Vitali Web Tools — HEIC decoder notices and source access
Reviewed: 2026-09-05

HEIC decoding uses heic-to 1.5.2 by Hopper Gee, containing libheif 1.22.2
and libde265 1.0.16 by their respective contributors. These libraries are
licensed under the GNU Lesser General Public License. heic-to's package
metadata says LGPL-3.0; its LICENSE permits version 3 or any later version.
Read each supplied licence and source-file notice for the applicable terms.
No warranty is provided by these libraries.

Licence texts, including the GPL text incorporated by LGPL v3:
  heic-to-1.5.2-LICENSE.txt
  libheif-1.22.2-COPYING.txt
  libde265-1.0.16-COPYING.txt

Unmodified source distributions are available alongside this notice:
  heic-to-1.5.2.tgz
  libheif-1.22.2-source.tar.gz
  libde265-1.0.16-source.tar.gz

Original sources:
  https://github.com/hoppergee/heic-to/tree/f37af866f9aa6212ddc84b67a279c9f2386aba4f
  https://github.com/strukturag/libheif/tree/v1.22.2
  https://github.com/strukturag/libde265/tree/v1.0.16

The installed CSP decoder source declares:
  libheif 1.22.2, USE_UNSAFE_EVAL=0, LIBDE265_VERSION=1.0.16.
The package's esbuild.mjs documents creation of the CSP entry point.
The upstream build guide uses USE_WASM=0, USE_UNSAFE_EVAL=0 and
LIBDE265_VERSION=1.0.16 for its Emscripten decoder build. It requires
Emscripten, CMake and the other prerequisites described in those sources.
The exact upstream Emscripten version and a bit-identical rebuild have not
been independently established by Vitali Web Tools.

The application uses the unmodified heic-to/csp API in bitmap mode inside
a local processing worker. The decoder is imported only when HEIC input
has passed header checks. It is not an external conversion service.
AVIF input uses the browser's own decoder instead of this library.

No terms imposed by Vitali Web Tools restrict modification of these
libraries or reverse engineering for debugging modifications to them.
The technical source/relinking arrangement for a production distribution
must be reviewed separately; this notice does not assert that such a
release review or a legal compliance assessment has already occurred.

SHA-256:
heic-to-1.5.2.tgz
a301b46a2e5a2a050c44d7c1655d63b4c17415312ebcfa82920e950baffc5a7f
libheif-1.22.2-source.tar.gz
af30a8b32dfbc1dc86a7f0f55a53107dad35010a65ebf1feb468082e402b11e0
libde265-1.0.16-source.tar.gz
ed12c931759c1575848832f70db5071a001ac813db4e4f568ee08aef6e234d4e