# Third-party components and licenses Toolars ships third-party software to your browser. This file is the stable, citable index of what is shipped, under which license, and where its source is. Files under `/generated/runtime//` are content-addressed by the build and **change whenever their bytes change**, so cite the stable copies listed here rather than the generated ones. Last reviewed: 2026-09-25. ## Copyleft components ### FFmpeg (ffmpeg.wasm core) | | | | -------------------- | --------------------------------------------------------------------------------------------------------------------- | | Package | `@ffmpeg/core` 0.12.10 (`@ffmpeg/ffmpeg` 0.12.15 is the MIT-licensed wrapper) | | Declared license | `GPL-2.0-or-later` | | Conveyed here under | **GNU GPL version 3** (the "or later" option) | | License text | [`GPL-3.0.txt`](./GPL-3.0.txt) — verbatim, SHA-256 `8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903` | | Used by | the Video ↔ GIF converter (`/tools/video-gif-converter`) | | Shipped as | `ffmpeg-core.js`, `ffmpeg-core.wasm` (~31 MB), fetched only when a conversion starts | | Redistributed | **unmodified** — copied byte-for-byte from the npm package by `scripts/build-tool-workers.mjs` | | Corresponding source | (tag for 0.12.10), and the npm tarball `@ffmpeg/core@0.12.10` | FFmpeg is a trademark of Fabrice Bellard, originator of the FFmpeg project. This component is provided **without any warranty**, including without the implied warranty of merchantability or fitness for a particular purpose. ### libheif (HEIC decoder) | | | | -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Package | `libheif-js` 1.23.2 (decoder-only Emscripten build, bundled libde265) | | License | `LGPL-3.0` for libheif; MIT for the JS wrappers and sample applications | | License text | [`LGPL-3.0.txt`](./LGPL-3.0.txt) — verbatim, SHA-256 `da7eabb7bafdf7d3ae5e9f223aa5bdc1eece45ac569dc21b3b037520b4464768`. LGPL-3.0 incorporates GPL-3.0 by reference, which is why [`GPL-3.0.txt`](./GPL-3.0.txt) is also provided. | | Used by | HEIC input in the Image Format Converter (`/tools/image-format-converter`) | | Shipped as | `libheif.js`, `libheif.wasm`, fetched only after a file passes HEIC signature validation | | Redistributed | unmodified, copied from the npm package | | Corresponding source | and | The engineering judgment on satisfying LGPL-3.0's "replace the library" condition — the decoder ships as separate, content-addressed files loaded through a documented path rather than being statically linked into application code — is recorded in `docs/adr/012-heic-local-decoder.md`. ## Permissive components with notices already served | Component | License | Notice | | --------------------------------------------------------------------------------------------------------- | ------------------------- | -------------------------------------------------------------------------------------------------------------------- | | `jsqr` 1.4.0 | Apache-2.0 | [`jsqr-1.4.0.txt`](./jsqr-1.4.0.txt) | | `tesseract.js` 6.0.1, `tesseract.js-core` 6.0.0 | Apache-2.0 | [`ocr/tesseract-js.txt`](./ocr/tesseract-js.txt), [`ocr/tesseract-core.txt`](./ocr/tesseract-core.txt) | | `tessdata_fast` language models (eng, chi_sim, chi_tra, jpn, kor, deu, fra, spa, rus, por, vie, hin, ind) | Apache-2.0 | [`ocr/tessdata-fast-models.txt`](./ocr/tessdata-fast-models.txt), [`ocr/english-model.txt`](./ocr/english-model.txt) | | `pdfjs-dist` 6.2.108 | Apache-2.0 | `LICENSE_*` files under `/generated/pdfjs/6.2.108/wasm/` | | Barlow (font) | SIL Open Font License 1.1 | `src/assets/fonts/OFL.txt` (repository) | | Application bundles (React, Next.js, and the remaining MIT/ISC/BSD dependencies) | MIT / ISC / BSD | `*.LICENSE.txt` emitted next to the generated bundles under `/generated/` | ## No warranty and no added restrictions The third-party components listed above are provided as-is, without warranty of any kind. Toolars adds no restrictions of its own on top of the licenses above, beyond what the licenses themselves require to be preserved. ## How to check this `scripts/audit-third-party-licenses.mjs` verifies that every component in the table above still has a notice present and non-empty, and fails the build if a copyleft component is added without one. Run it with: ```bash corepack pnpm audit:third-party-licenses ``` ## How a notice reaches the binary `scripts/build-tool-workers.mjs` stages each runtime asset and: 1. reads any `.LICENSE.txt` or `.LEGAL.txt` sibling next to the source artifact in `node_modules`; 2. where upstream ships none — `@ffmpeg/core` ships no license file at all — writes this directory's text beside the input first, so both cases take the same path; 3. folds the notice bytes **into the asset's content hash**, so a licence change produces a new URL instead of silently changing what an existing URL means; 4. writes the notice next to the content-addressed output as well, so it is served beside the binary it covers. An asset listed in `REQUIRED_NOTICES` in that script that would be emitted without a notice **fails the build** rather than shipping unnoted. The audit below checks the shipped artifact too: ```bash corepack pnpm audit:third-party-licenses # reports every gap, exits 0 corepack pnpm audit:third-party-licenses --strict # exits non-zero if any gap is accepted ``` It verifies the stable texts in this directory, then — when a build output is present — that each copyleft artifact carries a notice at both its compatibility path and its content-addressed path. There are **no accepted gaps** today.