Does Salesforce security review reject a package/ lightning component if the following are used in lightning component code? (a) let keyword, instead of var (b) JS fat arrow (=>) within the controller/ helper functions (this is esp. useful for cleaner coding when used with .then or .catch contructs) (c) JS functional programming contructs such as array.map(), array.forEach(), array.filter() etc.

I've used this in my component and it works fine, but PMD check throws an error. While I was able to confirm that PMD check throws an error because it might not have JS rules defined to specifically check for 'let' keyword and it views them defined as without 'var'. Eventually, it considers them as global variable while they aren't (they are local scoped and initialized with 'let'). Salesforce documentation doesn't specifically indicate whether these can be used or not , esp. with regards to security review of the package.

I did see Salesforce using let keywords in the Salesforce Inspector code which tells me that they might allow but not sure.

Does anyone know if this could cause security review failure??

2 Answers 2


No, this will not impact security review. I have already contributed code that uses such syntax.

Most of what you mentioned (let, fat arrow functions...) is supported by all browsers including IE11 because this is part of the ES6 standard. However, there are a few things are not supported by IE11 around array functions. Array.find() being the most annoying one.

Note that you will get warnings if you try to lint your code with the Salesforce CLI lint plugin but that is only because the plugin is set to check on ES5 (you cannot change this setting for now).

  • Thanks @POZ!!! That is really helpful to know you have already tried this. Just to be sure, your code contributed to a managed package, right??
    – arut
    Commented Jul 31, 2018 at 5:59
  • Yes, I did contribute it as a managed package.
    – POZ
    Commented Jul 31, 2018 at 10:23
  • Oh and one detail that you may find useful as well: you cannot use arrow function syntax for the top level controller and helper functions (the Lightning parser will prevent you from doing that). You can use arrow functions elsewhere.
    – POZ
    Commented Jul 31, 2018 at 10:28
  • Thanks @POZ!!! I'm aware of the restriction on the arrow function syntax on the top level controller and helper functions (otherwise the whole component would fail to work), but appreciate the info.
    – arut
    Commented Jul 31, 2018 at 12:00

There shouldn't be any problem with them; all browsers that support Lightning support these features. Also, the security review isn't concerned with coding issues so much as it is actual security violations. You'll want to confirm with the Security Review Team to be 100% certain, but I would say that there shouldn't be any issues unless you intend to support customers that have opted in to IE 11 extended support...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .