Broadcom Inc. has released patches for 89 newly discovered vulnerabilities in TrueSource Spring Enterprise, distributing them first to critical infrastructure operators and other qualified early-access customers before the issues become public. The rollout lifts the cumulative tally of vulnerabilities addressed across the TrueSource product line to 408, and it arrives alongside a new tool aimed at helping large organizations manage the patching process itself.
A dashboard for tracking exposure
The centerpiece of this update is TrueSource Hub, a component built into Spring Enterprise that lets enterprises inventory which applications rely on vulnerable code, rank which fixes deserve immediate attention, and monitor remediation progress over time. For organizations running hundreds or thousands of Spring-based services, simply knowing where a flaw exists can be as difficult as fixing it; Hub is designed to close that visibility gap by giving security and operations teams a single place to see exposure across their codebase.
Automating patches inside existing build tools
Alongside Hub, Broadcom is shipping build plugins for Application Advisor that integrate directly with Maven and Gradle, the two build systems most commonly used in Java development. Rather than requiring developers to manually track down and apply security updates, the plugins generate pull requests with the necessary changes already drafted, so teams can review and merge approved fixes through their normal workflow. Broadcom frames this as the practical core of the release: assess every repository, prioritize the fixes that matter, apply them during the build process, and generate audit records that prove remediation occurred.
Legacy support without slowing current releases
A notable design choice is that TrueSource Spring Enterprise pushes fixes across all supported versions simultaneously, including older releases that might otherwise lag behind. At the same time, current versions receive security-only patches, a narrower approach intended to let teams deploy updates quickly without pulling in unrelated feature changes that could complicate testing or introduce regressions.
Availability and licensing
TrueSource Spring Enterprise, including the Hub and build plugins, is now generally available. The 87 fixes tied to this specific release are already accessible to early-access and critical infrastructure customers, with the corresponding CVE records to be published publicly at a later date - a staggered disclosure model meant to give high-stakes operators a head start on remediation. The product is sold, along with Trusted Artifacts and Data Services, through Broadcom's tiered site licensing structure, meaning exact terms and included capabilities will vary by customer agreement.