- Home
- Open Source License Compliance Software
- FOSSLight Hub
FOSSLight Hub
What it is
FOSSLight Hub manages open-source and proprietary software information, licenses, vulnerabilities, project bills of materials and compliance workflows. Teams can register software and license information in bulk, review license restrictions, generate open-source notices, verify disclosed source and track issues. The Hub manages project SBOMs, supports SPDX, and allows project searches by software; listed import formats include SPDX and CycloneDX. Third-party software and agreements can also be managed as projects. A project’s Security tab tracks vulnerability findings from its SBOM, with a configurable score threshold and resolution status. For open-source entries without a version, the tab does not show vulnerability lists by ID because accurate verification is difficult without version information. The REST API can return project vulnerability information as JSON and upload analyzed open-source reports. Projects can assign a registered Hub user to security-related Jira issues; if nobody is designated, the creator is assigned by default. FOSSLight Hub is free at no cost and released under AGPL-3.0. Installation guidance covers Docker or Docker Compose, and a Java setup with stated runtime, database and memory requirements.
For and against
For
- Bulk registration covers open-source software and licenses.
- Tracks vulnerability findings with thresholds and resolution status.
- REST API can query vulnerability information as JSON.
- Free and released under AGPL-3.0.
Against
- Vulnerability lists by ID are unavailable for OSS entries without versions.
- Java setup requires Java 11 or higher and at least 8 GB memory.
- FOSSLight Enterprise requires a separate account.
The verdict
FOSSLight Hub brings software inventories, compliance steps and SBOM-based vulnerability tracking into one open-source tool. Version information matters for vulnerability listings, and deployment has documented system requirements.
Who it suits
FOSSLight Hub suits teams handling software compliance, licensing and vulnerability workflows across general distribution, internal transfer, B2B, internal-only, self-check or open-source contribution projects.
Plans and prices
FOSSLight Hub
Released under AGPL-3.0; self-hosted installation is documented
Read 7 Oct 2026 · fosslight.org
On the record
- Access
- The guide lists an LGE-only Hub and FOSSLight Enterprise, which requires a separate account; account inquiries go to [email protected].fosslight.org · read 7 Oct 2026
- Automation
- The documented REST API can query project vulnerability information as JSON and upload analyzed open source reports.fosslight.org · read 7 Oct 2026
- Compliance
- It supports an all-in-one compliance process, including generating open source notices, verifying disclosed source, and tracking issues.github.com · read 7 Oct 2026
- Deployment
- The maker documents Docker and Docker Compose installation, or a Java installation requiring Java 11 or higher, MariaDB 10.0 or higher or MySQL 5.6 or higher, and at least 8 GB memory.fosslight.org · read 7 Oct 2026
- Intended users
- Project distribution types include general software distribution, internal transfer, B2B, internal-only software, self-check, and open source contribution.fosslight.org · read 7 Oct 2026
- Jira workflow
- A project can designate a registered Hub user as the responsible person assigned to security-related Jira issues; the creator is assigned by default if none is designated.fosslight.org · read 7 Oct 2026
- License
- The Hub is released under the AGPL-3.0 open source license.fosslight.org · read 7 Oct 2026
- License management
- It manages open source information, license restrictions, and vulnerabilities, with bulk registration for open source and licenses.github.com · read 7 Oct 2026
- Purpose
- FOSSLight Hub manages open source, licenses, vulnerabilities, project BOMs, and open source compliance workflows.fosslight.org · read 7 Oct 2026
- SBOM
- It manages open source and proprietary software in SBOMs, supports SPDX, and can search projects by software.github.com · read 7 Oct 2026
- Security
- The project Security tab tracks vulnerability findings from the project SBOM, with a configurable vulnerability score threshold and resolution status.fosslight.org · read 7 Oct 2026
- Supply chain
- It can manage third-party software and agreements as projects.github.com · read 7 Oct 2026
- Vulnerability data caveat
- The Security tab does not show vulnerability lists by ID for OSS entries without a version, because accurate vulnerability verification is difficult without that version.fosslight.org · read 7 Oct 2026
