HEIC decoder: third-party notices, source and replacement

NumLM distributes libheif-js 1.23.2, including libheif 1.23.2 and the
libde265 1.0.15 HEVC decoder. These libraries are covered by GNU LGPL v3;
the individual source files and accompanying licence texts control.
They are provided WITHOUT WARRANTY, including implied warranties of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

The libheif-bundle.mjs file is an unmodified copy of the ESM/WASM bundle
from the npm package libheif-js@1.23.2. Its SHA-256 is:
d05292271af008d300cc75be374feb8fd35b418a71420a556c3fb817f662b502

Copyright holders include struktur AG, Dirk Farin, Joachim Bauch,
Kiril Vatev and the contributors identified in the source files.
All original copyright and licence notices remain in the source archives.

Licence texts (relative to this notice):
  COPYING.libheif-js.txt
  COPYING.libheif.txt
  LICENSE-libde265.txt
The libheif and libde265 texts include both GNU LGPL v3 and GNU GPL v3.

Corresponding source, available without charge from this same directory:
  source/libheif-js-1.23.2.tar.gz
  source/libheif-emscripten-1.23.2.tar.gz
  source/libheif-1.23.2.tar.gz
  source/libde265-1.0.15.tar.gz

Upstream locations:
  https://github.com/catdad-experiments/libheif-js/tree/1.23.2
  https://github.com/catdad-experiments/libheif-emscripten/tree/v1.23.2
  https://github.com/strukturag/libheif/tree/ac1cb05c39008f01525c991ff8b88f84ddf70fd2
  https://github.com/strukturag/libde265/tree/v1.0.15

Building a compatible replacement:
1. Extract the libheif-emscripten source and place the separately supplied
   libheif source in its libheif subdirectory (GitHub archives omit submodules).
2. Follow .github/workflows/emscripten.yml from the builder archive. The
   upstream WASM build uses Ubuntu 22.04, Emscripten 3.1.61, Node 24 and
   TypeScript 5. It runs libheif/scripts/install-ci-linux.sh and prepare-ci.sh,
   then run-ci.sh with USE_WASM=1, USE_UNSAFE_EVAL=0, USE_TYPESCRIPT=1.
   build-emscripten.sh enables libde265 1.0.15 by default; place its supplied
   release tarball in the libheif build directory to avoid downloading it.
3. Run dist-prep.sh wasm from the builder directory. Arrange its output as
   libheif-wasm in a tar.gz archive, as shown in the upstream workflow.
4. In the libheif-js source, install its build dependencies and run
   node scripts/install.js /absolute/path/to/your/libheif.tar.gz
   This creates libheif-wasm/libheif-bundle.mjs using the supplied build scripts.
   Build tools and their dependencies are not needed for ordinary conversion.

Using your replacement:
The decoder is a separate runtime ES module at
/vendor/libheif/libheif-bundle.mjs; it is not incorporated into NumLM's
application JavaScript chunks. An interface-compatible modified module can
replace it at that URL in a local copy of the site, or through browser
developer tools' local response overrides. Preserve the default export and
libheif-js interface. Reload the page after replacing the module so a new
worker loads it. There is no application integrity hash or signature check
requiring the original decoder bytes. Browser response-override support
varies; a local static copy permits replacing the file directly.

NumLM's terms do not prohibit modifying/replacing these LGPL components or
reverse engineering to debug those modifications as permitted by LGPL.
Changes to the decoder may change output or fail if its interface changes.

This notice records software licences. It does not grant or warrant any
third-party HEVC/HEIF patent rights or determine patent obligations in any
jurisdiction. Image conversion does not grant rights in third-party images.