HashiCorp Archives Boundary's Free Edition and Plans No Further Security Patches
Software / news
HashiCorp Archives Boundary's Free Edition and Plans No Further Security Patches
The read-only repository holds 112 open issues and 40 open pull requests, and the last release was cut on April 30.
HashiCorp archived the open source repository for Boundary Community Edition on Oct. 9, 2026, and its README says no new releases, bug fixes or security patches are planned. Teams that run the free edition to broker SSH and database access now have source code and binaries that will not change.
The notice sits at the top of the hashicorp/boundary README. It reads: "Boundary Community Edition (CE) is no longer under active development," and the repository "has been archived as of October 8, 2026." GitHub's own banner on the repository page says it was archived by the owner on Oct. 9, and the GitHub API shows the last push at 16:50 UTC that day. The two dates differ by one day, and the page does not reconcile them.
What the README promises and what it drops
Existing source and previously released binaries "remain available for reference and existing self-managed use." Nothing else is promised. The README says "No new Boundary CE releases, maintenance updates, bug fixes, or security patches are currently planned," and tells users to "evaluate whether it meets their operational, security, and compliance requirements."
It points to two replacements. "Future Boundary development will focus on HCP Boundary and Boundary Enterprise," it says, and it names "production-scale governance, compliance, session recording, enterprise support" as the reasons to move. It gives no price for either and no migration path from a self-hosted community install.
The README does not say why. It does not mention IBM, which is the licensor named in the repository's licence file.
The state of the repository at archive
- Open issues112 items
- Open pull requests40 items
Source: GitHub repository page for hashicorp/boundary, accessed 2026-10-12
The repository was created on Jan. 8, 2020. It carries 5,126 commits on main, 4,063 stars and 317 forks at the time of the API call. An archived repository accepts no new issues or pull requests, so the 112 and 40 above will stay open permanently unless someone forks them.
| Release | Published | Branch status |
|---|---|---|
| v0.21.3 | April 30, 2026 | Final 0.21 tag listed |
| v0.20.3 | April 30, 2026 | Final 0.20 tag listed |
| v0.19.5 | April 30, 2026 | Final 0.19 tag listed |
| v0.21.2 | April 7, 2026 | Superseded |
| v0.21.1 | Feb. 13, 2026 | Superseded |
| v0.21.0 | Dec. 11, 2025 | Superseded |
The three April 30 tags went out within 15 minutes of each other, which is the pattern of a backport batch across three supported branches. The release list on GitHub shows nothing after that date. The release list does not say whether any of them carried a security fix.
Why the licence matters for anyone who wants to fork
The repository's LICENSE file is the Business Source License 1.1. The licensor is International Business Machines Corporation, and the licensed work is "Boundary Version 0.14.0 or later." The change date is "Four years from the date the Licensed Work is published," after which the code converts to MPL 2.0.
That clock runs per version. A fork of v0.21.3 cannot be offered under MPL 2.0 until four years after that version was published, and the additional use grant is conditional on production use that does not include offering the work to third parties. Anyone who wants a community-maintained Boundary today is working from source they may run but not resell. Open source maintainers have been here before: Nitter's maintainer retracted a legal claim this month, and LineageOS 24.0 shows what a community-run project ships when it controls its own code.
HashiCorp's edition comparison page lists only HCP Boundary and Boundary Enterprise. It says Enterprise has "full feature parity to HCP Boundary" and describes HCP as managed, with HashiCorp hosting the control plane. It does not mention a Community Edition at all.
The next fixed date is the change date on each tag. For v0.21.3 that falls in April 2030, four years after its April 30, 2026 publication.
Sources
More in Software
- 01Rust Borrow Checker Bug 11 Years Old Lets Safe Code Hide a Short-Lived Reference in a 'static ValueIssue #164250 shows a Drop impl smuggling a stack reference past the compiler on stable releases back to 1.85.0, and commenters trace variants to Rust 1.4.
- 02REA, a Reverse-Engineering Tool for AI Agents, Gained 52,186 GitHub Stars in a Day. It Has 653 Watchers.Three trackers report three different star totals for morluto/rea, and the 15 newest issues and pull requests show an installer still being patched.
- 03QGIS Merges a 'Closed Door' on AI-Written Code 13 Days After Proposing ItQEP 428 bars LLM, AI and agent-assisted code from qgis/qgis after a vote that closed October 7, with two follow-up proposals still open.
- 04Anthropic Moved Its Monorepo Off Git to Scion as Daily Merges Grew From 2,500 to 30,000A seven-person team built Scion in five months. The post is candid about merge-queue conflicts and says the system is not a git replacement for general use.