HashiCorp archives Boundary Community Edition with no further security patches planned
Serguey Asael Shinder2 min readHashiCorp has archived the public hashicorp/boundary repository on GitHub. The notice at the top of the project now says that Boundary Community Edition (CE) is no longer under active development and that the repository was archived as of 8 October 2026; GitHub itself shows the archive date as 9 October.
What the archive means in practice. The repository is read-only: it no longer accepts new issues, pull requests or community contributions. The existing source code and previously released binaries stay available, both for reference and for teams that already run Boundary themselves. The key sentence for operators is the next one: no new Boundary CE releases, maintenance updates, bug fixes or security patches are currently planned.
Where development goes. HashiCorp writes that future Boundary work will focus on HCP Boundary, its hosted service, and Boundary Enterprise, the self-managed commercial edition. The notice describes the direction as enterprise-grade access for both people and AI agents, and lists production-scale governance, compliance, session recording and enterprise support among the capabilities of those editions.
Who is affected. The project describes Boundary as identity-based access management for dynamic infrastructure — that is, it sits on the path by which people reach the systems it protects. A component in that position that receives no further patches is a different risk from an ordinary unmaintained library, and HashiCorp says so directly: teams continuing to use Boundary CE should evaluate whether it meets their operational, security and compliance requirements.
What to do now. Teams running CE have three realistic options, none of them immediate: stay on the last release while tracking advisories themselves, move to one of the two commercial editions, or plan a migration to another access broker. Whatever the choice, the archive date is the point from which any newly reported vulnerability in CE should be assumed to stay unfixed upstream.
Source: HashiCorp, hashicorp/boundary repository notice — https://github.com/hashicorp/boundary