Broadcom Commits to Securing Key Open‑Source Python and Java Libraries (Spring, RabbitMQ, and More)

Broadcom announced on September 1 that it will take on security responsibility for several important open‑source software projects, explicitly naming the Spring Java application framework and RabbitMQ.

The company traced the history of Spring, noting that Australian developer Rod Johnson created its predecessor in 2002, later founding SpringSource to commercialize the software. SpringSource was acquired by VMware, merged into the EMC‑VMware joint venture Pivotal Software, which pioneered micro‑services and cloud‑native development. Most of Pivotal’s software was subsequently folded into VMware’s Tanzu brand, with Tanzu Kubernetes Grid continuing as the vSphere Kubernetes Service and supporting containerized applications in the Cloud Foundation suite.

Broadcom’s Tanzu division sells the VMware Tanzu platform, a bundled PaaS offering that includes Spring implementations. Because Spring is free and open‑source software (FOSS), the Tanzu team has contributed heavily to many of its constituent open‑source components and other commonly used FOSS projects.

Just before VMware’s annual Explore conference, Broadcom introduced a new product called TrueSource. TrueSource will identify the critical components that Spring users depend on and “work hard” to keep those components secure.

According to Tanzu vice‑president Purnima Padmanaban, “Our philosophy is to provide a solution focused on delivering clean, safe components. We select and build each Spring library, database, and other Java component.” She added that the commitment also extends to non‑Spring code, offering “TrueSource trusted artifacts” for the broader Java ecosystem, Python, and Node.js.

Broadcom stated that its library‑management process ensures the libraries conform to reference architectures and receive support from maintainers. Thousands of Broadcom engineers scan, fix, contribute, and use these libraries daily.

A VMware spokesperson emphasized that Broadcom’s business unit will collaborate with open‑source maintainers, provide upstream fixes for any active project, and maintain Spring and RabbitMQ directly. The spokesperson stressed that community maintainers must remain the authoritative source.

The announcement reflects the open‑source community’s desire for vendor contributions and illustrates how software vendors sometimes adopt “reverse‑feeding” measures to stay competitive when building products on top of free open‑source software.