Terry KS SINGAPORE, 1 SEPTEMBER 2026 – Broadcom Inc. announced the launch of TrueSource, a comprehensive portfolio of commercially supported and verifiably built open source software designed specifically for enterprise environments. The initiative aims to address growing security challenges in open source supply chains, particularly as AI tools accelerate the speed at which attackers exploit code vulnerabilities.
The TrueSource portfolio brings together three primary offerings:
Spring Enterprise: Focused on the Spring ecosystem, this service delivers secure, curated releases and proactive security scanning across its dependency tree. Every patch is verified by human engineers rather than relying solely on automated AI fixes, which recent research shows can frequently break application functionality. Coverage includes over 5,000 verified Java libraries and managed dependencies like Apache Tomcat and Kotlin.
TrueSource Trusted Artifacts: Provides clean-room SLSA Build Level 3 builds for libraries across Java, Python, and Node.js. It also integrates the Bitnami Secure Images catalog, offering hardened container images for hundreds of open source packages.
TrueSource Data Services: Extends enterprise support, security, and deployment automation to critical data engines, including PostgreSQL, RabbitMQ, MySQL, and Valkey.
Unlike fully automated AI-driven patching solutions, Broadcom’s approach prioritizes accountable engineering and upstream community collaboration. Security fixes are applied in partnership with open source maintainers to ensure system stability, code integrity, and long-term software health.
All TrueSource offerings, including Spring Enterprise, TrueSource Trusted Artifacts, and TrueSource Data Services, are available through tiered site licensing options.