Backpatch Alliance · Open Source Security
Security fixes for the end-of-life open source still running in production. No major version upgrade required. Delivered as standard package artifacts your build already resolves.
Backpatch producer for
Piloted by 5 FINOS institutional members
Backpatch producer for
Every backpatch is developed in a public GitHub organization your engineers can audit before adoption. Long-term support providers ship binaries alone. Backpatch Alliance ships the binary and publishes the source that produced it.
Fixes go back upstream wherever the project takes them. Open to everyone, not locked in by one vendor's fork.
Every backpatch is cherry-picked from a specific upstream commit and links back to it. The source that produced the artifact is public and forkable, so you verify the fix rather than trust a vendor's word for it.
Major-version upgrade across every service that consumes the library, directly or transitively. Hundreds of repositories, dozens of teams. Coordination cost paid twice: once to ship, once to defer everything else.
Pay a vendor to backpatch, per library, per year. Fix locked in proprietary distribution. Your commercial relationship is with the vendor, not with the open source project. Posture depends on their next pricing decision.
Custom cherry-picks maintained by your team. Test coverage that survives API changes between versions. Real engineering-hours cost per library. Unsustainable across a portfolio of end-of-life dependencies.
Security fixes with public source, cherry-pick provenance to upstream, and signed artifacts. Delivered on a severity-based SLA.
One member requests a backpatch. Every member has it. Pooled institutional demand feeds a single production line, so every backpatch that ships is accessible to every member of the Alliance. Cost and effort are shared; benefit is shared.
Every backpatch is developed in a public GitHub organization. Full commit history, authorship provenance, and links to the upstream commits being backported are visible for audit. Your security team can review the diff. Your dependency-review pipeline can inspect the source before adoption. No proprietary blob to trust on the vendor's assurances.
Where the upstream project accepts contributions, the canonical fix is offered back to the original maintainers. Where it does not, the fork is maintained in public rather than behind a vendor's contract. Either way the source is yours to build from.
Each backpatch cherry-picks from a specific upstream commit, with metadata linking back. A baseline git tag marks the starting version, so any auditor can diff the backpatch branch against a known upstream point. Published artifacts are signed by Moderne. Provenance is git history, not marketing.
Moderne engineers backpatch the vulnerable framework at the exact upstream commit representing the customer's baseline. Fixes cherry-pick from later releases where they apply cleanly, and are rewritten where the API has diverged. Every backpatch preserves authorship provenance, links to upstream, and passes the framework's test suite. Additional regression tests are added where API divergence requires it. Source is developed publicly and the published artifact is signed by Moderne.
The patched artifact publishes to your package repository with a +backpatch.NNN version suffix. For the JVM ecosystem today, that is Maven. Your build system resolves it as a standard dependency. Proxy configuration unchanged. Scanners, SBOM tooling, and CI pipelines continue to operate against the same coordinates. Moderne hosts the canonical artifact repository. OSERA members consume through a FINOS-hosted Sonatype Nexus that mirrors it. Direct customers consume from the Moderne repository. The sources JAR publishes alongside the binary in both channels. Each backpatch publishes with OpenVEX and CycloneDX metadata, so Snyk, Sonatype, and Mend recognize the backpatched version as remediated without new pipeline work.
Customers consume the artifact through existing build tooling. Maven or Gradle resolves the backpatched coordinates as a standard dependency. Rollout follows the customer's change management process. Customers who also license Moderne Platform can apply the version update across every pom.xml, build.gradle, or dependency manifest in coordinated changesets, including direct and transitive references and multi-module version alignment for Spring Framework and Apache Camel.
More than sixty production-ready backpatches across eight categories: application frameworks (15), serialization and data formats (12), utilities and Apache Commons (10), networking and HTTP clients (8), integration and messaging (4), security and cryptography (4), data and persistence (4), and logging (3). Validated during the OSERA pilot by FINOS institutional members and consumable today through your existing package infrastructure. Four featured here for range:
3.10.6.Final+backpatch.001
Network framework. Backpatch cherry-picked from main, tests rewritten against the older API.
5.3.39+backpatch.001
Application framework. All modules released self-referentially so versions align across the framework.
2.25.4+backpatch.001
Integration framework. Approximately 100 modules, stress-tested end to end during pilot.
1.47+backpatch.001
TLS and cryptography library. Original patched version was still in CVS. Migrated to Git and built on Ant to reach modern tooling.
Available to any enterprise under commercial contract. Backpatches delivered on a severity-based SLA. No FINOS membership required.
Talk to an ExpertFINOS institutional members can access Backpatch Alliance backpatches through the OSERA pilot. Contact membersuccess@finos.org or visit osera.finos.org for details.
Visit OSERABackpatch Alliance is Moderne’s commercial backpatching product. It produces canonical, upstream-first fixes for critical open source frameworks past their end-of-support date. Source is public at github.com/moderneinc/recipes-backpatch, cherry-pick metadata links each backpatch to the upstream commit it was ported from, and published artifacts are signed by Moderne. Delivered on a severity-based SLA.
More than sixty production-ready backpatches are live across eight categories, including Spring Framework, Spring Boot, Spring Security, Apache Struts 2, Jackson Databind, SnakeYAML, XStream, Netty, Jetty, Tomcat Embed, Apache Camel, Apache ActiveMQ, Bouncy Castle, Hibernate Core, H2, Logback, and Log4j 1 and 2. The full index is at moderne.ai/backpatch-alliance/coverage. Coverage expands based on Alliance member and customer requests.
Backpatched artifacts preserve the upstream group ID and artifact ID and add a +backpatch.NNN version suffix. A backpatched Spring Framework 5.3.39 publishes as org.springframework:spring-core:5.3.39+backpatch.001. Your build system resolves it identically to any other Maven artifact.
Backpatched artifacts publish to a Maven repository. Moderne hosts the canonical repository. OSERA delivery goes through a FINOS-hosted Sonatype Nexus mirror, accessible to member institutions. Direct delivery comes from the Moderne repository under commercial contract. Proxy configuration is unchanged or minimal. CI, SBOM tooling, and vulnerability scanners continue to operate against the same coordinates, and OpenVEX and CycloneDX metadata publishes alongside each artifact.
No. Backpatch Alliance is available standalone under commercial contract. Customers consume backpatched artifacts through their existing build tooling. Maven or Gradle resolves the coordinates as it would any other dependency. Customers who also license Moderne Platform can apply backpatches across every repository in their estate in a single coordinated operation using OpenRewrite recipes.
Yes. Backpatch source is public at github.com/moderneinc/recipes-backpatch, with full commit history, authorship provenance, and links to upstream commits. The sources JAR publishes alongside the binary in the Maven repository, so customers can inspect source through standard tooling without additional access. Built artifacts are delivered to paying customers through commercial contract.
Yes. The source is public and forkable at no cost. A subscription buys hosted, pre-built, signed artifacts, continuous updates, and VEX feeds. The artifact is free; the service is what you pay for.
Each backpatch passes the upstream project’s existing test suite, adapted where necessary for API differences between the vulnerable version and the fix’s original target. Where the upstream API has changed significantly (Netty is one such example in the launch coverage), tests are rewritten against the older API to preserve semantic equivalence. Additional regression tests are added where API divergence requires it.
Moderne produces backpatches on commercially reasonable efforts where a CVE is independently fixable and an upstream fix or rebuild path exists. Where an end-of-life version has no upstream fix that applies, patching is best-effort. Behavioral parity with the prior version cannot be guaranteed and integration may require changes in your application. You vet the fix and own application-side changes; Moderne provides guidance.
Transitive dependencies pointing to a backpatched artifact resolve through your build tool’s normal dependency management. Customers on Moderne Platform can additionally use OpenRewrite recipes to update all references, direct and transitive, across every repository in a single operation.
Backpatches propagate through your existing build and deployment workflow. The artifact is a standard Maven dependency that resolves through your existing tooling. Customers on Moderne Platform can additionally use OpenRewrite recipes to apply the version update across every pom.xml, build.gradle, or dependency manifest in coordinated changesets. Multi-module frameworks like Spring Framework and Apache Camel have internal modules updated in coordinated changesets to maintain version alignment.
Nothing about a backpatch holds you on it. The artifact uses standard coordinates, so moving to a supported upstream release is an ordinary version change in your build. Moderne Platform customers can use OpenRewrite recipes to apply that migration across every repository at once.
Backpatches are maintained under commercial contract. They are maintained for as long as you need the version they patch, and they do not lock you into staying on it.
Yes. Each backpatch is delivered on an SLA based on the severity and priority of the vulnerability it addresses.
Proprietary long-term support providers deliver drop-in replacements as binaries. Their patches are typically distributed only under commercial contract, without public source access. Backpatch Alliance delivers fixes as public source in an open GitHub organization, offers the canonical fix back to the upstream project where viable, and maintains the fork openly where not. The sources JAR publishes alongside every binary and the source is free to fork and build yourself. Backpatch Alliance is designed to keep enterprises portable and audit-ready.
Akrites is a Linux Foundation initiative that coordinates disclosure and upstream fixes for vulnerabilities in maintained open source projects. Backpatch Alliance is Moderne’s commercial product that backpatches vulnerabilities in end-of-life versions that upstream projects no longer support. The two efforts complement each other. Akrites handles active projects. Backpatch Alliance handles the versions your business still depends on but the upstream can’t fix.
OSERA is a FINOS-governed alliance for financial services firms to mutualize the cost of backpatching shared dependencies. Backpatch Alliance is the underlying capability that produces those backpatches. FINOS institutional members access Backpatch Alliance through OSERA. Any other enterprise accesses it directly from Moderne.
Backpatch Alliance is available today, with more than 60 backpatches live. Talk to a Moderne expert about coverage priorities, SLA requirements, and integration with your existing package infrastructure.