What's the deal with Deno? We talk with a major contributor to find out. Listen now.
13

Support for document.cookie being writable (scoped to your own namespace, similar to how localStorage and sessionStorage work in Locker) is at the top of our queue and (Safe Harbor :p) is planned to be released before the auto-activation date to give you time to verify functionality. I'll update this answer as progress is made. Edit (Feb 13, 2017): Read/...


12

I wasn't satisfied with the accepted answer, specifically relating to the VisualForce aspect of it, so I performed some additional testing on this critical fix with regard to VF. What I learned is that when a VF iterator (apex:pageBlockTable, apex:repeat, etc.) is used against a Map, one of its undescribed actions is to sort the keys. This completely ...


12

There's been a family of long-standing issues with edge cases in how the platform handles caching schema describe information under the covers. As Daniel mentioned, there are KIs that have gone unfixed where issues like initializing the describe for say, Account, at an old API version and then trying to access it with a newer one would (incorrectly) omit ...


7

I'd checked in with Chris Peterson about this, specifically around the concern that I wouldn't be able to use Id.getSObjectType(). This critical update isn't about that altering that behavior. Instead it is to fix known issues like Missing dependent object: Field: .LastViewedDate error occurs when Apex class with API version 28.0+ is used in VF with API ...


7

Support for read/write has been added to Locker Service by Salesforce (thanks to @TrevorBliss for following up on that). However, the implementation does not work the same way as before Locker Service if your community uses a mix of Lightning and Visualforce. For example, if you have some pages that serve Visualforce PDF files, these pages will not have ...


6

My suggestion: just turn it on and test it on a sandbox or developer org. Should become pretty clear. Update: reading MarkPonds comment on behavior in VF, I would recommend to stick with the current pattern sfdcfox describes using sorted lists from keysets as iterators. The weird and incomplete documentation might be a hint that this isn't shipped as a big ...


6

It looks like Salesforce is currently doing 302 redirects for static resources requested from the salesforce.com domain when the security update is enabled. I didn't notice the redirect behavior until this morning, and was reasonably confident that we were getting 404's before. Turning the security update back off results in HTTP 200 instead of the 302 ...


5

Salesforce could have done a better job explaining this (and picking a less problematic way to brand it). From the comments, it's worth noting that this will be enabled for everyone using "My Domain" on 2020-07-13, and you are being given the option to enable it early. When talking about "Edge" and web stuff, I wouldn't blame people for thinking they're ...


5

The real answer was provided by Matt over on Salesforce Success Get the ProfileId of Automated Process User using Dev Console SELECT ProfileId from User WHERE alias = 'autoproc' Coerce the URL that edits Apex class access for a Profile /_ui/system/user/ProfileApexClassPermissionEdit/e?profile_id=theAutomatedProcessProfileId and you'll get the familiar ...


5

This is anticipated behavior - from the release note This change affects Visualforce pages and Lightning components that directly reference custom metadata types. You can see a related known issue for a visualforce scenario where the recommended workaround is indeed to use a wrapper class. I'm on the team that builds custom metadata, I will work with ...


5

Steven Lawrence from Salesforce answered me on November 14 about this, at the Salesforce Success Community Group about Salesforce Infrastructure. His answer was: Fortunately, this change does not affect calls to PageReference.getContentAsPDF() or PageReference.getContent() when the PageReference object is for another resource within the org, such as ...


4

It is clearly stated in Salesforce disabling TLS 1.0. Note this option is completely unavailable for sandbox environments: June 25, 2016, at 9:30 AM PDT (16:30 UTC) After this date and time, all sandbox orgs -- whether existing, refreshed, or new -- will have TLS 1.0 automatically disabled and will require TLS 1.1 or later in HTTPS connections to or ...


4

Even when this code would compile and run, it had a problem; you couldn't actually instantiate a SomeItem inside the list of Item, because the JSON parser wouldn't know what subtype you actually mean to use. As such, the Critical Update is actually a good thing, because it fixes aberrant behavior with this type of code. The solution is to manually create the ...


4

This change requires the "MyCustomClassName" class to: Be global (this was actually already the case) in order to allow the managed package's own code to create an instance of it. Now have a global, no-arg constructor that the managed package can call. So it needs to look something like: global class MyCustomClassName implements thepackage....


3

When the critical update mentions query parameters it's referring the the values in the URL after the ?, so BillingCity=, Sales_Rep__c=, etc. The terminology is a bit inconsistent, see this question for an extended discussion on the matter. So if anything the bug in this case is that it's not stripping all your url parameters. My guess is that this is ...


3

There was a critical update on October 5th, 2018 to address a security vulnerability related to unauthenticated guest users. This critical update proactively limited the default permissions given to unauthenticated guest users, so if you have functionality in a Salesforce Site or Community that relied on the previously broader permissions, you will be ...


3

It depends on the integrations. 3DES is only one of several cipher suites that are used. During the TLS handshake, the client and server choose the most secure cipher that they have in common and use that. If 3DES is the only supported cipher, then connections will fail. Otherwise, there won't be any effect, as the connection will simply choose another ...


3

You're allowed a single queueable call per database execute method, so this code should technically work: // Must use Database.AllowsCallouts for PDF generation public with sharing class GenerateOnePDF implements Queueable, Database.AllowsCallouts { public void execute(QueueableContext context) { Blob v = Page.myPDFPage.getContentAsPDF(); ...


3

Different servers run different versions of salesforce at any given time. It's rare to see all servers on the exact same version, even mid-release. The auto activation date is, as far as I can tell, based in the scheduled release for a patch or release. Sometimes, like all things software, something fails QA, or a patch has to roll back because it broke a ...


3

Locker does introduce a small amount of overhead (reduced massively in the Winter'17 .11 patch) but it should typically not be significant. If you enable Lightning Components debug mode in Setup and grab a new set of profiles we'll get a much better set of symbols than the obfuscated h and l. @Sachin I originally added this as comment on your post and did ...


3

As far as I know (though looking over the Winter '18 release notes, which mentions that this critical update will be enabled for everyone as part of that release), the critical update you mention is only to allow you to set up CSRF protection on GET requests on a page-by-page basis (It shouldn't automatically turn that on for any existing page). That option ...


3

It's not automated. It's essentially a manual task checklist you can use to confirm which critical updates you've looked at or what steps you've done (steps provided by Salesforce). Your progress bar will update as you check off items in the checklist If you click on "Get Started" on a given update, you'll see a list of items to complete below the &...


3

Ideally, once the summer 20 has been released the two updates are removed on the critical update section. It might also be possible that in Production, you have activated those Critical updates that is why they are not showing. Not activating the opt-out option means you are allowing Salesforce to enforce the Guest User Object Permission on your org. Once ...


2

The first option for resolution is far preferable: The issue occurs with standard headers. If your Visualforce page does not require headers then you can set the showHeader attribute to false which should resolve the issue: <apex:page standardController="SObject" showHeader="false"> In API Version 38, the above attribute no longer fixes the error,...


2

I have faced the exact same issue when I try to connect to the salesforce org from Eclipse Kepler , And I changed the eclipse from Eclipse Kepler to Eclipse Mars and This error was eliminated. However at what point you got this error, If you were getting it in the Eclipse then try the option I have shared.


2

I went ahead and put together some tests and validated that Sets and Maps now do maintain their order like a List after the critical update is applied. Here is a unit test I put together that compares the order of a set and map to the order of a list. When I ran it without the critical update applied, it failed. When I ran it with the critical update ...


2

With Winter`16 release it would be resolved. Partners says: In the Winter '16 release, getContent() and getContentAsPDF() can be invoked from within Asynchronous Apex such as Batch Apex, Schedulable and Queueable classes, and @future methods. This provides an alternate solution for any partners impacted by the upcoming Critical Update and allows ...


2

After further testing, it turns out that the optionalFields property is more restrictive in the update. If an optional field is listed when not looking at the correct record type, it will prevent the wired method from running again when the recordId is updated. In our case, we use the component in both the Case page and Contact page. We had one wire/...


2

After a call to SFDC Support, the answer seems to be: "Call SFDC Support to enable Automated Process user access to invocable classes before enabling this Critical Update." Clearly unsatisfactory. Let's hope Winter 20 has a solution. UPDATE: If you do call Support, they will tell you that you can self-serve by entering the Automated Process's ProfileId ...


2

You must read this:- Notes on Critical Updates Salesforce analyzes your organization to determine if a critical update potentially affects your customizations. If your customizations aren’t affected, Salesforce automatically activates the update in your organization. On the scheduled auto-activation date, Salesforce permanently activates the update. After ...


Only top voted, non community-wiki answers of a minimum length are eligible