Broadcom Extends Its Open Source Bet to Valkey, PostgreSQL and MySQL

Broadcom has introduced TrueSource, a new commercial portfolio designed to provide enterprises with verified and supported versions of open source components. The initiative expands the work the company already does around Spring into the Java, Python and Node.js ecosystems, Bitnami images, and data engines including PostgreSQL, RabbitMQ, MySQL and Valkey. One of the less visible parts of the announcement may also be among the most important: Broadcom is committing to send security fixes upstream and support maintainers with engineering resources and funding.

The key points about Broadcom TrueSource in 20 seconds

• TrueSource will provide commercially supported, verified builds of open source software.
• Coverage includes Java, Python, Node.js, Bitnami, PostgreSQL, RabbitMQ, MySQL and Valkey.
• Broadcom says vulnerabilities will be fixed with upstream projects, rather than through isolated private patches.
• The company combines AI-assisted analysis with human engineering and verification.
• The announcement highlights a growing question: who actually funds the security work behind the open source software enterprises depend on?

There is an obvious commercial angle to the move. Broadcom wants to sell large organizations something many of them increasingly need: an open source software supply chain with known provenance, verifiable builds, commercial support and a more predictable response when vulnerabilities emerge.

But the announcement also raises a much broader issue.

A significant part of the world’s technology infrastructure depends on projects maintained by relatively small communities. Companies may run millions of instances of a library, database or component, while responsibility for handling a critical vulnerability can ultimately fall on a handful of people.

Artificial intelligence is making that imbalance even more visible.

TrueSource adds an enterprise layer around open source

Broadcom has divided TrueSource into three main offerings.

Spring Enterprise remains focused on Spring and its dependency tree. Broadcom says its coverage extends to more than 5,000 verified Java libraries and includes components used by supported Spring Boot release lines.

The second component, TrueSource Trusted Artifacts, extends the approach to Java, Python and Node.js.

Broadcom describes clean-room builds produced according to SLSA Build Level 3, part of the Supply-chain Levels for Software Artifacts framework. The offering also incorporates the Bitnami Secure Images catalog, providing hardened and verifiably built container images for hundreds of widely used open source packages.

The third component is particularly relevant to infrastructure teams: TrueSource Data Services.

This is where PostgreSQL, RabbitMQ, MySQL and Valkey come in. The offering includes validated artifacts, support, deployment automation, extensions and associated components such as Operators and Helm Charts.

Broadcom’s argument is that downloading a package from a public repository is no longer enough for many enterprise environments.

Organizations increasingly need to know where software came from, how it was built, what dependencies it contains, which vulnerabilities affect it and what will happen when an urgent security update becomes necessary.

Valkey shows where the real problem lies

The inclusion of Valkey is particularly representative of this challenge.

Valkey emerged in 2024 as an open source project under the Linux Foundation following Redis’ licensing changes. It has since become an important alternative for organizations looking for an open source in-memory data store.

But adopting an open source project also means someone has to maintain it.

One of the project’s maintainers noted following Broadcom’s announcement that the number of vulnerability reports reaching Valkey has steadily increased over the past year, partly because artificial intelligence has made code analysis more accessible.

That growth has a positive side.

Finding a vulnerability earlier gives maintainers a chance to fix it before it becomes a bigger problem for users.

The difficult part comes after discovery.

A security report does not automatically turn into a patch.

Someone still has to reproduce the issue, verify that it actually exists, assess its severity, determine which versions are affected, write the fix, make sure it does not break existing behavior and coordinate the release.

If several branches are supported, maintainers must also determine how to apply the fix safely across each of them.

And when the vulnerability is not yet public, another sensitive task appears: coordinating an embargo so that vendors and users can receive a fix without prematurely publishing information that could make exploitation easier.

AI can dramatically reduce the cost of the first stage, finding suspicious code, without necessarily reducing all the work that follows by the same amount.

More AI-discovered vulnerabilities also mean more human work

Broadcom says it is seeing a similar phenomenon around Spring.

According to the company, monthly security advisories affecting the Spring community have increased by more than 1,700%, while its engineers have used more than 12 billion tokens from frontier AI models over the past five months to analyze Spring and its dependencies. These are Broadcom’s own figures and should be understood in the context of the TrueSource launch.

The company does not intend to let AI automatically apply everything it discovers.

Its approach is to use models to accelerate analysis while keeping engineers responsible for authoring, reviewing and validating the resulting fixes.

Broadcom also cites testing by 1Password’s Off-by-1 Labs involving 6,000 AI-generated patches. According to those results, only 26% fixed the vulnerability without breaking the application.

That figure does not demonstrate that every automated patching system has the same success rate. Results depend on the dataset, tools and methodology used.

It does, however, illustrate a familiar problem: eliminating vulnerable behavior is only part of the job. A patch must also preserve the software’s intended behavior.

For a database or component used by thousands of applications, that requirement can be even more important.

The risk of fixing vulnerabilities outside the upstream project

This is where one of the most interesting parts of TrueSource appears.

Broadcom says its policy will be to remediate vulnerabilities with maintainers, not around them.

When it finds and fixes problems in open source projects, the company says it will contribute those fixes upstream and support maintainers with engineering time and funding.

This is not simply a matter of being a good open source citizen.

Maintaining private patches creates technical debt.

A company can discover a vulnerability in a library, modify the code internally and solve its immediate problem. But from that moment onward, it is maintaining a version that differs from the upstream project.

When the next release arrives, engineers have to determine whether the modification is still necessary, whether it remains compatible and whether it conflicts with newer changes.

Multiply that across hundreds of components and the model becomes difficult to sustain.

Contributing a fix upstream allows maintainers who understand the project to review it, makes the patch available to other users and helps ensure that the correction remains part of future releases.

It also reduces the proliferation of security forks silently maintained by different vendors.

Aiven and Broadcom point to the same issue with Valkey

Valkey’s recent experience provides an example of how this collaboration can work.

A project maintainer highlighted Aiven as one of the companies contributing engineering resources to Valkey since the project’s early days rather than simply consuming its releases.

For one recent security fix, according to the maintainer, Aiven provided a fully verified patch it had received from a customer and offered to help with the remediation if required.

That is very different from simply submitting an automatically generated report saying that a vulnerability might exist.

For maintainers, a report accompanied by a reproducer, analysis and a potential fix can substantially reduce the amount of work required to turn a discovery into a safe security update.

The distinction is likely to become increasingly important.

AI tools allow more researchers, companies and users to discover potential vulnerabilities. If the cost of generating reports falls much faster than the cost of validating them, open source projects could face a new security asymmetry: finding possible problems becomes progressively cheaper while the human capacity to process them remains limited.

Open source sustainability begins after the download

TrueSource also reflects an evolution in the business models built around open source.

For years, many companies have created commercial services on top of open source projects. That model can be entirely compatible with their licenses, but there is an important difference between consuming a project and helping maintain it.

Security makes that difference particularly visible.

A critical vulnerability cannot sit unresolved for weeks simply because a project has too few maintainers available.

Nor is it particularly sustainable for organizations generating substantial revenue from a technology to depend exclusively on the voluntary time of the people maintaining its code.

Broadcom intends to turn part of that requirement into a commercial product. Customers will pay for verified artifacts, support, vulnerability visibility and a more controlled path to security remediation.

The company will also allow properly licensed TrueSource customers to report vulnerabilities that have not yet been publicly disclosed and receive early access to remediation. Critical infrastructure organizations will have access to a dedicated program providing patch insights and mitigation guidance.

It will take time to assess how Broadcom’s commitment translates into concrete contributions across each community.

But the principle matters beyond a single vendor.

Enterprise open source does not end when someone runs apt install, deploys a container or adds a dependency to an application.

That is where a relationship begins, and it can last for a decade.

As AI multiplies the industry’s ability to discover vulnerabilities, the hardest part still depends on people who understand the code, know how to fix it safely and are willing to maintain those fixes for years.

Frequently asked questions

What is Broadcom TrueSource?

TrueSource is a commercial portfolio of verified and supported open source software from Broadcom. It includes Spring Enterprise, TrueSource Trusted Artifacts and TrueSource Data Services.

Which projects are covered by TrueSource Data Services?

Broadcom has announced coverage for PostgreSQL, RabbitMQ, MySQL and Valkey, including validated artifacts, support and deployment-related tooling.

Will Broadcom use AI to generate security patches automatically?

Broadcom uses AI models to analyze code and identify potential vulnerabilities, but says Spring fixes are authored, reviewed and verified by engineers. Its approach keeps human verification at the center of the security process.

Why is contributing patches upstream important?

Because it avoids maintaining private modifications that diverge from the original project. An upstream fix can be reviewed by maintainers, distributed to the wider community and properly maintained in future releases.