HashiCorp archives Boundary open source repo, no more patches

Any team running HashiCorp Boundary Community Edition for identity-based access to servers, databases or other dynamic infrastructure now has a question with a date on it. On 8 October, HashiCorp archived the open source repository and said no more community releases, maintenance updates, bug fixes or security patches are planned.

The change lives in the project's own README on GitHub, revised in pull request 6788 and merged on 9 October. The repository is marked archived through the GitHub API and no longer accepts new issues, pull requests or community contributions. Existing source code and previously released binaries stay online for reference and for teams running them already.

What is still supported

HashiCorp says future Boundary work will go into HCP Boundary, the hosted service, and Boundary Enterprise, the paid self-managed product. The README names the capabilities those cover: production-scale governance, compliance, session recording, enterprise support, and what the company calls "enterprise grade human and agentic access capabilities". The repository's own description still reads "Boundary enables identity-based access management for dynamic infrastructure", and the LICENSE file in the archived tree is a Business Source License whose Licensor is listed as International Business Machines Corporation, with Boundary 0.14.0 and later copyright held by IBM Corp since 2024.

What this does not say

The README does not give an end-of-life date for the binaries that were already released, and does not say when a security disclosure in the archived code would get a public response. It names no transition path for a self-hosted deployment that wants to stay self-hosted: the two supported products are a managed service or a paid edition. A team that cannot run managed and will not pay enterprise is on its own on the archived code.

The 4,063 stars on the repository and the 318 forks give a rough idea of how many teams had the project in their sights. How many are running it in production is not something HashiCorp publishes, and the archive note gives no number of its own.

The practical consequence is that any Boundary CE instance is now a dependency that will not patch itself. The company's own line, that teams continuing to use it should "evaluate whether it meets their operational, security, and compliance requirements", is the polite version of that fact. A team with Boundary CE in the critical path for access should put a migration decision on the next planning cycle: stay on frozen code, pay for Enterprise, move to HCP, or move to something else. Alternatives named in the Hacker News discussion include Pomerium and the paid tier of Infisical, each with its own licence shape.

Source

hashicorp/boundary on GitHub, pull request 6788, and the Hacker News discussion.