Provenance Record

A genuine Analysis: it compares what four vendors said about security fixes after freezing or archiving their community editions, rather than recapping one announcement. About 1,353 words (range 800-2000), 16 sources, clear sections (background, current situation, security-fix list, reasons and free routes, implications, what the sources do not settle, sources and independence). Facts are attributed to named sources and labelled as the Herald's own checks where applicable; the one analytical passage ('One narrower point follows') is short and derived from the quoted statements. No prediction or opinion is presented as the Herald's own, and the closing section says so.

All 16 sources read from raw text; every manifest sha256 re-hashed and matched (source-0..15 under sources/2026-11/minio-localstack-boundary-and-portainer-ended-or-froze-community-editions-from-december-2025-to-october-2026-with-differing-security-fix-positions/). suspicious_patterns: none in any source. Allowlist: github.com, infoq.com, itsfoss.com, linuxiac.com, lwn.net and thenewstack.io are all listed; no addition needed. Snapshots read by route: source-9 (It's FOSS MinIO, sha256 2d6de0188944862bc03f68004e93248445e9f7ce95fd1f955fb5ed5b993794eb), source-10 (It's FOSS Portainer, sha256 cc2eabaf48abee1a60dccfbef80d4de306aff1fa4eb30536d0145e3129bd4744) and source-13 (The New Stack, sha256 c85ad4303d1ac6801eea971aed154628d3226018c1eedef44853959b7d1b1d6e) are Archive.org captures (archive_fallback true; captures dated 2026-10-13, 2026-09-23 and 2026-10-23); a live fetch with a browser User-Agent on 2026-11-08 returned 403 for the It's FOSS Portainer and The New Stack URLs, so the capture is the raw-text route. All other sources are live snapshots (status 200). Quotes: 39 quoted strings extracted mechanically from the body and string-matched (whitespace/curly-quote normalised) against the snapshots: 39 of 39 found in the source the article attributes them to (MinIO README commit, README, release notes, It's FOSS x2, Linuxiac, LWN, InfoQ x2, The New Stack, Boundary README, Portainer README, LocalStack README); I also read every one in context in the text extractions (well over the 15-quote sample, including all headline/lead-critical ones: 'Critical security fixes may be evaluated on a case-by-case basis', 'currently planned', 'is now archived and read-only', 'No new Boundary CE releases ... security patches are currently planned', 'CE will get security fixes ...', 'So far, no fork of the MinIO community edition has gained traction.'). Per source: source-0 Boundary repo: README says archived 'as of October 8, 2026', 'No new Boundary CE releases, maintenance updates, bug fixes, or security patches are currently planned', future development 'HCP Boundary and Boundary Enterprise', no reason given, no free tier named; GitHub banner 'archived by the owner on Oct 9, 2026' - confirmed. source-1/2 LocalStack: README notice 'archived and read-only', free Hobby plan 'for non-commercial use'; commit 8b9a79f0 'Update the project README (#13901)' dated 2026-03-23T08:51:59Z and its diff adds exactly that notice - confirmed. source-3 MinIO repo: README 'THIS REPOSITORY IS NO LONGER MAINTAINED', 'AIStor Free ... community use (free license)'; banner reads archived Apr 25, 2026. source-4: commit 27742d46 'update README.md maintenance mode', committer date 2025-12-03T08:13:11Z, bullets quoted exactly - confirmed. source-5: release 'Security/CVE RELEASE.2025-10-15T17-29-55Z', published_at 2025-10-16T19:33:51Z, notes say 'clone the source and build the latest container' - confirmed, and it is still the newest release entry. source-6/7/8 Portainer: README 'not intended for, or supported in, business, production ...', 'There is no SLA', 'updated periodically, with no guarantees on cadence'; 2.45.2 published 2026-10-08T00:23:15Z with a Security section, 2.45.3 published 2026-10-21T23:20:29Z with 'Security improvements' - confirmed. source-9 It's FOSS: May 2025 release moved management features, October 2025 stopped images/binaries, CVE users 'had to build from source instead', Dec 3 2025 maintenance-mode commit, archived February, unarchived, archived again April 2026 (article date April 25 matches the banner), 'no guaranteed security patches', 'still works' - confirmed. source-10 It's FOSS Portainer (21 Sep 2026): Cresswell quote, 'three separate times', 'CE will get security fixes, bug fixes, and backports of 3.x features, but only where a matching Docker API exists to interface with', '3 Nodes Free' - confirmed. source-11 Linuxiac (5 Dec 2025, by the editor-in-chief): 'MinIO is effectively done', 'critical security fixes ... case-by-case', 'the priority now is clear: begin planning an urgent migration to an alternative' - confirmed, opinionated as the article says. source-12 LWN (25 Jun 2026, 'This article was contributed by Tyler Langlois'): archived February 2026, 'did not state its reasons', 'has continued to publish vulnerability information ... at least through April', 'is no longer supplying updates to the open-source project', Silo fork with plans 'limited to bugs and security fixes' and most recent release June 18, 2026, 'Most users of MinIO have moved on...', compares Ceph and Garage - confirmed. source-13 The New Stack (27 Jan 2026, Steven J. Vaughan-Nichols): 10 more programs, MinIO called 'perhaps the chief one', 'forked, stability-focused EmeritOSS versions will remain freely available on GitHub in source code', commercial images - confirmed; the piece is about a program Chainguard runs, as the article says. source-14 InfoQ (28 Dec 2025, Renato Losio): maintenance mode via latest commit; closing line 'So far, no fork of the MinIO community edition has gained traction.' - confirmed and dated. source-15 InfoQ (15 Feb 2026): single registration image, 'currently planned for March', co-CEO quote, 'LocalStack will not release any further updates to the Community Edition, with product enhancements and security patches applied only to the new version' (InfoQ's own wording, attributed 'per InfoQ' in the article), 'will need to be updated before the change goes live' - confirmed. Herald's own checks re-run against the GitHub API on 2026-11-08 (UTC): minio/minio archived true, localstack/localstack archived true, hashicorp/boundary archived true (pushed_at 2026-10-09T16:50:40Z), portainer/portainer archived false (pushed_at 2026-11-06); newest MinIO release RELEASE.2025-10-15T17-29-55Z published 2025-10-16T19:33:51Z; Portainer newest releases 2.45.3 (2026-10-21T23:20:29Z) and 2.45.2 (2026-10-08T00:23:15Z); LocalStack commit date 2026-03-23T08:51:59Z. All match the article and are labelled as the Herald's own. Headline check item by item: MinIO maintenance mode 2025-12-03 and archived (confirmed); LocalStack archived 2026-03-23 (confirmed); Portainer CE kept on the 2.x line, announced 2026-09-21, 2.45.2/2.45.3 released (confirmed); Boundary archived October 8 (README) / October 9 (banner), reported as unexplained (confirmed; the repository's last commit, 'Revise README for Boundary CE archiving', is dated 2026-10-09T16:50:36Z, which does not explain the README's October 8). 'Differing security-fix positions': four different statements, each checked against its own source; the article uses 'each' only for 'Linuxiac, It's FOSS and LWN each frame ... finding an alternative', which holds for all three. Internal link /article/2026-10/13-hashicorp-archives-the-boundary-community-edition-repository-saying-no-new-releases-or-security-patches-are-currently-planned resolves to a published Briefing; its description (README October 8, banner October 9, neither explains) matches that Briefing and its 'no new releases or security patches currently planned' framing is consistent with the Boundary README text used here. InfoQ (December 2025) and LWN (June 2026) are dated and not set up as a contradiction. Independent-source recount (per outlet, policy 'Analysis requirements'): InfoQ (two articles = one outlet; own reporting on MinIO and LocalStack), It's FOSS (two articles = one outlet; MinIO and Portainer), Linuxiac (MinIO only; opinionated), LWN.net (MinIO only; a contributed article by guest author Tyler Langlois, which the policy lists as not independent), The New Stack (MinIO only; reports a program run by a vendor, Chainguard, which is not one of the four subjects). Strictly independent outlets with their own reporting: InfoQ, It's FOSS and Linuxiac = 3; outlets covering at least two of the four projects: InfoQ and It's FOSS = 2; no independent outlet covers Boundary (first-party README plus the Herald's earlier Briefing). Requirement of at least 2 independent of the subject, at least 4 sources (16), is met. The article's wording that 'the independent accounts come from five outlets' counts the contributed LWN piece and the Chainguard-program piece as independent although it discloses both labels; filed as a clarification. Anthropic disclosure: not required - the article does not name Anthropic, Claude or Bun in its headline, summary, lead or any passage; 'Claude' appears only in LWN's text about Ceph commit history and in It's FOSS page sidebars, none of which the article reports. Absence/quantifier greps run on title, summary and body: no absence claim ('no source reports') beyond the 'In the text the Herald read' / 'names ... but no free tier' statements, which I tested against the Boundary README and all cited sources and found accurate; no relative dates except 'today'/'now' attached to the Herald's November 8 check (see concerns). Originality: no existing MinIO, LocalStack or Portainer article; only the earlier Boundary Briefing, which the article links and does not duplicate. Title is 149 characters (under the 150 limit).

Every quote, date, version, repository state and figure checked against raw source text or the GitHub API and found accurate. Two subordinate imprecisions found (both filed as clarifications): (1) the 'five outlets' independence count treats a contributed LWN article and a vendor-program article as independent; (2) the closing paragraph says the three archived 'repositories carry' three statements, but LocalStack's statement ('security patches applied only to the new version') is InfoQ's wording of the company announcement, which neither the repository README nor the Herald read.

Substantively sound, well-sourced Analysis that meets the Analysis requirements (length, 16 sources, at least 2 independent outlets, a topic examined, facts separated from analysis, no Herald prediction). Headline, summary and lead are each backed by cited sources and survived item-by-item checking against raw text and the live GitHub API. Two subordinate imprecisions are recorded as clarifications; the signed article is not edited. Featured candidacy: 2 - a cross-project comparison of how four widely used developer-infrastructure vendors treated security fixes when ending free editions, useful to a broad developer audience, but without a single new industry-changing event