HOMER
HOMER patches a SQL injection in /exec and stabilizes Azure and DuckDB storage in 11.0.x
A side-by-side editorial comparison of BigBlueButton and Greenlight — release velocity, themes, recent moves, and the top alternatives to consider.
BigBlueButton 4.0 enters release candidate with LiveKit fully replacing the legacy audio stack.
BigBlueButton is in its final stretch to 4.0 GA, with three release candidates shipping in September 2026. The 4.0 release is a near-complete architectural rebuild: LiveKit has replaced SIP.js and mediasoup as the default media transport, BlockNote replaced the old shared notes engine, and the mobile layout was overhauled. RC2 shipped security fixes for a cross-meeting presentation injection vulnerability, urging immediate admin updates.
Greenlight 3.9 makes URL_HOST mandatory, forcing admin action on every self-hosted deployment.
Greenlight, the BigBlueButton web frontend, is in a security-maintenance phase. The 3.8.x series was dominated by gem updates and language patches; 3.9.0 introduces multiple undisclosed security fixes alongside a breaking change that requires URL_HOST to be set in .env or the application will refuse to start. A follow-up hotfix landed hours later to address a startup crash introduced in the release.
BigBlueButton is in its final stretch to 4.0 GA, with three release candidates shipping in September 2026. The 4.0 release is a near-complete architectural rebuild: LiveKit has replaced SIP.js and mediasoup as the default media transport, BlockNote replaced the old shared notes engine, and the mobile layout was overhauled. RC2 shipped security fixes for a cross-meeting presentation injection vulnerability, urging immediate admin updates.
The LiveKit migration that began in 3.x security patches has culminated in rc.1's 'LiveKit as audio state source' refactor — the legacy audio path is gone. Multi-room sessions with membership-based tokens and automatic token refresh enable scenarios (breakout listen-in, large conferences) that the old bridge couldn't cleanly support. A 4.0 GA release is imminent given the RC cadence.
4.0 GA will ship within 2-3 weeks based on the RC pace. Post-GA focus will shift to hardening the LiveKit multi-room session model and expanding BlockNote capabilities (Markdown export landed in beta.4; more collaborative editing features likely next). The successful migration may influence other open-source video conferencing projects still running legacy SFU stacks.
Greenlight, the BigBlueButton web frontend, is in a security-maintenance phase. The 3.8.x series was dominated by gem updates and language patches; 3.9.0 introduces multiple undisclosed security fixes alongside a breaking change that requires URL_HOST to be set in .env or the application will refuse to start. A follow-up hotfix landed hours later to address a startup crash introduced in the release.
Greenlight's release cadence is maintenance-driven: security response and dependency updates rather than feature work. The 3.9.0 breaking change is the project tightening deployment requirements, likely in response to misconfiguration risks identified in security audits. The rapid hotfix points to limited pre-release testing capacity on the project.
The undisclosed 3.9.0 security fixes will be disclosed within weeks and likely explain the URL_HOST mandate — deployments without it were probably vulnerable to host header injection or similar configuration-dependent attacks.
Other Meetings products tracked by Sparkpulse, ranked by recent ship velocity. Each card links to a full editorial trajectory and lets you pivot into a head-to-head comparison with either BigBlueButton or Greenlight.
HOMER patches a SQL injection in /exec and stabilizes Azure and DuckDB storage in 11.0.x
Fourwaves adds custom domain support for event websites, removing the hosted-subdomain constraint for conference organizers
JW Player automates CMAF rendition ladders and sharpens ad attribution by player and placement
Nextcloud Talk Desktop is approaching Talk v25 stable while its July managed-config feature unlocks enterprise mass deployment for the first time.
Nextcloud Talk v25 adds classified conversations and an owner role, targeting regulated enterprise deployments.
Element Call is removing its legacy architecture — the federated multi-SFU model is now the only option.
See all BigBlueButton alternatives → · See all Greenlight alternatives →
Latest ship moves from both products, interleaved chronologically. ⚡ = editorial spark.
Both compete on the same themes — video-conferencing, open-source — within Meetings. BigBlueButton is currently shipping more aggressively (velocity 6.3 vs 5.0), with 1 editorial sparks in the last 30 days against 0. See the at-a-glance table above for a side-by-side breakdown of velocity, recent sparks, and editorial themes.
Sparkpulse doesn't pick a winner — we score release velocity, not feature parity. BigBlueButton is currently shipping more aggressively (velocity 6.3 vs 5.0), with 1 editorial sparks in the last 30 days against 0. For your specific use case, the alternatives sections above list other Meetings products to evaluate alongside.
Top BigBlueButton alternatives in Meetings are ranked by recent ship velocity. Browse the "BigBlueButton alternatives" section above for the current picks, or visit /alternatives/bigbluebutton for the full list with editorial commentary on each.
Top Greenlight alternatives in Meetings are ranked by recent ship velocity. Browse the "Greenlight alternatives" section above for the current picks, or visit /alternatives/greenlight for the full list with editorial commentary on each.