Files
av-tools/THIRD_PARTY_NOTICES.md

98 lines
11 KiB
Markdown

# Third-party notices
av-tools 0.1.0 is Copyright © 2026 Albrecht Degering and licensed
GPL-3.0-or-later; see the root `LICENSE`. This inventory describes third-party
inputs. It is informational, not legal advice, and does not replace their
terms. Files under `LICENSES/` reproduce available terms. A packaged ZIP also
receives licence files shipped by installed runtime npm packages under
`LICENSES/npm/`.
## Browser runtime
| Package | Version | Licence declared upstream | Project source | Role | Distribution |
| -------------------------------- | ------- | ------------------------- | --------------------------------------------- | ------------------------------------------------------------- | -------------------------------------- |
| `@add-ideas/toolbox-contract` | 0.2.2 | Apache-2.0 | `https://git.add-ideas.de/zemion/toolbox-sdk` | typed manifest/context contract | shipped, bundled |
| `@add-ideas/toolbox-shell-react` | 0.2.2 | Apache-2.0 | `https://git.add-ideas.de/zemion/toolbox-sdk` | shared Toolbox application shell | shipped, bundled |
| `@ffmpeg/ffmpeg` | 0.12.15 | MIT | `https://github.com/ffmpegwasm/ffmpeg.wasm` | browser worker and high-level FFmpeg API | shipped, bundled |
| `@ffmpeg/util` | 0.12.2 | MIT | `https://github.com/ffmpegwasm/ffmpeg.wasm` | byte/blob helpers | shipped, bundled |
| `@ffmpeg/types` | 0.12.4 | MIT | `https://github.com/ffmpegwasm/ffmpeg.wasm` | transitive runtime API types | shipped as compiled/bundled references |
| `@ffmpeg/core` | 0.12.10 | GPL-2.0-or-later package | `https://github.com/ffmpegwasm/ffmpeg.wasm` | single-thread FFmpeg JavaScript and WebAssembly | shipped verbatim as self-hosted assets |
| `@ffmpeg/core-mt` | 0.12.10 | GPL-2.0-or-later package | `https://github.com/ffmpegwasm/ffmpeg.wasm` | multithread FFmpeg JavaScript, WebAssembly and pthread worker | shipped verbatim as self-hosted assets |
| `fflate` | 0.8.3 | MIT | `https://github.com/101arrowz/fflate` | in-browser ZIP creation | shipped, bundled |
| `react` | 19.2.7 | MIT | `https://github.com/facebook/react` | user-interface runtime | shipped, bundled |
| `react-dom` | 19.2.7 | MIT | `https://github.com/facebook/react` | browser rendering | shipped, bundled |
| `scheduler` | 0.27.0 | MIT | `https://github.com/facebook/react` | transitive React scheduling runtime | shipped, bundled |
The MIT text inspected in the ffmpeg.wasm source is
`LICENSES/ffmpeg.wasm-MIT.txt`. The core npm tarballs do not contain a licence
file, but their package manifests declare `GPL-2.0-or-later`;
`LICENSES/GPL-2.0-or-later.txt` reproduces GPL version 2. These notices do not
make the complete application “MIT-only.”
## Native components linked into the WebAssembly cores
The following list is derived from the `v12.15` ffmpeg.wasm Dockerfile, the
configuration embedded in the copied 0.12.10 WASM and the resolved histories
of its source repositories. Branch-based inputs are recorded below as exact
commits. The combined core is GPL-enabled. Individual projects retain their
own terms, notices, patent considerations and corresponding-source
requirements.
| Component | Upstream build ref | Upstream term(s) to review | Source selected by the build | Role | Distribution |
| --------- | --------------------------------------------------- | ------------------------------------------------------ | ----------------------------------------- | -------------------------------------------------- | -------------------------- |
| FFmpeg | n5.1.4 (`4729204c17f756e186d622060088371d10b34f7e`) | LGPL-2.1-or-later; GPL features enabled for this build | `https://github.com/FFmpeg/FFmpeg` | demuxing, decoding, filtering, encoding and muxing | shipped in both WASM cores |
| x264 | `33cac6b77d5b9259c552156013a817ab23119612` | GPL-2.0-or-later/commercial alternatives | `https://github.com/ffmpegwasm/x264` | H.264 encoding | shipped, statically linked |
| x265 | `2bb5520e9596f361bf0ed81b3b8da0d7fd999069` | GPL-2.0-or-later/commercial alternatives | `https://github.com/ffmpegwasm/x265` | HEVC encoding | shipped, statically linked |
| libvpx | v1.13.1 | BSD-3-Clause | `https://github.com/ffmpegwasm/libvpx` | VP8/VP9 codecs | shipped, statically linked |
| LAME | `2badea1974ae36cb8312afe99cff1e6b3b5decee` | LGPL-2.0-or-later | `https://github.com/ffmpegwasm/lame` | MP3 encoding | shipped, statically linked |
| Ogg | v1.3.4 | BSD-3-Clause | `https://github.com/ffmpegwasm/Ogg` | Ogg framing | shipped, statically linked |
| Theora | v1.1.1 | BSD-3-Clause | `https://github.com/ffmpegwasm/theora` | Theora codec | shipped, statically linked |
| Opus | v1.3.1 | BSD-3-Clause | `https://github.com/ffmpegwasm/opus` | Opus codec | shipped, statically linked |
| Vorbis | v1.3.3 | BSD-3-Clause | `https://github.com/ffmpegwasm/vorbis` | Vorbis codec | shipped, statically linked |
| zlib | v1.2.11 | Zlib | `https://github.com/ffmpegwasm/zlib` | DEFLATE support | shipped, statically linked |
| libwebp | v1.3.2 | BSD-3-Clause | `https://github.com/ffmpegwasm/libwebp` | WebP codec/muxing | shipped, statically linked |
| FreeType | VER-2-10-4 | FTL or GPL-2.0-only | `https://github.com/ffmpegwasm/freetype2` | font rendering | shipped, statically linked |
| FriBidi | v1.0.9 | LGPL-2.1-or-later | `https://github.com/fribidi/fribidi` | bidirectional text | shipped, statically linked |
| HarfBuzz | 5.2.0 | MIT | `https://github.com/harfbuzz/harfbuzz` | text shaping | shipped, statically linked |
| libass | 0.15.0 | ISC | `https://github.com/libass/libass` | ASS/SSA subtitle rendering | shipped, statically linked |
| zimg | release-3.0.5 | WTFPL-2.0 | `https://github.com/sekrit-twc/zimg` | image scaling/conversion | shipped, statically linked |
The publisher must make the reviewed Corresponding Source bundle and external
notices available with the core assets and assess applicable patent/licensing
constraints. Exact upstream legal files for these native components are
included under `LICENSES/native/` in both the source tree and production ZIP.
`SOURCE.md` records the immutable source identities and retrieval instructions.
## Development-only packages
These direct packages support building or testing and are not intentionally
shipped in the static ZIP:
| Package | Exact version | Licence | Role |
| ----------------------------- | ------------- | ---------- | ------------------------------------- |
| `@add-ideas/toolbox-testkit` | 0.2.2 | Apache-2.0 | manifest and nested-path test helpers |
| `@eslint/js` | 10.0.1 | MIT | lint rules |
| `@playwright/test` | 1.61.1 | Apache-2.0 | browser tests |
| `@testing-library/jest-dom` | 6.9.1 | MIT | DOM assertions |
| `@testing-library/react` | 16.3.2 | MIT | component tests |
| `@testing-library/user-event` | 14.6.1 | MIT | interaction tests |
| `@types/node` | 25.9.5 | MIT | Node type declarations |
| `@types/react` | 19.2.17 | MIT | React type declarations |
| `@types/react-dom` | 19.2.3 | MIT | React DOM type declarations |
| `@vitejs/plugin-react` | 6.0.3 | MIT | Vite React transform |
| `eslint` | 10.7.0 | MIT | static analysis |
| `eslint-plugin-react-hooks` | 7.1.1 | MIT | hooks lint rules |
| `eslint-plugin-react-refresh` | 0.5.2 | MIT | refresh lint rules |
| `globals` | 17.7.0 | MIT | lint environment data |
| `jsdom` | 29.1.1 | MIT | unit-test DOM |
| `prettier` | 3.9.5 | MIT | formatting |
| `typescript` | 6.0.3 | Apache-2.0 | type checking |
| `typescript-eslint` | 8.64.0 | MIT | TypeScript lint support |
| `vite` | 8.1.5 | MIT | development and production bundling |
| `vitest` | 4.1.10 | MIT | unit/integration tests |
Native FFmpeg 7.1.3 was development-only for fixture generation. It and its
host libraries are not an application runtime dependency and are not included
in the release ZIP. Generated fixture data is CC0-1.0 as described in
`tests/fixtures/README.md`.