By ByteBot
Spring security advisories are up 1,700% month-over-month. Open source supply chain attacks now land every three days on average — up from once a month a year ago. And the AI tools developers are using to patch that backlog? They fix a vulnerability without breaking anything just 26% of the time. Broadcom used that last number to justify TrueSource, a commercial open source security portfolio announced at VMware Explore on August 31. It covers Spring, Java, Python, Node.js, PostgreSQL, RabbitMQ, MySQL, and Valkey — and it makes the case that human engineers, not AI automation alone, have to own every patch that ships.
What TrueSource Is
TrueSource bundles three products under a tiered site license. Spring Enterprise covers 5,000+ verified Java libraries pinned to specific Spring Boot versions, including Apache Tomcat and Kotlin dependencies. TrueSource Trusted Artifacts extends that to the broader Java ecosystem, Python, and Node.js — 100,000+ validated dependency builds in total — plus the Bitnami Secure Images catalog of hardened, verifiable container images. TrueSource Data Services handles PostgreSQL, RabbitMQ, MySQL, and Valkey with Kubernetes Operators, Helm Charts, and deployment automation included.
None of those components are new. What Broadcom is selling is the verification layer on top: clean-room SLSA Build Level 3 builds, human-reviewed patches, and coordinated upstream submissions to the original maintainers rather than proprietary forks that diverge and eventually rot.
The AI Patch Problem Is Worse Than You Think
The 26% success rate comes from Broadcom’s own testing of 6,000 AI-generated patches. That figure — three out of four AI-generated patches either failing to fix the vulnerability or breaking the application — is striking, but it lines up with what other teams are quietly reporting. Broadcom’s engineers spent 12 billion tokens running frontier AI models against their codebase over five months, using AI to surface and triage vulnerabilities at scale. Then they handed every patch to a human engineer to write and verify before release.
“Trust cannot rest on unverified, machine-generated patches. It has to rest on accountable engineering.”
Ram Velaga, SVP and GM, Broadcom
The practical upside for customers: TrueSource subscribers receive patches before the CVE is publicly disclosed, deployed simultaneously across all supported release lines. Organizations running older Spring or PostgreSQL versions get the fix without being forced into a major version upgrade first.
What SLSA Build Level 3 Actually Means
SLSA (Supply-chain Levels for Software Artifacts) is an industry security framework. Level 3 sets a high bar: builds run in ephemeral, isolated environments with no shared state between them, the build process cannot access the network during compilation, and signing keys are separated from any user-controlled build step. Every artifact requires two-party code review before it can be built. Even if an attacker compromises a developer’s credentials, they cannot push malicious code through without clearing that review gate.
Bitnami Secure Images — now part of TrueSource Trusted Artifacts — add Software Bills of Materials (SBOMs), CVE scanning reports, and Vulnerability Exploitability eXchange (VEX) documents to each container image. The catalog moved away from Docker Hub to a Broadcom-controlled registry earlier this year over supply chain concerns.
The Catch Nobody Is Saying Loudly
Broadcom is solving a real problem. The supply chain attack numbers are real — 454,600 new malicious open source packages appeared in 2025, a 75% year-over-year jump. The AI patch failure rate is a real data point the industry needs to reckon with.
But Broadcom’s history makes the framing uncomfortable. The developer community’s reaction has been predictably skeptical, with commenters pointing out that Broadcom previously withheld Spring security fixes from older versions unless enterprises paid. Eighty-six percent of organizations are actively reducing their VMware footprint this year, according to independent reporting. Pricing for TrueSource is listed only as “tiered site licensing” with no public figures — not how a company signals affordability.
This is a classic Broadcom move: identify something enterprises genuinely need, package it well, and charge accordingly. The question is whether the security value justifies the vendor relationship risk. For organizations running Spring applications or PostgreSQL clusters in production without a dedicated supply chain security program, TrueSource looks substantive. For everyone else, the AI patch failure stat is the real takeaway — and it applies whether you use TrueSource or not.
What to Do Now
If your team depends on Spring, Node.js, or PostgreSQL in production, inventory which versions you’re running and whether they’re still receiving community security updates. If you’re evaluating automated patching tools, test your vendor’s patch success rate on your actual codebase — Broadcom’s 26% benchmark is a useful starting point for that conversation. TrueSource is available now through Broadcom’s site licensing program; contact their sales team for pricing.
