Broadcom wants to extend its supported enterprise software model to a much larger slice of open source. The company has introduced TrueSource, a portfolio spanning thousands of Java libraries, Python and Node.js components, Bitnami container images, and data engines such as PostgreSQL, RabbitMQ, MySQL, and Valkey. Beyond commercial support, Broadcom is promising to work with the maintainers of the original projects, send security fixes upstream, and contribute engineering time and funding to those communities.
Broadcom TrueSource: the key facts in 30 seconds
- TrueSource extends Broadcom’s coverage from Spring into Java, Python, Node.js, and Bitnami containers.
- TrueSource Data Services adds PostgreSQL, RabbitMQ, MySQL, and Valkey.
- Broadcom will offer verified builds and curated artifacts for enterprise environments.
- Vulnerabilities will be fixed with human review and contributions to the upstream projects.
- The company says AI helps uncover flaws, but it doesn’t replace the work of maintainers.
The initiative arrives as companies are consuming more open-source software than ever, while pressure keeps mounting on the people who maintain their dependencies. Artificial intelligence is accelerating vulnerability discovery, but finding a potential flaw is only the start of a process that can take days of analysis, coordination, and development work.
TrueSource tries to turn that need into an enterprise service: components whose provenance and build process can be verified, paired with support and a defined path for when a vulnerability shows up.
The offering also touches a problem that has followed open source for years: a company can consume thousands of components for free, but someone has to maintain them when something breaks.
From Spring to thousands of Java, Python, and Node.js packages
Broadcom starts from a particular position because it maintains Spring, one of the most widely used frameworks for building enterprise Java applications.
Spring Enterprise is one of TrueSource’s three pillars. The company says its coverage reaches more than 5,000 verified Java libraries, built on the exact versions pinned by the various supported branches of Spring Boot. It also covers dependencies such as Apache Tomcat and Kotlin.
But TrueSource is meant to reach beyond that perimeter.
TrueSource Trusted Artifacts extends coverage to the broader Java ecosystem, as well as to Python and Node.js. Broadcom describes builds produced in controlled environments and verified to SLSA Build Level 3, within the SLSA (Supply-chain Levels for Software Artifacts) software supply chain security framework.
The idea is that an organization shouldn’t have to rely solely on trusting that the package it downloads is the one it expects to receive.
For many companies this has become a real concern. A modern application can pull in hundreds or thousands of dependencies from external repositories. Each one adds code, maintainers, build systems, and distribution mechanisms that the team building the application has limited control over.
TrueSource introduces a layer of curation and rebuilding.
Broadcom says its engineers will select components following reference architectures, build them, and verify them before distributing them to customers.
The offering also includes Bitnami Secure Images, hardened and verifiable images of open-source packages commonly used in containers.
PostgreSQL, MySQL, RabbitMQ, and Valkey join TrueSource
The third part of the announcement carries this approach down into the data layer.
TrueSource Data Services will offer artifacts, support, and deployment expertise for PostgreSQL, RabbitMQ, MySQL, and Valkey.
It won’t be limited to the core executable. Broadcom is including extensions it considers necessary, Kubernetes Operators, Helm Charts, and automation for deploying these services, along with information about their operational and security status.
The choice makes sense from a risk-management standpoint.
A flawed patch in a library can cause problems in an application. A bad database update can directly affect the availability or integrity of the underlying data.
That’s why Broadcom keeps insisting on human involvement.
The company is using advanced AI models to analyze code, but it rejects the idea that the answer is to automatically trust the patches those models generate.
Broadcom cites an analysis by Off-by-1 Labs, from 1Password, covering 6,000 AI-generated patches. According to those results, only 26% fixed the vulnerability without breaking the applications examined.
That’s a result tied to one specific methodology and can’t be extrapolated to every automated code-generation system. But it shows how hard it is to judge a patch solely by its ability to remove a security flaw.
It also has to preserve the software’s functionality.
AI finds more vulnerabilities, but someone still has to process them
The growth of AI applied to code analysis is creating a seemingly contradictory situation.
The more tools that exist for finding vulnerabilities, the more work can end up landing on the security teams of open-source projects.
Broadcom says monthly security advisories related to Spring have risen more than 1,700%, and that over five months its engineers used more than 12 billion tokens of advanced models to analyze Spring and its dependency tree. These figures come from the company itself, as part of the TrueSource announcement.
Valkey is seeing something similar.
Project leaders have said the volume of reported vulnerabilities has grown steadily over the past year, and that AI has lowered the barriers to finding and reporting potential issues.
For users, it’s a good thing that flaws surface sooner.
For maintainers, it’s a new burden.
Every report has to be reproduced. Then someone has to determine whether it really is a vulnerability, assess its severity, identify the affected branches, and develop a fix.
There’s still the work of checking that the patch doesn’t introduce regressions, backporting it to supported versions, and coordinating its release.
If there’s a security embargo in place, all of that work also has to happen without prematurely revealing details that could help someone build an exploit.
Automation can turn up ten times more vulnerability candidates. It doesn’t automatically multiply by ten the number of people able to verify and maintain the fixes.
Broadcom promises to send fixes upstream
This is arguably the most significant part of the announcement from an open-source standpoint.
Broadcom is committing to remediate with maintainers, not around them.
Fixes developed for TrueSource are meant to be submitted to the original projects, while the company contributes engineering time and funding to maintainers.
Working upstream has a practical consequence.
If a vendor finds a vulnerability and builds an internal patch that never reaches the original project, it ends up maintaining its own variant of the software from that point on.
The next update can touch the same lines of code. A new vulnerability can affect that version differently. And every new branch forces the vendor to maintain and re-test its private patch.
The problem grows quickly once a platform depends on hundreds of components.
Merging the fix into the original project lets it go through review by the people who know the code, and it later becomes part of the releases used by the whole community.
It also reduces security fragmentation.
Valkey and Aiven show how the model can work
Valkey offers a recent example of collaboration between companies and maintainers.
The project has highlighted Aiven’s work since its earliest stages, contributing engineering time in addition to using the software.
In a recent fix, according to one of Valkey’s maintainers, Aiven provided a fully verified patch it had received from a customer and offered to help with the repair process.
The difference compared with submitting just an automated report is considerable.
A good security report can include a reproducible test case, the affected versions, technical analysis, and a possible fix. That cuts down the time maintainers need to turn an alert into a shippable update.
Broadcom intends to follow a similar philosophy with TrueSource.
The company wants its engineers to analyze, fix, and validate issues, but for the result to flow back to the original projects whenever it applies.
How that promise plays out in practice will need to be seen in each community. PostgreSQL, MySQL, Valkey, Python, and the broad Java universe all have very different governance and development structures.
TrueSource also wants to automate getting the patch into production
Security work doesn’t end when a project publishes an update, either.
It still has to be rolled into applications.
Broadcom will include tools that scan customers’ repositories to determine the impact of new versions and that can generate pull requests with what it considers the lowest-risk update path.
Security teams will also get dashboards showing which vulnerabilities have been fixed and which remain outstanding.
The company is even proposing a mechanism for vulnerabilities that aren’t yet publicly known.
Customers with the right licenses will be able to report undisclosed flaws and get early access to fixes. Critical-infrastructure organizations will have a dedicated program with patch information and mitigation guidance.
The model ends up looking less like a traditional package repository and more like a managed supply chain for open-source components.
The open-source business is shifting toward trust
TrueSource also reflects how the business built around open-source software is changing.
Commercial value no longer has to sit in owning the code.
It can sit in proving who built it, verifying its provenance, maintaining versions for years, responding to vulnerabilities, and taking responsibility for making sure an update can reach production with reasonable risk.
AI can speed up part of that process.
It can review huge amounts of code, look for suspicious patterns, and help develop possible fixes. Broadcom is already using it that way within Spring.
But the company itself draws a fairly clear line: the final patch still has to depend on responsible engineering and human review.
This connects to a problem that will likely grow over the coming years.
Discovering vulnerabilities is getting a lot cheaper. Keeping software secure still requires people who understand how it works.
TrueSource is Broadcom’s commercial answer to that gap.
And its success shouldn’t be measured only by how many Java libraries, Python packages, Node.js modules, or databases it manages to add to its catalog.
A far more interesting measure will be how many of the fixes it finds actually end up in Spring, Valkey, and the other open-source projects they came from.
Because using open source is easy. Maintaining, for years, the code that thousands of companies depend on is the part that costs money and time.
Frequently asked questions
What is Broadcom TrueSource?
TrueSource is a commercial Broadcom portfolio meant to provide curated open-source components, built in a verifiable way and backed by enterprise support.
Will TrueSource support Java, Python, and Node.js?
Yes. TrueSource Trusted Artifacts extends coverage to libraries across the Java, Python, and Node.js ecosystems, and also adds Bitnami container images.
Which databases and engines does TrueSource Data Services include?
Broadcom has initially announced PostgreSQL, MySQL, RabbitMQ, and Valkey, along with components and tools tied to deploying and operating them.
Will Broadcom use AI to automatically fix vulnerabilities?
The company uses AI models to speed up the discovery and analysis of potential flaws, but it maintains that fixes must be created, reviewed, and verified by engineers and coordinated with project maintainers.
