EVERYTHING XIAOMI
Get listed

FOSSLight Hub

FOSSLight Hub is a free, open-source tool for managing software components, licenses, vulnerabilities, SBOMs, and compliance work.

Place
#22 of 28
Score
5.9
FOSSLight Hub's website

What FOSSLight Hub is

FOSSLight Hub is a free, open-source tool for managing software components, licenses, vulnerabilities, SBOMs, and compliance work. It supports bulk registration of open-source software and license information, review of license restrictions, creation of open-source notices, checks of disclosed source, and issue tracking. Its SBOM features cover open-source and proprietary software, support SPDX and CycloneDX imports, and let teams search projects by software. Third-party software and agreements can also be managed as projects. A project Security tab tracks vulnerability findings from its SBOM, with a configurable score threshold and resolution status; findings by ID are not shown for open-source entries without a version. The documented REST API can return project vulnerability information as JSON and accept analyzed open-source reports. Projects can assign registered Hub users to security-related Jira issues, with the creator assigned by default if no responsible person is set. Deployment options include Docker or Docker Compose, or Java 11 or higher with a supported database and at least 8 GB memory. The Hub is released under AGPL-3.0.

Good

  • Bulk registration for software and licenses
  • SBOM support includes SPDX and CycloneDX imports
  • Tracks vulnerability status and configurable score threshold
  • REST API supports queries and report uploads

Watch out

  • Open-source entries without versions lack vulnerability findings by ID
  • Java installation requires Java 11 or higher
  • Java installation requires at least 8 GB memory

Who it suits

It suits teams that need to track software components, license obligations, vulnerabilities, and compliance workflows across projects. Its self-hosted deployment options and API may fit teams integrating those tasks into their own processes.

Verdict

FOSSLight Hub brings component, license, SBOM, vulnerability, and compliance tracking into one open-source tool. Check its deployment requirements and version-related vulnerability caveat against your project needs.

Plans and prices

From FOSSLight Hub's own pricing page, checked 7 Oct 2026.

All about pricing
PlanPriceWhat it gives you
FOSSLight HubFreeReleased under AGPL-3.0; self-hosted installation is documented

The facts

Each one read from FOSSLight Hub's own pages, with the date it was checked.

What it does

Access
The guide lists an LGE-only Hub and FOSSLight Enterprise, which requires a separate account; account inquiries go to [email protected].checked 7 Oct 2026
Automation
The documented REST API can query project vulnerability information as JSON and upload analyzed open source reports.checked 7 Oct 2026
Compliance
It supports an all-in-one compliance process, including generating open source notices, verifying disclosed source, and tracking issues.checked 7 Oct 2026
Deployment
The maker documents Docker and Docker Compose installation, or a Java installation requiring Java 11 or higher, MariaDB 10.0 or higher or MySQL 5.6 or higher, and at least 8 GB memory.checked 7 Oct 2026
Intended users
Project distribution types include general software distribution, internal transfer, B2B, internal-only software, self-check, and open source contribution.checked 7 Oct 2026
Jira workflow
A project can designate a registered Hub user as the responsible person assigned to security-related Jira issues; the creator is assigned by default if none is designated.checked 7 Oct 2026
License
The Hub is released under the AGPL-3.0 open source license.checked 7 Oct 2026
License management
It manages open source information, license restrictions, and vulnerabilities, with bulk registration for open source and licenses.checked 7 Oct 2026
Purpose
FOSSLight Hub manages open source, licenses, vulnerabilities, project BOMs, and open source compliance workflows.checked 7 Oct 2026
SBOM
It manages open source and proprietary software in SBOMs, supports SPDX, and can search projects by software.checked 7 Oct 2026
Security
The project Security tab tracks vulnerability findings from the project SBOM, with a configurable vulnerability score threshold and resolution status.checked 7 Oct 2026
Supply chain
It can manage third-party software and agreements as projects.checked 7 Oct 2026
Vulnerability data caveat
The Security tab does not show vulnerability lists by ID for OSS entries without a version, because accurate vulnerability verification is difficult without that version.checked 7 Oct 2026

Alternatives to FOSSLight Hub

All alternatives
  1. 1

    DeepFilterNet

    Free planOpen sourceAPILinuxmacOSSelf-hosted
    7.6Free plan
    Visit
  2. 2FOSSology logo

    FOSSology

    Free planOpen sourceWebAPILinuxmacOS
    7.5Free plan
    Visit
  3. 3

    ScanCode.io

    Free planWebAPILinuxmacOS
    7.0Free plan
    Visit
  4. 4

    SourceTrust

    Free planWeb
    6.7From $299 a year
    Visit
  5. 5

    FOSSA

    Free planWebAPILinuxSelf-hosted
    6.4Free plan
    Visit
  6. 6

    DejaCode

    WebAPILinuxSelf-hosted
    6.3From $500 a month
    Visit