Its TrueSource Spring Enterprise users gained early fix access

Broadcom is utilizing artificial intelligence to identify and patch vulnerabilities within its TrueSource Spring Enterprise platform, marking a significant shift in how software vendors manage code se...

TrueSource by Broadcom protects customers from open source software vulnerabilities across libraries, container images, and data engines.

YouTube video by SpringDeveloper

Also: sovereign agentic AI on Tanzu, TrueSource trusted artifacts, reverse engineering ChatGPT Work, agents that took over a wiki, accidental platforms, and a meeting that could have been an email.

Broadcom TrueSource combines Spring Enterprise, trusted Java, Python and Node.js artifacts, hardened containers and data services with human-verified security fixes.

YouTube video by RedMonk

Tom Fenton recaps VMware Explore 2026, including VCF 9.1 updates, AI operations, TrueSource, customer deployments, certification changes, and the conference's new Las Vegas venue for 2027.

Read MoreGeneral third-party Java libraries outside the Spring BOM, plus Python, Node.js packages, and Bitnami Secure Images. Distribution / Sourcing, Broadcom ... 

Broadcom recently announced the TrueSource project during VMware Explore 2026. This initiative offers enterprise customers verified and traceable open-source software builds. These builds also include full commercial support. The project does not aim to commandeer these open-source tools. Instead, it delivers secure, patched, and rebuilt packages. These packages rely entirely on the original upstream source code. Broadcom will not pay the upstream software maintainers.

Broadcom has resolved to make the security of popular open source code its own area of responsibility. The company has launched TrueSource, a commercial program that spans Spring, thousands of Java libraries, the Python and Node.js ecosystems, container images, and several widely used databases. The Foundation of the Program The new program is built upon TrueSource. Broadcom promises to select, build, and verify software components itself, and to remedy any problems found together with the maintainers of open projects.

Broadcom will vertrauenswürdige Builds von Open-Source-Software anbieten. Eigene Entwickler sollen mit KI-Unterstützung Sicherheitslücken stopfen.

Broadcom Expands Spring Security with TrueSource Open Source Portfolio

Broadcom launches TrueSource Trusted Artifacts to provide hardened Spring dependencies, secure open source packages and automated vulnerability remediation.

Broadcom is launching "TrueSource," an effort to curate and secure open-source components used with its Tanzu platform, including Spring, RabbitMQ, and libraries across Java, Python, and Node.js. "The idea is to provide a set of solutions focused on providing clean and secure artefacts," Purnima Pad...

Broadcom is launching "TrueSource," an effort to curate and secure open-source components used with its Tanzu platform, including Spring, RabbitMQ, and libraries across Java, Python, and Node.js. "The idea is to provide a set of solutions focused on providing clean and secure artefacts," Purnima Padmanabhan, vice president of Broadcom's Tanzu Division, told The Register. "We choose and build every Spring library, databases, other Java components," she said. The Register reports: Padmanabhan said that promise means VMware will also provide "TrueSource trusted artifacts" for code that is not part of Spring, including the wider Java ecosystem, Python, and Node.js. "Broadcom's curation process ensures that the libraries conform to a reference architecture and are supportable by the maintainers of record," according to a company statement. "Thousands of engineers across Broadcom's software divisions scan, fix, contribute to, and consume them every day." A VMware spokesperson told The Register the Broadcom business unit "will work with and support maintainers on open source software and we will provide fixes to open source upstream for any active projects." "With Spring and RabbitMQ, we are the maintainers. For other open source software, we will work with the maintainers. We believe that the community maintainers must remain the source of truth," the spokesperson said. This is just the sort of contribution that the open-source community wants vendors to do to reflect the value they extract from software they did not create alone. It's also the sort of thing vendors sometimes conclude they need to do to keep products based on FOSS viable. Read more of this story at Slashdot.

Curate Feeds | Make Collections | Customize Email Briefs

Curate Feeds | Make Collections | Customize Email Briefs

Curate Feeds | Make Collections | Customize Email Briefs