Does Upgrading Major Version Number Trigger Security Review

Question

We're rolling out a larger change in our manage package and it would be nice to recognise these changes by increasing the Major version number on our package. The concern is whether it will trigger a security review or not.

Now before I get torn apart I understand that the code should always be in a state where it will pass a Security Review and we do try to do that: with regular security scans and the PMD scanner working for all our builds. But realistically if moving to a new Major version is going to trigger potential heartache and delay the release we might be better off just increasing the minor version instead. Just wanted to know if it will definitely trigger one or if Salesforce is more likely to wait until the 1-year mark to re-review.

Cheers all

Answer 1

So having spoken to our Salesforce Technical Evangelist we were basically told not to worry about it. From my basic understanding after the meeting: when you do your first security review (and pass) there is a flag set against the package to say it has successfully passed. This flag is never unset. What happens is that Salesforce decides to review the package again (often after a year).

The Technicial Evangelist also reassured us that if there is a need to do a security review it will happen in parallel with our roadmap and deployment schedule in order to never delay a release to a customer.