# Third-party notices

## gifsicle 1.96

Source: https://github.com/kohler/gifsicle
Tag: v1.96
Commit: a08e0f6686d467bb8b9e4715b1f1835f12984fb0
Copyright (C) 1997-2025 Eddie Kohler and other notices retained in source.
License selected for this distribution: GNU GPL version 2 only (`COPYING`).
Upstream source is an unmodified, pinned Git submodule. ImageTools adds a CMake configuration outside the upstream tree, disables threads and SIMD, and wraps the CLI in dedicated browser workers with memory-only FS.

Compiler: Emscripten 6.0.11 (emsdk commit b44154299bdefe75ba287874bb63fc9806243771). Its generated runtime and system library files retain their respective licenses; see Emscripten upstream `LICENSE` and `system/lib` notices. These toolchain notices are copied alongside the codec in the source archive before publication.

## libwebp 1.6.0

Source: https://github.com/webmproject/libwebp
Tag: v1.6.0
Commit: 4fa21912338357f89e4fd51cf2368325b59e9bd9
Copyright (c) 2010, Google Inc. All rights reserved. Additional source notices and contributor credits are retained.
License: BSD-3-Clause (`COPYING`), with the additional IP rights grant in `PATENTS`. Full `COPYING`, `PATENTS`, and `AUTHORS` are distributed alongside the WASM and in the complete source archive. The ImageTools converter combines libwebp with the GPL-2.0-only GIF reader and is distributed under GPL-2.0-only.

Unmodified, pinned Git submodule. Encoder and mux are built statically, with optional image I/O tools, threading, SIMD and near-lossless mode disabled. No giflib, PNG, JPEG or TIFF dependency is used by the converter. Lossless mode encodes changed-frame rectangles; lossy mode encodes complete composited frames with user-selected RGB quality and lossless alpha. The C encoder receives stripped GIF data; the JavaScript integration then attaches required ICC and enabled optional metadata with direction tags removed.

## Static AVIF → PNG dependencies

The native and browser decoder use the same pinned, unmodified submodules. Complete source, upstream notices and the integration/build configuration are included in the corresponding-source archive. File hashes and commits are recorded in DEPENDENCIES.lock.json.

- **libavif 1.4.2**, https://github.com/AOMediaCodec/libavif, commit c5240fc79fe5c2407e10afd35f5505ef6333ea49. BSD-2-Clause, full LICENSE retained. Copyright and contributor notices remain in source.
- **dav1d 1.5.4**, https://github.com/videolan/dav1d (official VideoLAN mirror), commit 54706fc6bc0cdecab7e9593974a4039cc038fca7. BSD-2-Clause. Full COPYING and source author notices retained and distributed. Explicitly selected AV1 decoder with one thread and one frame context; assembly disabled in this build.
- **libpng 1.6.58**, https://github.com/pnggroup/libpng, commit 3061454d980de7d53608f594194cfac722721d2a. libpng-2.0 license, full LICENSE and source notices retained.
- **zlib 1.3.2**, https://github.com/madler/zlib, commit da607da739fa6047df13e66a2af6b8bec7c2a498. Zlib license, full LICENSE and source notices retained.

ImageTools generates narrowly modified libavif source copies in the build directory to let zero disable its pixel budget and preserve dav1d ENOMEM diagnostics. The original upstream trees stay unchanged; checked allocations retain their row-stride and address-space guards. See core/avif/device-capacity.cmake and decoder-diagnostics.cmake. YUV float contraction is disabled for reproducible native/WASM conversion. The combined application remains GPL-2.0-only. The AVIF decoder WASM contains no libaom or system codec library.

The dav1d build copies are prepared by scripts/prepare-dav1d.mjs. Its Emscripten Meson build uses the runtime pthread stubs without enabling shared-memory threads. In the selected one-thread/one-frame path, the 32-bit fixed frame-size budget is replaced by checks on actual padded picture and single-frame work-buffer sizes before narrow integer arithmetic. Upstream's guard remains for other threading configurations. The original submodule stays unchanged. Meson and Ninja are build tools, with no dependency downloaded by the codec build.

## GIF → AVIF native/WASM encoder

libaom 3.13.2, source https://aomedia.googlesource.com/aom, commit ad44980d7f3c7a2605c25d51ea96946949000841, BSD-2-Clause LICENSE with the additional grant in PATENTS. Copyright (c) 2016, Alliance for Open Media; source notices and AUTHORS retained. Complete pinned source, LICENSE, PATENTS and AUTHORS are distributed in the corresponding-source archive and license downloads.

The encoder builds libaom's encoder only (CONFIG_AV1_ENCODER=1, CONFIG_AV1_DECODER=0, no SIMD or threads). libavif enables AVIF_CODEC_AOM_ENCODE and disables AVIF_CODEC_AOM_DECODE. Browser encoding and verification use separate WASM modules/workers: the encoder disables dav1d, while the checker disables libaom and explicitly uses dav1d. AV1 frame types are read from dav1d frame headers through a build-copy observation hook in the sequence checker; the native encoder build also provides this checker. The default AVIF-to-PNG decoder build does not compile that hook. SBOM records the native/WASM encoding purpose. The GIF reader integration remains GPL-2.0-only. Actual frame progress callbacks are in ImageTools integration code; upstream submodules remain unchanged.

## Standalone HEIC → JPEG program

- Adobe XMP Toolkit SDK v2025.03, https://github.com/adobe/XMP-Toolkit-SDK, release commit 581c41213ddcee1fbc72cbb532531102a6617a25, BSD-3-Clause. Copyright (c) 2020, Adobe. Unmodified XMPCore sources are linked into the standalone HEIC program for XML/RDF parsing, namespace resolution and metadata editing. XMPFiles, PDF plugins and other file handlers are not compiled. The original LICENSE and source notices are included in the complete source archive and the public license download.
- Expat 2.9.0, https://github.com/libexpat/libexpat, release R_2_9_0, commit a76b1174c1ea52abb639a4c69d52b630a8a106a2, MIT. Original copyright and COPYING retained and distributed. DTD/general entity processing is disabled; XMPCore also disables entity use. No XML parser code is copied into the application.

- libheif 1.23.6, https://github.com/strukturag/libheif, commit f81f28ac014b1c28dee483ac45b72c6b05bc421a, LGPL-3.0-or-later.
- libde265 1.1.3, https://github.com/strukturag/libde265, commit ba62bf4cfb3242f3bf0a45617ff09e35236e4d82, LGPL-3.0-or-later.
- libjpeg-turbo 3.2.0, https://github.com/libjpeg-turbo/libjpeg-turbo, commit c85e6b905bf237038faa936dab160ebfc5da0344, IJG and BSD-3-Clause. The libjpeg API encoder is built without TurboJPEG, tools or SIMD. Full LICENSE.md and README.ijg are distributed.
- Little CMS 2.19.1, https://github.com/mm2/Little-CMS, commit 21c582a594fe5279f90c0b93437c398f93bf62b0, MIT. Only the core library is compiled, without optional GPL plugins.
  The standalone Ultra HDR packer also links this pinned core library for Apple gain-map gamma 2.2 evaluation via cmsBuildGamma/cmsEvalToneCurveFloat.
- libultrahdr 2.0.2, https://github.com/google/libultrahdr, commit e5f5a022fe96fc4dc2ee35c19f733a50df807abe. Separate native/WASM HEIC HDR pack/check program, loaded only for supported HDR conversion and never linked with GIF programs. The core is used under its MIT option; bundled image_io is Apache-2.0 and modp_b64 is BSD-3-Clause. LICENSE, LICENSE-MIT, LICENSE-APACHE, image_io/LICENSE, image_io/src/modp_b64/LICENSE, and adobe-hdr-gain-map-license/NOTICE are included in the complete source archive; public license downloads include the combined core license and bundled notices. No automatic dependency downloads, GPU, HEIF/AVIF or SMPTE path is built. The JPEG packaging CLI and extraction wrapper are MIT under core/heic/LICENSE.

The original libultrahdr release tree is unchanged. `scripts/prepare-ultrahdr.mjs` applies checked edits only to a build-directory copy: reconstruct multi-marker ICC profiles through libjpeg, place MPF ahead of frame/coding headers for Apple ImageIO, and release API-0 intermediate gain-map/SDR/YUV images after their last use. The integration script and complete release sources are included in the corresponding source archive; HDR and JPEG algorithms remain those of the pinned release.

Original HEIC CLI wrapper and configuration: MIT, see core/heic/LICENSE. The separate HEIC program is LGPL-3.0-or-later; it links no GIF/GPLv2 implementation. Communication with the browser uses command arguments, file bytes and JSON, in its own worker. Other application and GIF/AVIF licensing remains as stated above. All exact codec trees, headers, license texts, pinned hashes, native/WASM CMake configurations and the MIT wrapper are present in the complete source archive. Rebuild with the documented Emscripten toolchain to replace heic-jpg.mjs and heic-jpg.wasm; no signing or DRM restricts replacement. Builds use existing local sources and never download codec dependencies during configuration. libheif security budgets are disabled to honor device-capacity processing; integer/stride/allocation checks remain. zlib handles supported compressed metadata; Brotli header compression is not compiled. The original upstream tree is unchanged. scripts/prepare-heif.mjs makes a checked build-directory copy that removes libheif's Emscripten-only disabling of HEVC deblocking and SAO; both normative decoding filters remain enabled. The exact patch and rebuild script are included.

## Batch ZIP download

Batch JPG download uses unmodified **fflate 0.8.3** (MIT), release
https://github.com/101arrowz/fflate/releases/tag/v0.8.3, commit
`dcb3714a6c25db3a2748641019c5277413d09714`. The complete official npm release
distribution is retained in `third_party/fflate`, including its full LICENSE
and readable JavaScript source. DEPENDENCIES.lock.json records package integrity
and every distributed file hash; the source archive and license page include
the library. ZIP creation uses streamed, uncompressed entries in its own
disposable Worker, retaining the exact JPG bytes.

## Public HDR photo example

The sunset HEIC sample and its converted HDR/SDR JPEG views in
`apps/web/public/examples/heic-hdr/` derive from John Charankattu's
`apple-hdr-heic` test photo, `tests/data/hdr-sample.heic` at fixed revision
`e64716c29abc91a3b40543d7c47fb0f526608982`:
https://github.com/johncf/apple-hdr-heic/tree/e64716c29abc91a3b40543d7c47fb0f526608982.
Copyright (c) 2024 John Charankattu; MIT license. The complete upstream license
is distributed beside the images as `LICENSE.txt` and included in the source
archive. `manifest.json` records provenance, hashes and conversion settings;
`scripts/prepare-hdr-example.mjs` rebuilds the views using ImageTools' pinned
production WASM. No upstream project code is introduced by this example.

The Ultra HDR decoder and packer use a checked build-directory copy prepared by scripts/prepare-ultrahdr.mjs. The preparation script and inserted patches are MIT, under core/heic/LICENSE. Its ICC reader calls the pinned libjpeg standard multi-marker ICC reconstruction instead of reading only the first APP2 marker. Its JPEG writer defers coding headers until after MPF, so Apple ImageIO recognizes the auxiliary-image index; compressed image bytes and gain parameters remain unchanged, and the relative image offset is recalculated. Exact source/patch fingerprints are checked; the upstream submodule is unchanged. Packaging starts with a metadata-free base JPEG and explicit verified sRGB/Display-P3 gamut. The application then restores complete source ICC and optional normalized Exif/XMP, repairing MPF lengths, before reference HDR decoding. The packer is replaceable as codecs/ultrahdr-pack.mjs and .wasm with no signing or DRM restrictions.