Integrations / Moderne

The Moderne Integration

Moderne and JFrog have partnered to remediate vulnerabilities in open source dependencies. Moderne fixes the library in an open fork of its source and publishes a signed binary to itsRead More >

Backpatch Alliance repository. Evidence of that binary flows to JFrog, which presents it as a remediation option and attests to it. Read Less >

Start Free Book a Demo

Moderne Integration

Built from an open fork

Moderne backpatches are developed in public forks. Most patch providers treat their fixes as intellectual property, even though the code they are fixing is open source, built for free by the community. Our forks are public: you can read the patch before you buy it.

Buy once, use in perpetuity

Every patch delivered during your subscription is licensed in perpetuity. You renew for the patches that are coming, not for permission to keep using the ones you already have.

An SLA to produce the patches you name

The catalog is shared: a patch produced for one customer goes to all. If a library you depend on isn't covered, you can buy an SLA for Moderne to produce the patches you name.
Related Resources
Moderne Blog

Blog: An Overview of OpenRewrite and Moderne

Read

Frequently Asked Questions

What exactly is a Moderne backpatch?

A discrete, security-only fix applied to the exact end-of-life version of an open source library you already run. Moderne fixes the library in a fork of its source, rebuilds it, and publishes a signed binary to the Moderne Backpatch Alliance repository. It resolves like any other Maven dependency.

What does Moderne cover?

Vulnerabilities in open source dependencies. 60 production-ready backpatches are live today across application frameworks, serialization, Apache Commons and utilities, networking and HTTP clients, integration and messaging, security and cryptography, data and persistence, and logging. The current index is at moderne.ai/backpatch-alliance/coverage, and coverage expands from customer requests.

What is the JFrog Self-Healing Software Supply Chain Security Ecosystem?

A partnership of open-source security companies delivering a single governed pipeline for provable, auditable remediation at agentic speed. Because JFrog Artifactory is where every artifact lives, JFrog ingests each partner’s fix natively, applies the customer’s policy, and produces one signed evidence chain an auditor can verify. Customers choose the best fix; JFrog delivers the governance.

When can we use this?

JFrog Zero-Touch Remediation is open to JFrog EnterpriseX customers immediately and is expected to be generally available in Q4 2026. Customers can schedule a technical walkthrough and live demonstration through the JFrog self-healing landing page, or register for the post-swampUP webinar on how each ecosystem partner integrates into the JFrog Platform.

About Moderne

Moderne is the Agent Tools company that provides deterministic, governed infrastructure for AI coding agents operating across enterprise software systems. As the creators of OpenRewrite, Moderne helps organizations scale AI-driven engineering with organization-wide intelligence and auditable execution, continuously improving software quality while maximizing the value of their AI investments.
Learn More