LoginSign Up
← Back to all sparks
Chamilo logo

Chamilo

EDTECH
Velocity2.5

LMS and EdTech platform: Chamilo

github.com ↗

Chamilo patches its 1.11 line again while the MCP-enabled 3.0 beta sits quiet since August.

lmsmcpagentic-authoringsecurity-maintenanceself-hosted
◆Current state
Chamilo runs three lines at once. The legacy 1.11 branch takes security releases every few months, most recently 1.11.42 on November 1, which can lock out users whose login or password has leading or trailing spaces. Version 2.0 reached GA in April, and the 3.0 line opened in August with an MCP server and OAuth 2.1 for course authoring by outside clients, followed by a bare beta.2 tag on August 31.
◆Where it's heading
The direction sits in 3.0, but the feed shows no 3.0 activity for two months while 1.11 maintenance continues. Most production installs still appear to run 1.11, which keeps that branch on a steady security cadence.
◆Prediction
Another 1.11 security release in the coming months is the most predictable entry; when the 3.0 beta moves forward is unclear from the feed.

◆Recent moves

  1. 12d ago

    Chamilo 1.11.42 security release can lock out some logins

    A security and bugfix release on the 1.11 line with one possibly breaking change: users whose login or password has leading, trailing or invisible characters cannot sign in until an administrator fixes the account. Admins should check for such accounts before upgrading.

    View source ↗
  2. 2mo ago

    Beta 2 tagged with no release notes

    A bare tag with no GitHub release behind it, eighteen days after beta 1. It moves the 3.0 line forward on paper without recording what changed, making this the second 3.0 tag to reach the feed without notes.

    View source ↗
  3. 3mo ago

    Chamilo 3.0 beta 1 opens an MCP server with course-authoring tools

    ⚡ SPARK

    The release that opens the 3.0 line, and the point where Chamilo stops being an LMS that is merely being rewritten and becomes one outside agents can drive. Most of its 456 changes continue the restoration work 2.0 did, but the MCP server is new to the codebase - no 2.0 release mentions it anywhere.

    View source ↗
  4. 4mo ago

    Chamilo 1.11.40: security and bugfix maintenance release

    Maintenance on the branch most production installs still run. With 2.0 at GA and 3.0 in beta, 1.11 remains the line that gets patched rather than changed.

    View source ↗
  5. 7mo ago

    Stop logging AI base-provider fallback events

    An internal change that stops logging AI base-provider fallback events, with no user-visible effect. Its body is scraped GitHub profile chrome rather than release content - one of two fragments the 2.0 GA release left behind in the feed.

    View source ↗
  6. 7mo ago

    Bump tar dependency 7.5.3 to 7.5.6

    A Dependabot bump of the tar dependency, captured as a standalone entry whose body is scraped profile chrome. Routine supply-chain maintenance on the rewrite branch.

    View source ↗