Broadcom, a semiconductor and infrastructure software company said on June 9 that it is expanding security investment in the Spring and Java ecosystem with open-source updates and clean-room-built Java dependencies for Tanzu Spring customers.

The California-based company said the move comes as AI tools accelerate the discovery of software vulnerabilities.

The company said its Tanzu business released the largest set of Spring security updates in the framework’s 23-year history.

It added that monthly security advisories reported by the Spring community rose more than 1,700% from March to April 2026.

Broadcom described Tanzu Spring as an enterprise support subscription for the Spring framework that includes extended support and the Spring Enterprise Repository.

It said Tanzu Spring customers now get day-zero CVE-only patch releases through that repository before the patches are released to open source.

The repository can be mirrored into internal artifact managers such as JFrog Artifactory and Sonatype Nexus.

Broadcom said the clean-room dependency builds are intended to provide a verifiable software supply chain and reduce software supply chain risk.

🔗 Source: Broadcom Inc.

Recent Broadcom developments