Broadcom's Tanzu business has released the largest set of Spring security updates in the framework's 23-year history to counter an unprecedented surge in AI-detected threats. The company is extending its clean-room build architecture, foundational to Bitnami, to build Java dependencies for the entire Spring ecosystem. These investments aim to protect the integrity of Spring and prepare customers for the continued rise in AI-enabled security threats, which have shrunk the time-to-exploit window following vulnerability disclosure.

"Spring is one of the most widely adopted application development frameworks in the world, and as its steward, we have a deep responsibility for its security," said Purnima Padmanabhan, Vice President and General Manager, Tanzu Division, Broadcom. "Because we maintain Spring and are the sole committers, we can better secure it at the source for everyone who depends on it. This investment is about two things we will never separate: the health of the Spring community and the security of our customers who trust Spring to run their business."

The number of monthly security advisories reported to Broadcom by the Spring community increased over 1700% from March to April 2026. In response, Broadcom's Spring engineering team has scaled investment in advanced AI-assisted security analysis, including frontier model-based scanning and validation workflows. These tools proactively identify vulnerabilities, assess remediation paths, and validate fixes across the dependency ecosystem.

Tanzu Spring now provides customers with day zero access to validated common vulnerabilities and exposures (CVE) patch-only releases via the Spring Enterprise Repository. CVE-only patches isolate the security fix from any other change, allowing customers to remediate faster. Broadcom's VMware Tanzu Spring enterprise support includes a certified source for secure libraries, commercial-first release of patches, access to dependent Java binaries, and automated upgrades with Spring Application Advisor.

As part of the expanded investment, Tanzu Spring customers gain access to a secured, SLSA Level 3-validated software supply chain for Java dependencies. Coverage spans the full transitive dependency graph managed by the Spring Boot bill of materials. Spring Boot 4.0 alone manages 1,768 dependencies, and across the full supported portfolio, the total exceeds 100,000 validated dependency builds. This capability provides validated dependencies across both current and end-of-life Spring versions, helping reduce software supply chain risk.