# Third-party notices av-tools 0.2.1 is Copyright © 2026 Albrecht Degering and licensed GPL-3.0-or-later; see the root `LICENSE`. This inventory describes third-party inputs. It is informational, not legal advice, and does not replace their terms. Files under `LICENSES/` reproduce available terms. A packaged ZIP also receives licence files shipped by installed runtime npm packages under `LICENSES/npm/`. ## Browser runtime | Package | Version | Licence declared upstream | Project source | Role | Distribution | | -------------------------------- | -------------------------- | ------------------------- | --------------------------------------------- | ------------------------------------------------------- | --------------------------------------------------------- | | `@add-ideas/toolbox-contract` | 0.2.3 | Apache-2.0 | `https://git.add-ideas.de/lotobo/toolbox-sdk` | typed manifest/context contract | shipped, bundled | | `@add-ideas/toolbox-shell-react` | 0.2.3 | Apache-2.0 | `https://git.add-ideas.de/lotobo/toolbox-sdk` | shared Toolbox application shell | shipped, bundled | | `@ffmpeg/ffmpeg` | 0.12.15 | MIT | `https://github.com/ffmpegwasm/ffmpeg.wasm` | browser worker and high-level FFmpeg API | shipped, bundled | | `@ffmpeg/util` | 0.12.2 | MIT | `https://github.com/ffmpegwasm/ffmpeg.wasm` | byte/blob helpers | shipped, bundled | | `@ffmpeg/types` | 0.12.4 | MIT | `https://github.com/ffmpegwasm/ffmpeg.wasm` | transitive runtime API types | shipped as compiled/bundled references | | reviewed FFmpeg WASM cores | 0.12.10-reviewed-stack5m.1 | GPL-enabled combined work | `https://github.com/ffmpegwasm/ffmpeg.wasm` | ST/MT FFmpeg JavaScript, WebAssembly and pthread worker | rebuilt from locked source and shipped as verified assets | | `fflate` | 0.8.3 | MIT | `https://github.com/101arrowz/fflate` | in-browser ZIP creation | shipped, bundled | | DejaVu Sans | 2.37 | Bitstream Vera/Arev terms | `https://dejavu-fonts.github.io/` | deterministic local contact-sheet labels | shipped unmodified as reviewed TTF | | `react` | 19.2.7 | MIT | `https://github.com/facebook/react` | user-interface runtime | shipped, bundled | | `react-dom` | 19.2.7 | MIT | `https://github.com/facebook/react` | browser rendering | shipped, bundled | | `scheduler` | 0.27.0 | MIT | `https://github.com/facebook/react` | transitive React scheduling runtime | shipped, bundled | The MIT text inspected in the ffmpeg.wasm source is `LICENSES/ffmpeg.wasm-MIT.txt`. The reviewed cores enable GPL FFmpeg features and statically link GPL components; `LICENSES/GPL-2.0-or-later.txt` reproduces GPL version 2. These notices do not make the complete application “MIT-only.” The reviewed DejaVu file is identified byte-for-byte in `SOURCE.md`; its full embedded terms are in `LICENSES/DEJAVU_FONTS.txt`. No remote or system font is used as a runtime fallback. ## Native components linked into the WebAssembly cores The following list is derived from the `v12.15` ffmpeg.wasm Dockerfile, the configuration embedded in the reviewed 0.12.10 WASM and the resolved histories of its source repositories. Branch-based inputs are recorded below as exact commits. The combined core is GPL-enabled. Individual projects retain their own terms, notices, patent considerations and corresponding-source requirements. | Component | Upstream build ref | Upstream term(s) to review | Source selected by the build | Role | Distribution | | --------- | --------------------------------------------------- | ------------------------------------------------------ | ----------------------------------------- | -------------------------------------------------- | -------------------------- | | FFmpeg | n5.1.4 (`4729204c17f756e186d622060088371d10b34f7e`) | LGPL-2.1-or-later; GPL features enabled for this build | `https://github.com/FFmpeg/FFmpeg` | demuxing, decoding, filtering, encoding and muxing | shipped in both WASM cores | | x264 | `33cac6b77d5b9259c552156013a817ab23119612` | GPL-2.0-or-later/commercial alternatives | `https://github.com/ffmpegwasm/x264` | H.264 encoding | shipped, statically linked | | x265 | `2bb5520e9596f361bf0ed81b3b8da0d7fd999069` | GPL-2.0-or-later/commercial alternatives | `https://github.com/ffmpegwasm/x265` | HEVC encoding | shipped, statically linked | | libvpx | v1.13.1 | BSD-3-Clause | `https://github.com/ffmpegwasm/libvpx` | VP8/VP9 codecs | shipped, statically linked | | LAME | `2badea1974ae36cb8312afe99cff1e6b3b5decee` | LGPL-2.0-or-later | `https://github.com/ffmpegwasm/lame` | MP3 encoding | shipped, statically linked | | Ogg | v1.3.4 | BSD-3-Clause | `https://github.com/ffmpegwasm/Ogg` | Ogg framing | shipped, statically linked | | Theora | v1.1.1 | BSD-3-Clause | `https://github.com/ffmpegwasm/theora` | Theora codec | shipped, statically linked | | Opus | v1.3.1 | BSD-3-Clause | `https://github.com/ffmpegwasm/opus` | Opus codec | shipped, statically linked | | Vorbis | v1.3.3 | BSD-3-Clause | `https://github.com/ffmpegwasm/vorbis` | Vorbis codec | shipped, statically linked | | zlib | v1.2.11 | Zlib | `https://github.com/ffmpegwasm/zlib` | DEFLATE support | shipped, statically linked | | libwebp | v1.3.2 | BSD-3-Clause | `https://github.com/ffmpegwasm/libwebp` | WebP codec/muxing | shipped, statically linked | | FreeType | VER-2-10-4 | FTL or GPL-2.0-only | `https://github.com/ffmpegwasm/freetype2` | font rendering | shipped, statically linked | | FriBidi | v1.0.9 | LGPL-2.1-or-later | `https://github.com/fribidi/fribidi` | bidirectional text | shipped, statically linked | | HarfBuzz | 5.2.0 | MIT | `https://github.com/harfbuzz/harfbuzz` | text shaping | shipped, statically linked | | libass | 0.15.0 | ISC | `https://github.com/libass/libass` | ASS/SSA subtitle rendering | shipped, statically linked | | zimg | release-3.0.5 | WTFPL-2.0 | `https://github.com/sekrit-twc/zimg` | image scaling/conversion | shipped, statically linked | The publisher must make the reviewed Corresponding Source bundle and external notices available with the core assets and assess applicable patent/licensing constraints. Exact upstream legal files for these native components are included under `LICENSES/native/` in both the source tree and production ZIP. `SOURCE.md` records the immutable source identities and retrieval instructions. ## Development-only packages These direct packages support building or testing and are not intentionally shipped in the static ZIP: | Package | Exact version | Licence | Role | | ----------------------------- | ------------- | ---------- | ------------------------------------- | | `@add-ideas/toolbox-testkit` | 0.2.3 | Apache-2.0 | manifest and nested-path test helpers | | `@eslint/js` | 10.0.1 | MIT | lint rules | | `@playwright/test` | 1.61.1 | Apache-2.0 | browser tests | | `@testing-library/jest-dom` | 6.9.1 | MIT | DOM assertions | | `@testing-library/react` | 16.3.2 | MIT | component tests | | `@testing-library/user-event` | 14.6.1 | MIT | interaction tests | | `@types/node` | 25.9.5 | MIT | Node type declarations | | `@types/react` | 19.2.17 | MIT | React type declarations | | `@types/react-dom` | 19.2.3 | MIT | React DOM type declarations | | `@vitejs/plugin-react` | 6.0.3 | MIT | Vite React transform | | `eslint` | 10.7.0 | MIT | static analysis | | `eslint-plugin-react-hooks` | 7.1.1 | MIT | hooks lint rules | | `eslint-plugin-react-refresh` | 0.5.2 | MIT | refresh lint rules | | `globals` | 17.7.0 | MIT | lint environment data | | `jsdom` | 29.1.1 | MIT | unit-test DOM | | `prettier` | 3.9.5 | MIT | formatting | | `typescript` | 6.0.3 | Apache-2.0 | type checking | | `typescript-eslint` | 8.64.0 | MIT | TypeScript lint support | | `vite` | 8.1.5 | MIT | development and production bundling | | `vitest` | 4.1.10 | MIT | unit/integration tests | Native FFmpeg 7.1.3 was development-only for fixture generation. It and its host libraries are not an application runtime dependency and are not included in the release ZIP. Generated fixture data is CC0-1.0 as described in `tests/fixtures/README.md`.