FAQ-000815 - External JavaScript Library Approval / Lightning Locker Service Compatibility

Current Status:VALID_RESPONSEErrorUnable to AnswerSuggests Case

← Back to List View Prompt Template

Current FAQ

Question
How should I handle third-party JavaScript libraries that are not compatible with Lightning Locker Service?
Answer
To handle third-party JavaScript libraries that are not compatible with Lightning Locker Service: **Evaluation and Compatibility**: 1. **Evaluate Compatibility**: Check the library's compatibility with Locker Service using Salesforce's documentation and tools. Incompatibility may indicate functional issues rather than direct security concerns. 2. **Use Locker Console**: Validate the security of open-source libraries using Locker Console results to check if the library works with LockerService enabled. **Required Approach**: 1. **Static Resources**: Load the library from the static resources folder of your package instead of external sources like CDNs. This ensures version control and compliance with security requirements regardless of Locker Service compatibility. 2. **Check for Vulnerabilities**: Use tools like Snyk to identify any publicly listed vulnerabilities in the library. **Alternative Solutions**: 1. **Consider Alternatives**: If the library cannot be made compatible, explore alternative libraries that adhere to Locker Service standards. 2. **Seek Guidance**: For libraries that are incompatible with Locker Service and cannot be replaced, it's recommended to open a case with Salesforce to get specific guidance tailored to your situation. **Important Note**: Even if a library is not compatible with Locker Service, it must still be stored in static resources and follow all other security requirements. The incompatibility with Locker Service doesn't exempt the library from standard security practices and requirements.

Enhancing FAQ with AI recommendations...

AI Recommended Enhancement

Related Security Rules (click to view)
AvoidAuraWithLockerDisabledLibraryWithKnownCriticalSeverityVulnerabilityLibraryWithKnownHighSeverityVulnerabilityLibraryWithKnownMediumSeverityVulnerabilityLibraryWithKnownLowSeverityVulnerabilityLoadJavaScriptIncludeScriptLoadJavaScriptHtmlScript
Question
How should I handle third-party JavaScript libraries that are not compatible with Lightning Locker Service?
Recommended Answer Update
To handle third-party JavaScript libraries that aren't compatible with Lightning Locker Service: **Evaluation and Compatibility**: 1. **Evaluate Compatibility**: Check the library's compatibility with Locker Service using Salesforce's documentation and tools. Incompatibility may indicate functional issues rather than direct security concerns. 2. **Use Locker Console**: Validate the security of open-source libraries using Locker Console results to check if the library works with LockerService enabled. **Required Approach**: 1. **Static Resources**: Load the library from the static resources folder of your package instead of external sources like CDNs. This ensures version control and compliance with security requirements regardless of Locker Service compatibility. 2. **Check for Vulnerabilities**: Use tools like Snyk to identify any publicly listed vulnerabilities in the library. **Alternative Solutions**: 1. **Consider Alternatives**: If the library can't be made compatible, explore alternative libraries that adhere to Locker Service standards. 2. **Seek Guidance**: For libraries that are incompatible with Locker Service and can't be replaced, open a case with Salesforce to get specific guidance tailored to your situation. **Important Note**: Even if a library isn't compatible with Locker Service, it must still be stored in static resources and follow all other security requirements. The incompatibility with Locker Service doesn't exempt the library from standard security practices and requirements.
Reasoning
The FAQ content is accurate and well-structured. I made minor language improvements for clarity and tone consistency: changed 'cannot' to 'can't' for a more conversational tone per the brand guidelines, and 'it's recommended to open' to 'open' for more direct language. These changes make the content more approachable while preserving all technical information. Regarding security rules: - AvoidAuraWithLockerDisabled: This rule directly relates to the FAQ's core topic about Lightning Locker Service compatibility, specifically the mention of checking compatibility and working with LockerService enabled. - LibraryWithKnownCriticalSeverityVulnerability, LibraryWithKnownHighSeverityVulnerability, LibraryWithKnownMediumSeverityVulnerability, LibraryWithKnownLowSeverityVulnerability: These rules directly apply to the FAQ's guidance about checking for vulnerabilities in third-party libraries using tools like Snyk. - LoadJavaScriptIncludeScript and LoadJavaScriptHtmlScript: These rules relate to the FAQ's requirement to load JavaScript libraries from static resources rather than external CDNs, which is a key security practice discussed in the 'Required Approach' section.
Reasoning References