# Public source inventory

## Deployed third-party module

- Path: `../vendor/heic-to-1.6.7-csp.js`
- Package/API: `heic-to@1.6.7/csp`
- SHA-256: `E0A515585872C319C601C33551925C9D5FEE31746CAF0311291ED7E6364C592C`
- Status: unmodified copy of the package CSP entry

## Pinned upstream source snapshots

| Component | Revision | File | SHA-256 |
| --- | --- | --- | --- |
| heic-to | tag v1.6.7 / `78345a3fcdb4a1d70d513fce2646aeff0127f7ba` | `sources/heic-to-v1.6.7-78345a3fcdb4.tar.gz` | `AF478F6A0B6141879D93C9D295B46C0F70B016F97B939A08A4F3A3B498D71A83` |
| libheif | tag v1.23.7 / `12a259a5882dd99d45ec5fc77e296a3b620d1e2e` | `sources/libheif-v1.23.7-12a259a5882d.tar.gz` | `E08529036EC998E6F27AB5C88A487F2BA3FB6A8EB9BB3B51B1D69563E0F9450C` |
| libde265 | tag v1.0.16 / `7ba65889d3d6d8a0d99b5360b028243ba843be3a` | `sources/libde265-v1.0.16-7ba65889d3d6.tar.gz` | `9DEDF12D5B5047C270D1FC54F5D92FC29D9EA21B94D3F2D998200258353189A0` |
| libde265 release input | v1.0.16 | `sources/libde265-1.0.16-upstream-release.tar.gz` | `B92BEB6B53C346DB9A8FAE968D686AB706240099CDD5AFF87777362D668B0DE7` |

The GitHub codeload hashes identify the exact bytes preserved for this package;
they are not claimed to be vendor-published checksum statements.

## License texts

- `notices/GNU-GPL-3.0.txt` (official GNU Project GPL v3 text)
- `notices/heic-to-LGPL-3.0-or-later.txt`
- `notices/libheif-COPYING.txt`
- `notices/libde265-COPYING.txt`

## Application integration code

The files under `application-integration/` are the site's separate adapter and
UI integration. The third-party decoder bundle was not patched.

## Version correspondence

- heic-to v1.6.7 maps to libheif 1.23.7 in the upstream release table.
- The generated source header records libheif 1.23.7,
  `LIBDE265_VERSION=1.0.16`, `USE_UNSAFE_EVAL=0` and `USE_WASM=0`.
- This identifies the intended source chain but does not prove a byte-identical
  rebuild. See `KNOWN-LIMITS.md`.