Broadcom introduces TrueSource, a portfolio of commercially supported and verifiably built open-source software. Spring Enterprise, TrueSource Trusted Artifacts, and TrueSource Data Services are all part of this portfolio. Patches are reviewed by engineers, not by AI alone.
With TrueSource, Broadcom aims to offer companies a single point of contact for the open-source components their applications run on. The portfolio consists of three components. Spring Enterprise remains the flagship for the Spring ecosystem; TrueSource Trusted Artifacts provides clean-room builds for the Java world, Python, and Node.js; and TrueSource Data Services focuses on data engines such as PostgreSQL, RabbitMQ, MySQL, and Valkey. The latter branch was previously known as VMware Data Services.
The approach is based on a few principles. Broadcom engineers build each library and verify it against a reference architecture. Broadcom sends fixes upstream to the maintainers themselves, and it supports those communities with time and funding. Additionally, automation scans customer repositories and opens pull requests that follow the lowest-risk path to a fix.
AI as a tool, not a replacement
Thanks to AI, attackers can turn vulnerabilities into working exploits within a matter of hours, which is driving interest in fully automated patching. Broadcom cites research from 1Password’s Off-by-1 Labs, which found that only 26 percent of 6,000 AI-generated patches fixed a vulnerability without breaking the application.
Broadcom does use AI, but on the detection side. Over the past five months, Spring engineers have consumed more than 12 billion tokens on Frontier models to scan code and dependencies. Every patch generated from this process is verified manually. “AI is a phenomenal accelerant for the engineers who maintain this software, not a replacement for them,” says Purnima Padmanabhan, vice president and general manager of the Tanzu division.
Building on the June Spring update
TrueSource follows the announcement in June, when Broadcom said it released the largest security update in Spring’s 23-year history. As part of that update, Tanzu Spring customers received day-zero CVE-only patches via the Spring Enterprise Repository, even before publication in open source. Broadcom also expanded Bitnami’s clean-room build architecture to all Java dependencies, with more than 100,000 validated dependency builds. Spring Boot 4.0 alone manages 1,768 dependencies.
The coverage extends beyond Spring itself: over 5,000 verified Java libraries, including Apache Tomcat and Kotlin, built and signed to the exact versions pinned by each supported Spring Boot release line. Trusted Artifacts delivers SLSA Build Level 3 builds and also includes the Bitnami Secure Images catalog.
Spring Enterprise, TrueSource Trusted Artifacts, and TrueSource Data Services are available through tiered site licenses. Customers with a valid license can also submit vulnerabilities that have not yet been made public for early remediation. For organizations in critical infrastructure, there is a separate program providing access to patch insights and mitigation advice.