aura components included in the package’s namespace. When this critical update is enabled, these rules are enforced.

Prior to this update, Aura components outside of the package namespace could access non-global methods (Apex controller methods not marked with the global access modifier).

When this update is enabled, if your code incorrectly depends on non-global Apex methods in a managed package, server actions that call those methods fail. Update your code to use only the supported API methods provided by the package as global methods.

Note

Note

An Aura component outside the package can access a public Apex method installed from a non-namespaced unlocked package. The Aura component can be installed from another package or created in the org. For accessing Apex methods, a non-namespaced unlocked package is treated the same as an unmanaged package.

How: To test this critical update, we recommend working in a sandbox to complete testing before the initial enforcement date of April 4, 2021, which is the Auto-Activation Date in the UI. After April 4, you can no longer activate or deactivate the critical update and you can test behavior only in a sandbox that's already been upgraded to Summer ’21. If you don't activate the critical update before April 4, it will be automatically activated when your instance is upgraded to Summer ’21.

  1. From Setup, enter Critical Updates in the Quick Find box.
  2. Select Critical Updates.
  3. Review the details for the “Disable Access to Non-global Controller Methods in Managed Packages” critical update.
  4. Click Activate.
  5. Test that your custom Aura components are working correctly.