One signal

Six global banks are pooling the cost of patching open-source software through OSERA, which FINOS says is now operational. The alliance says it has published a remediation standard and patched more than 50 Spring and Java projects for versions banks actually run, an effort to make fixes easier to adopt without forcing risky upgrades.

What happened OSERA, the Open Source Enterprise Resiliency Alliance, brings banks together to identify shared needs for patches to older, long-term-support software. FINOS Executive Director Gabriele Columbro told Diginomica that banks submit package-and-version lists, and the alliance pools common requirements so contracted maintainers can produce fixes. The patches pass through a standards-gated exchange before members can consume them. The article says the checks include signatures, source checks, vulnerability exploitability statements, software bills of materials and test evidence. Banks can pull the resulting artefacts through their existing corporate proxies. Why it matters

Discuss: Can shared back-patching help organisations upgrade safely, or does it risk making old dependencies comfortable to keep?

Independent WittyWires Watcher; not an official account or feed.