Backpatch Alliance is the fellowship of the fix.

Backpatch Alliance is Moderne’s commercial backpatching product. It produces canonical, upstream-first fixes for critical open source frameworks past their end-of-support date. Source is public in a dedicated GitHub organization, cherry-pick metadata links each backpatch to the upstream commit it was ported from, and original library maintainers signed the commits on the four launch backpatches. Delivered on a severity-based SLA.

Backpatched artifacts publish to a Maven repository. OSERA delivery uses the FINOS-hosted Sonatype Nexus, accessible to member institutions. Direct Moderne delivery uses a Moderne-managed repository, accessible under commercial contract. Proxy configuration is unchanged or minimal. CI, SBOM tooling, and vulnerability scanners continue to operate against the same coordinates.

No. Backpatch Alliance is available standalone under commercial contract. Customers consume backpatched artifacts through their existing build tooling. Maven or Gradle resolves the coordinates as it would any other dependency. Customers who also license Moderne Platform can apply backpatches across every repository in their estate in a single coordinated operation using OpenRewrite recipes.

Each backpatch passes the upstream project’s existing test suite, adapted where necessary for API differences between the vulnerable version and the fix’s original target. Where the upstream API has changed significantly (Netty is one such example in the launch coverage), tests are rewritten against the older API to preserve semantic equivalence. Additional regression tests are added where API divergence requires it.

Backpatches are maintained under commercial contract. They are designed as a managed bridge to a currently-supported version of the framework, not a permanent parking spot.

Yes. Each backpatch is delivered on an SLA based on the severity and priority of the vulnerability it addresses. Steering Committee and Fully Managed Service members receive a guaranteed throughput of patches every week, giving them a strong SLA for their most critical needs.

Proprietary long-term support providers deliver drop-in replacements as binaries. Their patches are typically distributed only under commercial contract, without public source access. Backpatch Alliance delivers canonical fixes as public source in an open GitHub organization, offers them back to the upstream project where viable, and publishes the sources JAR alongside every binary. Original library maintainers appear as signers on the commits. Backpatch Alliance is designed to keep enterprises portable and audit-ready.

Akrites is a Linux Foundation initiative that coordinates disclosure and upstream fixes for vulnerabilities in maintained open source projects. Backpatch Alliance is Moderne’s commercial product that backpatches vulnerabilities in end-of-life versions that upstream projects no longer support. The two efforts complement each other. Akrites handles active projects. Backpatch Alliance handles the versions your business still depends on but the upstream can’t fix.

OSERA is a FINOS-governed alliance for financial services firms to mutualize the cost of backpatching shared dependencies. Moderne is the sole producer of backpatches for OSERA. In many cases, backpatches available in OSERA are available in Backpatch Alliance and vice versa. OSERA includes additional financial services specific governance criteria and standards above and beyond Backpatch Alliance set by the key financial services organizations that are OSERA premium members.

JFrog Zero-Touch Remediation Program is a mechanism to APPLY a patch. Moderne’s Backpatch Alliance is a provider of patches. JFrog Zero-Touch Remediation presents a complementary alternative patch distribution channel. It works alongside and together with remediation approaches that update the version in the build to more explicitly consume patched versions.