Broadcom Inc. announced TrueSource by Broadcom, a portfolio of commercially supported, verifiably built open source software for the enterprise. TrueSource brings together Spring Enterprise, the company?s flagship offering for the Spring ecosystem; new TrueSource Trusted Artifacts, which provides secure clean-room builds of the broader Java ecosystem, Python, and Node.js and incorporates a secure catalog of hardened container images; and TrueSource Data Services, a new offering that provides trusted artifacts, support, and deployment expertise for PostgreSQL, RabbitMQ, MySQL, and Valkey data engines. TrueSource Offerings are Built on Common Principles: Curated, prescriptive, enterprise-grade libraries and artifacts: Every library and artifact is selected against a reference architecture, built, and verified by Broadcom engineers, so enterprises consume open source with confidence.
Remediation with maintainers, not around them: Broadcom contributes fixes upstream and backs community maintainers across the industry with engineering time and funding. Patch automation tooling and security visibility: Automation scans customer repositories, assesses the blast radius of each release before they consume it, and opens pull requests that apply the lowest-risk remediation path, with dashboards showing their security team exactly what?s fixed and what remains. Early access with collaboration: Properly licensed customers of any TrueSource offering will have the option to bring not-yet-public vulnerabilities they discover for early access to remediation.
In addition, there is a special program for critical infrastructure organizations to get dedicated access to patch insights and mitigation advice. Broadcom Sets the Enterprise Standard with Spring Enterprise: Building on Broadcom?s June commitment to Spring supply chain security, this announcement arrives as AI accelerates exploitation, allowing attackers to weaponize vulnerabilities in hours. While this has fueled interest in fully automated, AI-generated patching, research indicates this approach carries significant operational and security risks.
In new testing, 1Password?s Off-by-1 Labs found that only 26 percent of 6,000 AI-generated patches fixed vulnerabilities without breaking applications. They concluded that automated patches are not yet safe enough to trust without significant human oversight. Spring Enterprise provides secure, curated releases of Spring from the team that creates and maintains it.
That stewardship comes with over 20 years of experience in making compatibility, performance, and security judgements that have allowed Spring to flourish. Customers receive: Proactive scanning with human-verified patches: Broadcom engineers continuously scan Spring and its dependency tree with frontier model analysis, then verify every patch by hand, finding vulnerabilities before attackers do. In the past five months, engineers have already spent more than 12 billion tokens against frontier models.
Simultaneous patches across every release line: Because Broadcom maintains Spring, every supported release line is patched before a CVE is ever published. Disclosure and remediation for OSS and long term support versions arrive together, so no version is left waiting for a fix. The whole dependency tree, not just Spring: Coverage extends beyond Spring itself to its managed dependencies, including Apache Tomcat, Kotlin, and across the full dependency tree: more than 5,000 verified Java libraries, built and signed at the exact versions pinned by every supported Spring Boot release line.
Security fixes without the upgrade: Full point releases bundle fixes with changes that demand testing. CVE-only patches carry the remediation alone, so security teams can push them to production in hours, not weeks. TrueSource Trusted Artifacts Extends Coverage Across Ecosystems: TrueSource Trusted Artifacts provides secure, clean room SLSA Build Level 3 builds of libraries across the Java ecosystem, Python, and Node.js.
Broadcom?s curation process ensures that the libraries conform to a reference architecture and are supportable by the maintainers of record. Thousands of engineers across Broadcom?s software divisions scan, fix, contribute to, and consume them every day in the software that runs the world?s most essential businesses. The offering also includes the Bitnami Secure Images catalog, adding hardened, verifiably built container images for hundreds of commonly used open source packages to the same commercial offering.TrueSource Data Services brings it to the data tier: TrueSource Data Services extends the TrueSource promise to the data engines enterprise applications depend on: PostgreSQL, RabbitMQ, MySQL, and Valkey.
A flawed patch can put the data itself at risk, so remediation takes operational judgment. Broadcom brings that judgment, from hardening and supporting these engines for the world?s most demanding enterprises, to curate a validated distribution inclusive of these data engines and the associated critical extensions, Operators and Helm Charts. The offering includes deployment automation for these engines as well as visibility into the security and operational posture.
Broadcom has already invested behind this position, applying AI where it is effective. As announced in June, its Spring engineering team has scaled frontier model based scanning and validation across the dependency ecosystem, with every resulting fix authored, reviewed, and verified by engineers who know the code. That work answered the more than 1,700 percent surge in monthly security advisories reported by the Spring community and delivered the largest set of security patches in Spring?s 23-year history.Availability: Spring Enterprise, TrueSource Trusted Artifacts, and TrueSource Data Services are available with simple, tiered site licensing options.
