# HEIC conversion: third-party notices and source

This site uses a locally modified build of heic-to 1.6.6's decoder, containing libheif 1.23.6 and libde265 1.0.16. The decoder is used in the browser; this component does not transmit the selected original photo to an external conversion service.

The libraries and local modifications are covered by GNU LGPL version 3 or later. They are supplied without warranty. See licenses/heic-to-LICENSE.txt, licenses/libheif-COPYING.txt, licenses/libde265-COPYING.txt, licenses/LGPL-3.txt and licenses/GPL-3.txt. Original per-file copyright notices remain in the complete source archives. Principal upstream authors include Hopper Gee; Dirk Farin, struktur AG and libheif contributors; and struktur AG, Dirk Farin and openHEVC/libde265 contributors.

Runtime notices are preserved in licenses/emscripten-LICENSE.txt and emscripten-AUTHORS.txt (MIT / Illinois-NCSA, including the Node path-code notice), musl-COPYRIGHT.txt (MIT and retained subcomponent notices), and the LLVM libc++/libc++abi/libunwind/compiler-rt license files. The libde265 MD5 implementation's public-domain/fallback permission notice is retained separately. The full source archives preserve other source-only tooling/sample notices.

ABC local modifications, dated 2026-10-12: a 384 MiB codec linear-heap ceiling, a checked per-context resource-limit adapter, and a modification notice. See patches/apply-abc-limits.py for the exact deterministic transformation, patches/abc-post.js for the source-level adapter and BUILD.md for complete build and replacement instructions. There is no claim that this codec heap ceiling bounds all browser-process RAM.

Corresponding source is supplied alongside this file in sources/. The full libheif 1.23.6 and libde265 1.0.16 archives, exact heic-to npm/repository source, its build glue and the local patch are included, with hashes in MANIFEST.json and SHA256SUMS.txt. Emscripten 3.1.61 reference-toolchain source is included in parts of at most 10 MiB; BUILD.md explains reassembly. The publisher's original compiler version was not recorded; the reference version is the libheif release's own CI pin.

Application glue is available on this same site at /assets/photo-worker.js, /assets/photo-processing.js and /assets/photo-inspect.js. Those files and this independently replaceable decoder can be downloaded for local rebuilding/recombination. See BUILD.md. Upstream project links and exact archive URLs are recorded in MANIFEST.json.

Synthetic test fixtures were generated from four solid-color quadrants by the accompanying generator scripts. They contain no personal photographs. No third-party photograph or image sample was incorporated. The new generation scripts are provided with this source package under LGPL-3.0-or-later. This does not change the licenses of FFmpeg, x265 or Pillow used as build tools.