Disabled Lightning Locker
Why is this an issue?
Lightning Locker is Salesforce's security architecture for Lightning components. It provides:
DOM isolation: Prevents components from accessing each other's DOM
Secure JavaScript: Blocks access to dangerous APIs
Namespace separation: Isolates components from different packages
Disabling Locker removes these protections, exposing your application to security vulnerabilities and potential conflicts between components.
Examples
This rule inspects the *-meta.xml bundle file of an Aura component, which declares the component's API version.
Example of an incorrect bundle file (API version below 40.0, so Locker is disabled):
<?xml version="1.0" encoding="UTF-8"?>
<AuraDefinitionBundle xmlns="http://soap.sforce.com/2006/04/metadata">
<apiVersion>39.0</apiVersion>
<description>A Lightning Component Bundle</description>
</AuraDefinitionBundle>
Example of a correct bundle file (API version 40.0 or later, so Locker is enabled):
<?xml version="1.0" encoding="UTF-8"?>
<AuraDefinitionBundle xmlns="http://soap.sforce.com/2006/04/metadata">
<apiVersion>40.0</apiVersion>
<description>A Lightning Component Bundle</description>
</AuraDefinitionBundle>
How can I fix violations?
Update component API version to version 40.0 or later where Locker is enabled by default. An autofix is available for this rule.
When should I disable this rule?
You may dismiss specific violations only when integrating with third-party libraries that are incompatible with Locker and cannot be updated.
Resources