HashiCorp archives Boundary Community Edition, no patches planned

HashiCorp archives Boundary Community Edition, no patches planned

9 October 2026: HashiCorp has archived the repository for Boundary Community Edition, its open source identity-based access tool for infrastructure, and says no new releases, bug fixes or security patches are currently planned for it. Teams that run the free edition themselves are now on software with no maintainer behind it.

Not yet independently verified. Not yet independently verified. The only source is the project README, and we found no separate announcement, migration guide or pricing statement from HashiCorp. We will update this when it can be confirmed, and remove this note. We will update this when it can be confirmed, and remove this note.

What the repository now says

The project README states that Boundary Community Edition is no longer under active development and that the repository was archived as of 8 October 2026. GitHub shows the repository as archived by its owner on 9 October and read-only. It no longer accepts issues, pull requests or community contributions.

Source code and previously released binaries remain available. The README describes them as available for reference and for existing self-managed use, so nothing is withdrawn or made unusable. What stops is the flow of changes: the README says no new Community Edition releases, maintenance updates, bug fixes or security patches are currently planned.

Where development goes next

According to the README, future work concentrates on HCP Boundary, the hosted service, and Boundary Enterprise. It points to production-scale governance, compliance, session recording, enterprise support and what it calls human and agentic access as the reasons to look at those two. It tells teams that stay on the Community Edition to judge for themselves whether it still meets their operational, security and compliance requirements.

The README gives no price for the paid editions and no migration guide, and it does not say whether a community fork is expected.

Who has to act

Boundary brokers sessions to servers, databases and other targets after authenticating a user against an identity provider, so a self-hosted deployment sits in front of sensitive systems. A tool in that position that no longer receives security patches carries a risk that grows with time. Any vulnerability found in the Community Edition from now on is unlikely to get an upstream fix.

The questions are the ones the README implies. Which version are you running, which identity provider is it tied to, and can you move to HCP Boundary or Boundary Enterprise, or to another access broker, before an unpatched flaw forces the decision? Auditors who ask for evidence of supported software are unlikely to accept an archived repository.

What stays available, and what does not

Existing binaries stay downloadable, the source remains readable, and anyone is free to keep running what they have. What disappears is the upstream: no issue tracker, no accepted contributions and, by the README's own account, no patches planned. The date to record in an asset register is 8 October 2026, when the community codebase was frozen.

Sources

• HashiCorp, Boundary repository README on GitHub (read 2026-10-12), 12 October 2026