Backpatch enterprise software and stay secure on your terms

Contents

1. Backpatching complements modernization
2. Backpatch Alliance exists to mutualize the cost of backpatching end of life software.
3. What you get with every backpatch
4. How Moderne makes backpatching work at scale
5. Managing ripple effects with automation
6. Full visibility and control of backpatching
7. Real-world examples: What can be backpatched
8. Modernization isn’t all-or-nothing

Upgrading software in a large enterprise is like turning a ship: deliberate, heavy with dependencies, and impossible to pivot instantly. Every change ripples through architecture dependencies, compliance requirements, infrastructure readiness, organizational workflows, and business-critical timelines.

But that doesn’t mean your systems should stay vulnerable. Just that you need multiple, reliable paths to staying secure, including the ability to backpatch what matters, when it matters.

Moderne was founded to help teams modernize and move forward with confidence, clarity, and control. But we’ve seen firsthand that in large organizations, moving forward doesn’t always mean moving fast. Many teams need the ability to stay where they are safely until the timing is right. That’s why we offer backpatching. It gives customers a way to apply security they need now, with the freedom to modernize on their terms.

Backpatching complements modernization

Backpatching isn’t a new idea, but it’s often misunderstood or underused, especially in large organizations. At its core, it’s about applying targeted fixes to older versions of software without triggering a full migration or complex refactor.

In enterprise environments with tightly coupled systems and highly governed change processes, backpatching can be the difference between staying exposed and staying protected. It doesn’t replace modernization. It complements it, giving you more control over when and how you move forward.

We have also shown that backpatching end-of-life vulnerabilities can be industrialized. From “we need a patch” to “it’s in your repository” now takes almost no time at all.

AI-accelerated vulnerability discovery in OSS drives the need for backpatches to quickly close security gaps. Open source libraries are built by thousands of people who gave their work away. Then a vendor adds one small fix, hides it, and charges for the whole thing. We think that’s backwards. That’s why we started the Backpatch Alliance where we believe if the code was open, the fix should be too.

Moderne takes a different and more cost-effective path by offering not only the creation of the patch at cost but the means for distributing across your codebase as well. Plus, it’s part of a broader modernization platform, enabling you to secure what’s in place today and streamline upgrades when the time is right.

Backpatch Alliance exists to mutualize the cost of backpatching end of life software.

The community funds the patches and members own the fix in perpetuity. Fixes are in the open, so you can see exactly what changed and how it was tested. Moderne experts produce them at cost.

What you get with every backpatch

Every backpatch ships the same way. The source is public in a dedicated GitHub organization, and the original maintainers signed the launch commits. Each backpatch carries cherry-pick metadata that links it to the upstream commit it came from, so you can trace any fix back to its origin. It passes the upstream test suite, with tests adapted for the older API where needed. Maven or Gradle resolves it like any other dependency, so your build doesn’t change and you don’t need the Moderne Platform to use it.

How Moderne makes backpatching work at scale

Enterprise teams don’t resist upgrades out of reluctance. They do it out of necessity. Most large organizations run on:

• Complex interdependencies

• Custom-built frameworks

• Production systems that can’t afford regression risk

Upgrading everything, everywhere, all at once isn’t always feasible.

Backpatching offers a practical alternative. It lets teams remediate real security issues, apply functional fixes, and extend the life of trusted systems without destabilizing them, incurring unnecessary migration costs, or paying a premium for extended vendor support.

But even when backpatching is the right move, it’s rarely as simple as it seems. Across large enterprises, code is spread across hundreds of repositories and owned by dozens of teams. For many organizations, knowing what to patch, how to patch it, and where to apply the change can feel just as challenging as upgrading itself.

What begins as a simple fix can quickly compound into a larger effort. Updating foundational dependencies means you also need to update any internal libraries that rely on them. For example, when you patch spring-security, if you have a custom-core library that depends on it, you then have to update custom-core to use the new patched version of spring-security. Then once that new version is published, every service or application that depends on custom-core must also be updated. With each layer, the update touches more of the codebase, creating a spiral of compounding complexity.

But with the right tooling and automation, what might otherwise be an organizational tangle becomes a structured, predictable process. Moderne turns backpatching into a repeatable, reliable, and fully visible process delivered as a full-service solution.

Managing ripple effects with automation

Once the patched library is published to your artifact repository, Moderne helps you manage the cascading upgrade process:

1. Run the Upgrade Dependency Version recipe to update internal libraries (like custom-core) that directly depend on the patched version

2. Publish new versions of those internal libraries to your artifact repository

3. Use Moderne’s recipe builder to generate a custom recipe that applies the new internal versions across all dependent services

4. Repeat as needed until the patch and updated dependent libraries have successfully propagated through your ecosystem

What could otherwise require a tedious, manual effort from dozens of teams affecting hundreds of repos, is handled through structured, scalable automation.

Full visibility and control of backpatching

Every step is visible and under your control. The Moderne Platform gives you:

• Previews of every change

• Side-by-side diffs showing what was updated

• Centrally managed pull requests

• Live progress tracking by repo, PR, and owner

Since it’s driven by OpenRewrite recipes, this process becomes a reusable capability, not just a one-off fix. When the next CVE hits or another library needs patching, you already have the system in place to respond quickly and confidently. With backpatching services, Moderne offers a scalable, sustainable alternative to costly vendor support contracts or ad hoc internal patching.

Real-world examples: What can be backpatched

Backpatching applies across a wide range of real-world challenges that enterprises face today. Examples include:

• Log4j (CVE-2021-44228): Rewriting vulnerable logging usage and removing unsafe patterns without replacing the entire logging framework

• Spring Security 4.x: Fixing outdated CSRF handling and other vulnerabilities while avoiding full framework migration

• JDK 8 or 11: Applying security updates in environments that can’t yet upgrade to JDK 17+ due to infrastructure or certification constraints

• Custom internal libraries: Patching unmaintained but critical in-house libraries, tailored to your organization’s specific usage

Modernization isn’t all-or-nothing

Backpatching doesn’t mean avoiding modernization. It means modernizing on your terms. It helps organizations stay secure without relying on expensive vendor support or rushing into upgrades before they’re fully scoped and staffed.

With Moderne, backpatching and modernization work side by side. You can patch what matters today, and use the same platform, recipes, and controls to drive upgrades tomorrow, whether that’s to Spring Boot 3.5, JDK 21, or beyond.

You stay in control. You choose the path. Moderne helps make both secure, scalable, and visible.