ILIAS
ILIAS ships synchronized security patches across versions 9, 10, and 11 on a monthly maintenance cadence.
A side-by-side editorial comparison of Chamilo and Open edX — release velocity, themes, recent moves, and the top alternatives to consider.
Chamilo's 3.0 beta quietly turns the LMS into an MCP server agents can author courses through.
Chamilo runs three lines at once. The legacy 1.11 branch takes security and bugfix releases roughly quarterly, 2.0 reached GA in April and has drawn three patch releases since, and a 3.0 line opened on 13 August. The 3.0 beta is where the direction sits: 456 changes spanning 88 plugin fixes, a 44-item security sweep, and a new MCP server with OAuth 2.1 that exposes course authoring and review to outside clients. The feed's own bodies are unreliable here - both 3.0 tags arrived carrying a single line of text, and the 2.0 GA release reached it only as scraped page fragments.
Open edX maintenance branches carrying security backports, not features
The visible stream is release-branch commits rather than named releases, and the recent ones are all corrective. Two July entries backport the same fix — an authorization gap where CourseTeamManageAPIView required only authentication, letting any enrolled learner call the endpoint. Earlier entries block SSRF in SAML metadata fetching by validating the URL against loopback, link-local, reserved and private ranges, add LTI launch logging, and normalize block structure keys.
Chamilo runs three lines at once. The legacy 1.11 branch takes security and bugfix releases roughly quarterly, 2.0 reached GA in April and has drawn three patch releases since, and a 3.0 line opened on 13 August. The 3.0 beta is where the direction sits: 456 changes spanning 88 plugin fixes, a 44-item security sweep, and a new MCP server with OAuth 2.1 that exposes course authoring and review to outside clients. The feed's own bodies are unreliable here - both 3.0 tags arrived carrying a single line of text, and the 2.0 GA release reached it only as scraped page fragments.
The rewrite has stopped being the story and the agent surface has started. 2.0 spent its cycle absorbing the legacy feature set - LTI, ONLYOFFICE, the plugin catalogue - and reached GA; 3.0's first beta spends most of its weight on that same restoration work but adds something no 2.0 release contains, an MCP server with OAuth 2.1 auto-connect and tools that write rather than only read. Model providers are being wired directly into the AI helper alongside it. Security remains constant across all three branches, with 44 security items in the 3.0 beta alone.
Expect the MCP tool surface to widen in the next 3.0 beta, since the first pass already moved past read-only lookups into course authoring and review. Whether 3.0 becomes the supported line or 2.0 keeps taking patches is the question the tags themselves do not answer.
The visible stream is release-branch commits rather than named releases, and the recent ones are all corrective. Two July entries backport the same fix — an authorization gap where CourseTeamManageAPIView required only authentication, letting any enrolled learner call the endpoint. Earlier entries block SSRF in SAML metadata fetching by validating the URL against loopback, link-local, reserved and private ranges, add LTI launch logging, and normalize block structure keys.
This window shows the maintenance side of a large deployment-driven platform: fixes land on master and are backported across named release branches (teak, ulmo, verawood) so operators on older lines get them. The security items share a shape — endpoints and integrations that trusted their callers more than they should. Nothing here indicates feature direction, because feature work does not surface in this branch stream.
Expect continued backporting across the active named branches, since the same authorization fix already landed on two of them within a minute of each other. What ships in the next named release is not visible from these entries.
Other EdTech products tracked by Sparkpulse, ranked by recent ship velocity. Each card links to a full editorial trajectory and lets you pivot into a head-to-head comparison with either Chamilo or Open edX.
ILIAS ships synchronized security patches across versions 9, 10, and 11 on a monthly maintenance cadence.
Sprite Lab arrives in Lab2, and the day's second tag carries nothing at all.
Kahoot's feed is classroom storytelling, with product news surfacing only occasionally
Monthly digests of accessibility work and legacy retirement, with SCORM now a paid line item
LatitudeLearning is handing its AI assistant to portal administrators to configure, not just switch on.
The cyber-readiness platform stops testing only people and starts testing the agents.
See all Chamilo alternatives → · See all Open edX alternatives →
Latest ship moves from both products, interleaved chronologically. ⚡ = editorial spark.
Both compete on the same themes — lms — within EdTech. Chamilo is currently shipping more aggressively (velocity 6.3 vs 5.0), with 1 editorial sparks in the last 30 days against 0. See the at-a-glance table above for a side-by-side breakdown of velocity, recent sparks, and editorial themes.
Sparkpulse doesn't pick a winner — we score release velocity, not feature parity. Chamilo is currently shipping more aggressively (velocity 6.3 vs 5.0), with 1 editorial sparks in the last 30 days against 0. For your specific use case, the alternatives sections above list other EdTech products to evaluate alongside.
Top Chamilo alternatives in EdTech are ranked by recent ship velocity. Browse the "Chamilo alternatives" section above for the current picks, or visit /alternatives/chamilo for the full list with editorial commentary on each.
Top Open edX alternatives in EdTech are ranked by recent ship velocity. Browse the "Open edX alternatives" section above for the current picks, or visit /alternatives/openedx for the full list with editorial commentary on each.