Disable Access to Non-global Apex Controller Methods in Managed Packages (Previously Released Critical Update)

As mentioned in the Spring ’19 release notes, this critical update corrects access controls on Apex controller methods in managed packages. When this update is enabled, only methods marked with the global access modifier are accessible by Aura components from outside the package namespace. These access controls prevent you from using unsupported API methods that the package author didn’t intend for global access.

Where: This change applies to orgs with Aura components in Lightning Experience, Salesforce Classic, and all versions of the Salesforce app.

Why: When added to a managed package, only Apex controller methods marked global should be accessible by Aura components outside of that managed package’s namespace. Methods marked public in their Apex definitions should be accessible only to Aura components included in the package’s same namespace. When this update is enabled, these rules are enforced.

Prior to this update, non-global methods (that is, Apex controller methods that weren’t marked with the global access modifier) could be accessed by Aura components outside of the package namespace.

When this update is enabled, if you’ve written code that incorrectly depends on non-global Apex methods in a managed package, server actions that call those methods fail. Update your code to use only the supported API methods provided by the package as global methods.

How: To test this critical update, we recommend working in a sandbox.

  1. From Setup, enter Critical Updates in the Quick Find box.
  2. Select Critical Updates.
  3. Review the details for the “Disable Access to Non-global Controller Methods in Managed Packages” critical update.
  4. Click Activate.
  5. Test that the custom Aura components that you’ve developed are working correctly.