Cloud Manager pipeline fails code scanning due to deprecated package warnings from transitive dependencies
Cloud Manager pipelines in AEM as a Cloud Service can fail during the Code Scanning step when deprecated packages are introduced through transitive dependencies, even if the project code does not directly reference them. This article explains how to identify the dependency causing the warnings and resolve the issue by updating it to a version that no longer imports the deprecated packages.
Description description
Environment
Adobe Experience Manager as a Cloud Service (all versions)
Issue/Symptoms
Cloud Manager pipelines fail during the Code Scanning step with warnings about deprecated package usage. This occurs even when the project code does not directly reference the deprecated packages. The issue is observed in production pipelines and the main development branch. The failure is linked to the inclusion of the aemaacs-opentelemetry-instrumentation bundle (be.orbinson.aem, version 1.1.0), which introduces a transitive dependency on be.orbinson.osgi:opentelemetry-logback-appender-1.0:2.26.0-alpha.0001.
The following deprecated packages are flagged:
ch.qos.logback.core(deprecated since 2022-01-27, removal 2025-08-31)ch.qos.logback.core.spi(deprecated since 2022-01-27, removal 2025-08-31)ch.qos.logback.classic(deprecated since 2022-01-27, removal 2025-08-31)ch.qos.logback.classic.spi(deprecated since 2022-01-27, removal 2025-08-31)org.slf4j.event(deprecated since 2024-04-11, removal 2025-08-31)
Note: These packages are imported by the logback appender OSGi bundle, which bridges OpenTelemetry logging to AEM’s logback runtime. The project code does not directly use these packages, and logback is provided by the AEM as a Cloud Service platform. Contact Adobe Support for more details.
Resolution resolution
Follow these steps to fix the issue:
- Replace the current version (
1.1.0) ofaemaacs-opentelemetry-instrumentationwith version1.2.0or later, which addresses the deprecated package usage. - In your project’s dependency management, such as
pom.xml, update the version ofaemaacs-opentelemetry-instrumentationto1.2.0or newer. - Ensure that your build references the updated dependency and that no other modules are introducing the deprecated packages.
- Commit and push the changes to your repository.
- Trigger a new Cloud Manager pipeline execution.
- Confirm that the Code Scanning step completes successfully without deprecated package warnings.
Cause
The pipeline failed because a transitive dependency introduced deprecated package imports, which are now flagged by Cloud Manager’s code scanning. The updated aemaacs-opentelemetry-instrumentation bundle removes or updates these dependencies to resolve the warnings.