Quarkus

NEOMSA ESB Release Strengthens Supply Chain Security Through SBOM and Dependency Hardening

Neoflex has released a new version of its NEOMSA ESB integration platform with a primary focus on cleaning up the software bill of materials and eliminating critical and high-severity vulnerabilities. The team automated SBOM generation using CycloneDX, ran SCA scans with Grype and OWASP Dependency-Check, and performed SAST and secret scanning across all build pipelines. Instead of blindly updating to the latest versions, engineers applied minimal fixed versions for each advisory while handling complex cases involving transitive dependencies, locked files, and deprecated build tools. The effort reduced the total package count from 5,872 to 1,683 after migrating the frontend build to Vite in Camel Karavan 4.18. Remaining medium and low findings were tracked in DefectDojo with clear remediation timelines. The changes deliver measurable risk reduction for on-premise deployments in critical infrastructure and financial organizations.