Broadcom rolled out security updates to the Spring and Java ecosystems tied to helping organizations navigate a surge in AI-detected security threats.

The updates are through Broadcom’s Tanzu business and include what it claims are the “largest set” of Spring security updates splashed across that open-source platform in its 23-year history. Broadcom is also opening its “clean-room build architecture” so Java dependencies can be built for the Spring ecosystem.

The updates are tied to a surge in detected security vulnerabilities, with Broadcom claiming the number of monthly security advisories reported by the Spring community increased 1,700% from March to April of this year. Toward fighting that surge, Broadcom’s Spring engineering team has increased its investment in AI-assisted security analysis, including frontier model-based scanning and validation workflows that can proactively identify vulnerabilities, assess remediation paths, and validate fixes across the ecosystem.

Broadcom is part of the Anthropic-based Project Glasswing initiative that was launched earlier this year. While not referenced as part of the latest update plans, Glasswing is an AI-powered large language model (LLM) that has shown a strong ability to find high-severity vulnerabilities.

Day zero access to CVEs

The Tanzu Spring platform now also provides day zero access to validated common vulnerabilities and exposures (CVE) patch-only releases through its Enterprise Repository before those patches are released to open source. The source of these patches ensure that they are validated by Broadcom, with the patches themselves designed to isolate the security fixes from any other change to the platform.

Broadcom did add that it will continue to issue CVEs for all versions of every Spring project under open-source support and for older versions under Tanzu Spring enterprise support.

"Spring is one of the most widely adopted application development frameworks in the world, and as its steward, we have a deep responsibility for its security,” Purnima Padmanabhan, VP and GM for Broadcom’s Tanzu Division, noted in a statement. “Because we maintain Spring and are the sole committers, we can better secure it at the source for everyone who depends on it. This investment is about two things we will never separate: the health of the Spring community and the security of our customers who trust Spring to run their business."

Tanzu Spring customers are also gaining access to Supply chain Levels for Software Artifacts (SLSA) level three-validated software supply chain for Java dependencies; coverage across the “full transitive dependency graph” managed by the Spring Boot bill of materials (BOM); and secured dependencies that are built and tests across every supported Spring iteration.

“This extensive investment to provide Spring customers with a clean room-built, verifiable software supply chain across all supported versions of Spring represents a leap forward in strengthening trust, transparency, and resilience across one of the world’s most widely adopted Java application development platforms,” Broadcom wrote of the support. “This capability gives customers validated dependencies across both current and end-of-life Spring versions, helping customers reduce software supply chain risk while continuing to benefit from the productivity and consistency of Spring Boot's dependency management model.”

The latest security updates come on the heels of Broadcom’s Tanzu platform-as-a-service (PaaS) gaining agentic AI-focused security features. These updates also included tighter Spring AI integrations.

“The nice thing about Spring AI that we are now realizing is that when you just ask AI to code every time, it will code something different for the same problem. So if you don't have a framework like Spring, it will do all the boring stuff, like get a log for me, persistent credential, it may do differently every time, and it increases a huge drift and proliferation in your code,” Padmanabhan told SDxCentral at that time. “So what we are doing is with Spring AI … we are also including guardrails so that AI builds consistent code. There is guidelines and guardrails, and an enterprise developer doesn't have to go and figure this out because of the framework. We're bringing the power of framework, so bringing determinism while maintaining creativity.”