Broadcom has launched TrueSource by Broadcom, a new initiative to take responsibility for securing key open-source software used in its Tanzu product suite, including the Spring Java framework and RabbitMQ. The move sees the company acting directly as maintainer for Spring and RabbitMQ, while pledging to work with maintainers of other widely used open-source projects, reflecting growing pressure on vendors to give back to the open-source communities whose code underpins their commercial products.

Spring originated from work by Australian developer Rod Johnson in 2002 and passed through SpringSource, VMware and the Pivotal joint venture before becoming central to VMware's, and now Broadcom's, Tanzu division. Under TrueSource, Broadcom says it will curate "clean and secure artefacts" for Spring libraries, databases and Java components, and extend "trusted artifacts" to the wider Java ecosystem, Python and Node.js, with thousands of engineers scanning, fixing and contributing to the code. A VMware spokesperson confirmed Broadcom will fix and upstream issues for active projects while insisting community maintainers "must remain the source of truth" outside Spring and RabbitMQ.