Disable Access to Non-global Controller Methods in Managed Packages (Update, Postponed)

This update is postponed to Summer ’21. It was scheduled for auto-activation (enforcement) in Winter ’20. This update corrects access controls on Apex controller methods in managed packages. When this update is enabled, only methods marked with the global access modifier are accessible by Aura components from outside the package namespace. These access controls prevent you from using unsupported API methods that the package author didn’t intend for global access.

Where: This change applies to orgs with Aura components in Lightning Experience, Salesforce Classic, and all versions of the Salesforce app.

When: This update was created in Summer ’17 and is enforced when a sandbox or production org is upgraded to Summer ’21. Enforcement starts for some sandboxes on April 4, 2021. To get the major release upgrade date for your instance, go to Trust Status, search for your instance, and click the maintenance tab.

Why: When added to a managed package, only Apex controller methods marked global are accessible by Aura components outside of that managed package’s namespace. Methods marked public in their Apex definitions are accessible only to Aura components included in the package’s namespace. When this update is enabled, these rules are enforced.

Prior to this update, Aura components outside of the package namespace could access non-global methods (Apex controller methods not marked with the global access modifier).

When this update is enabled, if your code incorrectly depends on non-global Apex methods in a managed package, server actions that call those methods fail. Update your code to use only the supported API methods provided by the package as global methods.

Note

Note

An Aura component outside the package can access a public Apex method installed from a non-namespaced unlocked package. The Aura component can be installed from another package or created in the org. For accessing Apex methods, a non-namespaced unlocked package is treated the same as an unmanaged package.

How: To test this update, we recommend working in a sandbox. After April 4, you can continue to activate or deactivate the update from Release Updates in Setup until the update is automatically enforced when your org is upgraded to Summer ’21.

  1. From Setup, enter Release Updates in the Quick Find box.
  2. Select Release Updates (Beta).
  3. Find “Disable Access to Non-global Controller Methods in Managed Packages” and click View Details or click Get Started.
  4. Test that your custom Aura components are working correctly.