# Third-party components and source access

These files are application resources loaded by the browser. No user media is sent to the upstream projects. Notices and upstream licenses remain applicable; this document does not replace them.

## FFmpeg WebAssembly

- Binary package: `@ffmpeg/core` **0.12.10**, GPL-2.0-or-later with its linked codec libraries. Local `ffmpeg-core.js` is byte-identical to the npm ESM artifact.
- Wrapper license: [FFmpeg WASM](licenses/FFMPEG-WASM-LICENSE.txt). Core license: [GPL v2](licenses/FFMPEG-GPL-2.0.txt); LGPL library text: [LGPL v2.1](licenses/FFMPEG-LGPL-2.1.txt).
- Matching upstream package/build release: repository tag **v12.15**, commit `71aa99d37c02a7b4c435275ca9ef50e612f6efa1`. Do not confuse the package version with repository tag v0.12.10, which contains an older core.
- [Download build and binding source](ffmpeg/source/ffmpeg-wasm-core-0.12.10-build-source.tar.gz), [Dockerfile](ffmpeg/source/Dockerfile), [dependency source locations](ffmpeg/source/dependencies.json).
- FFmpeg source: [n5.1.4](https://github.com/FFmpeg/FFmpeg/tree/n5.1.4), [source download](https://github.com/FFmpeg/FFmpeg/archive/refs/tags/n5.1.4.tar.gz).
- The build archive contains all build scripts and upstream codec source references. Follow its Dockerfile to obtain FFmpeg and codec sources, and use its Emscripten 3.1.40 configuration. Upstream moving branches are identified as such in the dependency index; we do not claim historical builds are bit-for-bit reproducible from current branch heads.

## Image metadata components

See [metadata notice and modification details](metadata/NOTICE.md). Separate modules can be replaced without rebuilding the website.

- [libheif corresponding source](metadata/source/libheif-1.23.5-source.tar.gz), upstream submodule commit `413e2a87e6a70b3eccc3a3adc5801179dd2d9e00`.
- [libheif JavaScript wrapper source](metadata/source/libheif-js-build-source.tar.gz).
- [libheif Emscripten build source](metadata/source/libheif-emscripten-build-source.tar.gz).
- [libheif LGPL-3.0 license](metadata/HEIF-LICENSE), [exifr MIT license](metadata/EXIFR-LICENSE), [pdf-lib MIT license](metadata/PDF-LIB-LICENSE). Piexif MIT notice is retained in its module.

## Other resources

| Component | Version / source | License |
| --- | --- | --- |
| fflate | 0.8.2, https://github.com/101arrowz/fflate | [MIT](licenses/FFLATE-LICENSE.txt) |
| qrcode-generator | 1.4.4, https://github.com/kazuhikoarase/qrcode-generator | [MIT](licenses/QRCODE-LICENSE.txt) |
| jsQR | 1.4.0, https://github.com/cozmo/jsQR | [Apache-2.0](licenses/JSQR-LICENSE.txt) |
| Tesseract.js | 5.1.1, https://github.com/naptha/tesseract.js | [Apache-2.0](licenses/TESSERACT-LICENSE.txt), bundle notices alongside JS |
| Tesseract.js-core | 5.1.1, https://github.com/naptha/tesseract.js-core | [Apache-2.0](licenses/TESSERACT-CORE-LICENSE.txt) |
| OCR trained data | https://github.com/tesseract-ocr/tessdata | Apache-2.0 |
| Transformers.js | 3.5.2, https://github.com/huggingface/transformers.js/tree/43622374f44c393e24228ebd8594369e96a13bb5 | [Apache-2.0](licenses/TRANSFORMERS-LICENSE.txt) |
| ONNX Runtime Web (super-resolution) | 1.22.0-dev.20250409-89f8206ba4, https://github.com/microsoft/onnxruntime/tree/89f8206ba4 | [MIT](licenses/ONNX-LEGACY-LICENSE.txt) |
| ONNX Runtime Web (RIFE) | 1.30.0, https://github.com/microsoft/onnxruntime | [MIT](ort/LICENSE) |
| RIFE model | Pinned file/source and hash | [Source and MIT notice](rife/NOTICE.md) |
| Swin2SR model | Browser downloads https://huggingface.co/Xenova/swin2SR-classical-sr-x2-64 | See upstream model card and licenses |

Website processing remains local. Replacing a component can affect file compatibility and browser memory requirements; the metadata checker does not validate C2PA signatures or determine whether pixels were AI generated.