Open Source Ecommerce Platforms 2026: Engineer's Field Guide

An open source ecommerce platform is shop software whose code you can read, modify, and self-host: your checkout logic, your data, your infrastructure, no license meter running on your revenue. That freedom is real, and so is its price: every platform in this guide assumes engineering capacity.

Most lists in this space are written from documentation. This one is written from deployment: I run a Medusa-based marketplace with 10,000 products and 50 vendors in production, I have evaluated most of the platforms below for client projects, and every license, version, and star count in this guide was pulled from the primary source on August 27, 2026. Where my experience is thin, I say so; where a platform is better served by SaaS, I say that too.

How this guide chooses

Three engineering criteria decide what makes the list and how it is judged. The project has to be alive — verifiable 2026 releases and active repos; several famous names from older listicles no longer clear that bar, so they are not here. Facts beat vibes: licenses read from LICENSE files, prices from pricing pages, activity from the GitHub API, all dated. And team fit beats feature count, because after enough platform evaluations the pattern is boring and reliable: teams succeed with platforms that match their stack and fail with platforms that fight it.

One more deliberate choice: multi-vendor marketplaces get their own category at the end. Treating marketplace capability as a checkbox column is how comparison articles mislead people into six-figure surprises.

The master table: 10 platforms, 8 dimensions

Licenses from LICENSE files, prices from official pricing pages, activity from the GitHub API — all checked 27 August 2026. Details and sources in each section below.

Medusa — the ownership maximalist

Medusa is a TypeScript commerce framework: modules for products, carts, orders, and payments, a workflow engine with per-step rollback, and REST APIs you build any frontend on. MIT-licensed core (with an Enterprise Edition carve-out worth reading), 36,026 GitHub stars and 455 contributors, monthly releases; v2.19.0 shipped August 13, 2026.

For: TypeScript teams building commerce as a product: custom pricing, B2B flows, ERP orchestration. It also ships the strongest AI-assisted development story in this guide: an official MCP server and Claude Code agent skills, covered in my Medusa and AI agents guide. Against: nothing exists until you build it, and the ecosystem trades finished plugins for framework primitives. This is the platform I run in production; my cost breakdown against Shopify shows exactly when that bet pays and when it does not.

Vendure — the NestJS platform

Vendure is the most platform-like of the TypeScript options: NestJS architecture, GraphQL API, a curated plugin system, 8,377 stars, 285 contributors, v3.7.2 released August 3, 2026. Its paid Vendure Platform is a flat annual subscription with no GMV fees, quoted per project with no public price.

For: NestJS shops wanting commerce that feels like the services they already run. Against: the license fine print most comparisons skip — Vendure is GPLv3 by default, with a commercial license from Vendure GmbH as the alternative. For proprietary commerce logic, that is a legal conversation before it is a technical one. My three-way production comparison goes deeper on this fork.

Saleor — the GraphQL purist

Saleor is Python, Django, and GraphQL only ("GraphQL native, API-only" in its own words). BSD-3 licensed, 23,267 stars, 261 contributors, near-daily patch releases (3.23.29 on August 26, 2026). Extensions run out-of-process as apps and webhooks, which keeps upgrades calm. Saleor Cloud is enterprise-priced: Select at $1,599 a month up to $200k monthly GMV, Volume at $3,999 up to $1M.

For: Python-first organizations and architectures that mandate GraphQL end to end. Against: if your team is not Python or your extensions want to live in-process, the discipline that makes Saleor clean will feel like friction. Self-hosting keeps it free; the Cloud pricing tells you who the vendor is really building for.

Sylius — PHP done headless

Sylius is the modern PHP answer: Symfony and API Platform underneath, MIT-licensed, 8,516 stars, v2.2.8 released July 31, 2026. Commercial Sylius Plus starts at €800 a year and sells nine modules including a B2B Suite and, notably for this guide, a Marketplace Suite.

For: PHP/Symfony teams who want headless discipline without leaving their stack, and mid-market B2B where the Plus modules map to real requirements. Against: a smaller ecosystem than the PHP giants below, and the marketplace capability sits behind the commercial tier — a legitimate model, but budget it. As the only MIT-licensed platform in the PHP field, its license is a quiet advantage.

WooCommerce — the pragmatic giant

WooCommerce is a GPLv3 WordPress plugin with over 7 million active installations, the largest footprint in this guide by an order of magnitude. Version 11.0.1 shipped August 10, 2026; Automattic monetizes through extensions, payments, and hosting while the core stays free.

If you already live in WordPress, this is the obvious answer, and the pool of affordable developers and agencies is the widest anywhere. The catch is that it inherits WordPress: the architecture, the plugin-quality lottery, the scaling ceiling. For a content site adding a shop, take it and move on. For commerce as a product, your customization budget will go into fighting the platform's assumptions instead of encoding your own.

Magento Open Source — the heavyweight in transition

Magento Open Source remains a complete, powerful PHP platform: OSL-3.0 licensed, 12,168 stars, release 2.4.9 in May 2026. The README's own framing is telling: the open-source tier ships "basic eCommerce capabilities" while Adobe recommends the paid Adobe Commerce for the full feature set.

For: organizations with existing Magento estates and teams — the migration cost away often exceeds the cost of staying, and that is a legitimate calculation. Against: for greenfield builds in 2026 it is hard to recommend. The release cadence is the slowest in this guide, the operational weight is the highest, and the vendor's roadmap energy visibly points at the paid product.

PrestaShop — the European workhorse

PrestaShop is a PHP platform with deep European roots: OSL-3.0 core, 9,201 stars, and a current release — 9.1.5 on August 18, 2026. The project claims over 250,000 active merchants; distribution is split between a free self-hosted Classic edition and a Hosted offering, with the Addons marketplace carrying the module economy.

Its case is geographic more than technical: European small-to-mid merchants with PHP support nearby, especially in France and Southern Europe, where the agency density is real. The architecture shows its age next to Sylius, and the module-quality spread resembles WooCommerce's. It earns its place through market reality rather than ambition, which is a fine reason to be on a list like this.

Shopware Community Edition — the German market leader

Shopware 6 is PHP/Symfony, API-first, with a free open-source Community Edition and commercial plans (Rise from €600, Evolve from €2,400 monthly). Per the EHI study — as reported by Shopware — it is the most-used shop system among Germany's top 1,000 B2C shops at 11.5%, for the fourth consecutive year. Its official Composable Frontends (Vue, Nuxt 3) make headless an officially supported path.

For: the DACH market, full stop. The agency ecosystem, the localized features, and the hiring pool have no equal there, which is why I wrote a dedicated respectful Medusa vs Shopware comparison (German). Against: outside DACH the ecosystem advantage fades, and deep customization pushes you toward the paid plans where the B2B components live.

Spree and Solidus — the Ruby lineage

Spree is the original Ruby commerce platform: BSD-3, 15,647 stars (the most-starred PHP-or-Ruby project here), with v5.6.1 in July 2026 and a free core plus unpriced Enterprise edition. Solidus, its 2015 fork maintained by Nebulab, holds 5,322 stars with v4.7.0 from April 2026; both repos saw pushes on the day I checked.

For: Rails teams, where either remains the native answer; Spree currently shows the faster release rhythm of the two. Against: the Ruby commerce talent pool is the smallest of any stack in this guide, and both projects live in the shadow of the JavaScript and Python momentum above. Alive and maintained, yes; growing ecosystems, honestly no.

The marketplace category: Mercur

Multi-vendor is not a feature you toggle: vendor panels, order splitting, commission math, and payouts are their own platform layer, which is why this category gets its own section instead of a table column. Mercur is the open-source answer: MIT-licensed, built on Medusa's commerce core, with vendor onboarding, split checkout, commissions, and payouts in the free tier. It is young (1,738 stars and a commit history dominated by one maintainer, trade-offs I documented in my independent Mercur review), but it is the only place in open source where the full marketplace loop ships under MIT. The practical build path is in my step-by-step marketplace guide, and the alternative routes (Sylius's commercial Marketplace Suite, third-party extensions on Shopware or WooCommerce, or SaaS platforms entirely) are mapped in the marketplace platform comparison.

Decision matrix: pick by team, not by feature table

Which license should you pick?

If the shortlist is otherwise tied, let the license break the tie: MIT and BSD (Medusa, Sylius, Saleor, Spree) impose nothing; GPLv3 and AGPL (WooCommerce, Vendure, Smartstore) are workable for standard shops but need legal review before proprietary logic goes in; OSL-3.0 (Magento, PrestaShop) sits in between. Nobody enjoys this paragraph, and skipping it is how license surprises happen mid-project.

Two patterns from real evaluations are worth repeating. Existing estates usually beat greenfield preferences: a working Magento with a trained team rarely justifies a migration on architecture aesthetics alone. And license fit is a first-round filter, not a footnote: copyleft (GPLv3, AGPL, OSL) is workable for most shops but needs legal sign-off the permissive licenses (MIT, BSD) never trigger.

The TCO reality check

Free licenses do not make free platforms, and I can put my own numbers on that. My production marketplace runs on Railway for $40–60 a month all-in (backend, worker, PostgreSQL, Redis), with images in Cloudflare R2 for under a dollar; my deployment comparison weighs Railway against Vercel and a bare VPS with verified pricing. Infrastructure is genuinely cheap. Development is not: in my three-scenario, three-year cost model against Shopify, the developer column dominates every open-source total, and the honest conclusion survives across platforms: a small standard shop is cheaper on SaaS, the crossover comes when customization gets a budget anyway, and at that point you are choosing between paying for workarounds or paying for ownership.

Apply that lens to any platform on this list: the license column of the master table is the least important cost line on it.

AI-readiness: the dimension that did not exist last year

Open source has a structural advantage in the agent era: coding agents can read the source, and typed, patterned codebases make agent output verifiable. But the platforms differ sharply in how far they lean in. Medusa ships official agent tooling (an MCP server and Claude Code skills), making it the reference point. Vendure and Saleor offer clean, typed, open APIs that agents handle well without dedicated tooling. The classic PHP platforms are agent-workable but pattern-noisy, and Shopware currently frames AI as a product add-on more than a development interface. If AI-assisted development is part of your team's workflow, this row of the master table will matter more every quarter; the reasoning lives in my Medusa and AI agents guide.

When open source is the wrong choice

The honest section, because the pattern repeats in my inbox: a small shop, a standard catalog, no developer on staff, and a quote for "free" software that costs five figures a year in agency retainers. Every platform in this guide assumes engineering capacity: building, upgrading, securing, integrating. If that capacity does not exist and the shop is standard, Shopify or a comparable SaaS is the better answer, and I say that as someone who earns money implementing the open-source side. Ownership is a strategy, not a virtue. Choose it when it buys you something specific — custom logic, data sovereignty, fee-free scale, or a marketplace model. Those are the cases the e-commerce industry page and my fullstack engagements are built around. Otherwise rent the SaaS, launch, and look at this list again in a year when you know what you actually need.