And as popular and widely used as Spring is, that would 100% happen. To me at least, I wouldn't count this as a particularly huge risk. But in an enterprise setting, with mandatory auditing and stuff, I can understand why there would be a requirement to at least pre-identify alternative(s).

> Not spring boot, but spring, is owned by VMware

How do I reconcile this statement with VMWare holding the copyright which you will find unambiguously littered in the official Spring Boot repository?

Since you contend the contrary, who does in fact hold the copyright?