Surge Migrate

Removal scheduled 31 March 2027

AEM Cloud Service APIs scheduled for removal on 31 March 2027

A second group of packages carries a removal date of 31 March 2027. Expect the same Cloud Manager enforcement pattern as the 2026 removals: warnings, then paused and failed pipelines.

Affected packages and APIs

  • com.adobe.granite.xss
  • com.day.cq.xss
  • org.apache.commons.fileupload
  • org.apache.tika
  • com.day.cq.commons.predicate
  • com.day.cq.mailer.commons
  • com.github.jknack.handlebars
  • com.adobe.cq.smartcontent
  • org.bson
  • com.adobe.granite.httpcache.api

What to use instead

org.apache.sling.xss for XSS protection, the Servlet API's multipart support for uploads, com.day.cq.commons.predicates, and embedded current versions of Tika or Handlebars where you need them.

How to fix it

  1. Search for the listed imports, including in JSPs and Groovy scripts.
  2. Switch XSSAPI usage to org.apache.sling.xss.XSSAPI; method names are largely the same.
  3. Replace Commons FileUpload with request.getParts() from the Servlet API.
  4. Embed current Tika or Handlebars versions if the feature is still needed.

AEM 6.5

import com.adobe.granite.xss.XSSAPI;

Cloud Service

import org.apache.sling.xss.XSSAPI;

How we detect it

  • Readiness scan rule removal-2027: APIs scheduled for removal on 31 March 2027.

Best Practices Analyzer reports it under OCU, OU.

Can agents fix it?

High for XSS and predicate packages; partial for upload handling, which needs a test of each form.

Source: Adobe Experience League. Checked 19 October 2026.