Disabled Lightning Locker
Why is this an issue?
Lightning Locker is Salesforce's security architecture for Lightning components. It provides:
DOM isolation: Prevents components from accessing each other's DOM
Secure JavaScript: Blocks access to dangerous APIs
Namespace separation: Isolates components from different packages
Disabling Locker removes these protections, exposing your application to security vulnerabilities and potential conflicts between components.
Examples
Example of incorrect component (old API version without Locker):
<aura:component>
<!-- API version 39.0 or below does not have Locker enabled -->
<aura:attribute name="data" type="Object"/>
</aura:component>
<!-- Component meta file with old API version -->
<AuraDefinitionBundle>
<apiVersion>39.0</apiVersion>
</AuraDefinitionBundle>
Example of correct component (current API version with Locker):
<aura:component>
<aura:attribute name="data" type="Object"/>
</aura:component>
<!-- Component meta file with current API version -->
<AuraDefinitionBundle>
<apiVersion>62.0</apiVersion>
</AuraDefinitionBundle>
How can I fix violations?
Update component API version to version 40.0 or later where Locker is enabled by default. An autofix is available for this rule.
When should I disable this rule?
You may dismiss specific violations only when integrating with third-party libraries that are incompatible with Locker and cannot be updated
Resources