FINOS · OSERA | Open Source Enterprise Resiliency Alliance

Secure open source. In production. At scale.

OSERA is the Open Source Enterprise Resiliency Alliance: a FINOS initiative helping regulated institutions remediate open source supply chain risk at scale in the era of AI-enabled cyber threats — neutral, sovereign, standards-based, and built for institutions of every size. Operational resilience, without the lock-in.

Supported by a growing Alliance of financial institutions and open source supply chain leaders, including:

Open source packages hardened and vulnerabilities addressed by OSERA

We're addressing new vulnerabilities and stewarding new projects every day. Use the live search to find packages that might be useful in your estate.

Loading published metrics…

Featured lines

High value open source project versions still running in production, hardened in the open. Use our open source Risk Navigator tool to see what would be useful for your estate.

Java

Spring Boot

2.7

The application line still running in production. Boot 2.7 carries the framework and the libraries a typical enterprise Boot application pulls in.

Java

Spring Framework

5.3

The core framework line those applications run, maintained on its own alongside Boot.

Java

Log4j

1.2 2.17 2.24

The logging lines still embedded across the estate, from the 1.2 release through two maintained 2.x lines.

Java

Jackson

2.13 2.15 2.19

Databind, core, and the Jackson modules. The widest set of forks in the public org, maintained on three version lines.

JavaScript

crypto-js

4.1

The JavaScript crypto library still embedded in front ends and Node services, maintained past its upstream end of life.

Financial industry grade standards. Bigger than OSERA.

Patching is only half of the problem. Agreement on how any fix is produced, verified, and attested is equally fundamental to enable regulated consumption at scale. OSERA's financial-industry-backed remediation standards are the acceptance gate for OSERA releases, and the shared bar large institutions can use to consume packages from upstream and from commercial producers.

Feeds and Advisories

OpenVEX and CycloneDX feeds, so a release states what it fixes and scanners can read that statement.

Fork Management

How patched-source repositories, patch branches, and baseline tags are named and published.

Patch Application

How a patch feed is discovered and applied across a dependency estate.

Recipient Evidence

Concise guidance on what changed, and which surface a recipient should test.

Release Process

Version naming, approved producers, test reports, bytecode compatibility, and publication hygiene.

Source Changes

Whether a fix is an upstream backport, the link to that change, and license headers on new files.

Institutions and producers, in one neutral venue

Not a vendor and not a buyers' club. The institutions that run open source meet the firms that maintain it. No single firm sits in the middle.

End users · demand

Institutions of every size

Premier members govern and prioritize
General members consume the same releases
Open to any jurisdiction

Compare membership →

The open, governed platform

FINOS neutral governance · one remediation standard · public source

IP & antitrustConfidentialityOpen standardsUpstream-first

Producers · supply

Vendors and maintainers

Patch and infrastructure vendors conform once
Maintainers bid to take a line
FINOS membership is the door

Become a FINOS member →

Three ways to get involved

Incubated where the regulatory bar is highest, and open to institutions of every size, in every country, and to technology firms with upstream expertise. Three ways in.

🏦

Financial institutions

Fund and govern as a Premier member, or consume the same attested releases as a General member. General fees run from $15k to $90k by firm size, so smaller and non-US institutions can take the same fix.

Become an OSERA member

🛠

Patch and infrastructure vendors

Commercial patch producers and supply-chain vendors join FINOS to conform to the Remediation Standards. FINOS members can also bid to maintain a line. No OSERA membership required.

Become a FINOS member

📦

Build it yourself

Every maintained line is public under the upstream licence. Build from the forks, and adopt the same open standard the exchange uses as its gate.

Build from GitHub

Get involved

Use the form below to propose a project for the alliance to consider maintaining, offer your firm as a tech producer, or share your interest in joining the effort. The FINOS team will follow up with next steps.

Form submissions route to membership@finos.org. Prefer to talk first? Join the weekly Supply Chain Resiliency formation call.