Exact library and source information (5 November 2026)

Served file: libheif-bundle.mjs
Unmodified copy of libheif-js@1.23.5/libheif-wasm/libheif-bundle.mjs.
SHA-256: 095194187be00d3e36335b8ad7f5552d70655e5e2159486d7d36cd4daa47bba9
Package archive: https://registry.npmjs.org/libheif-js/-/libheif-js-1.23.5.tgz
Package source commit: d8ec4bc3bc5bf8055975577bccbbc7e1d7313c2d
Source archive: https://github.com/catdad-experiments/libheif-js/archive/d8ec4bc3bc5bf8055975577bccbbc7e1d7313c2d.tar.gz
Bundling/install instructions: scripts/install.js and scripts/bundle.js at that commit.

The package installer obtains this exact native/WASM release:
https://github.com/catdad-experiments/libheif-emscripten/releases/tag/v1.23.5
https://github.com/catdad-experiments/libheif-emscripten/releases/download/v1.23.5/libheif.tar.gz
Build repository/source:
https://github.com/catdad-experiments/libheif-emscripten/tree/v1.23.5
https://github.com/catdad-experiments/libheif-emscripten/archive/refs/tags/v1.23.5.tar.gz
Its .github/workflows/emscripten.yml and dist-prep.sh are the build instructions;
use recursive submodules (archive users must obtain the submodule below).

Exact libheif submodule commit in v1.23.5:
413e2a87e6a70b3eccc3a3adc5801179dd2d9e00
https://github.com/strukturag/libheif/tree/413e2a87e6a70b3eccc3a3adc5801179dd2d9e00
https://github.com/strukturag/libheif/archive/413e2a87e6a70b3eccc3a3adc5801179dd2d9e00.tar.gz
Build script: build-emscripten.sh in that source; the release workflow uses
Emscripten 3.1.61, USE_WASM=1, USE_UNSAFE_EVAL=0 and TypeScript bindings.
The default HEVC decoder dependency is libde265 1.0.15:
https://github.com/strukturag/libde265/releases/tag/v1.0.15
https://github.com/strukturag/libde265/releases/download/v1.0.15/libde265-1.0.15.tar.gz
The build script downloads that archive and gives its configure/build steps.
AOM, OpenJPEG, uncompressed decoding and WebCodecs are disabled by default.

Application worker: heic-worker.mjs (readable source in this directory).
It loads the separate bundle lazily, uses libheif's metadata-only context and
image-handle APIs, checks exactly one top-level primary HEVC still, and checks
both coded ISPE and transformed dimensions before allocating RGBA/full pixels.
It rejects AV1/VVC/JPEG/JPEG2000 items and sequences/collections. Main-thread
container checks reject AVIF brands and animation before worker creation.

Version-sensitive resource preflight:
The exact pinned bundle has a wasm32 Emscripten embind context with $$.ptr and
heif_security_limits structure version 4. The worker fails closed if its
version differs. Structure layout comes from libheif/api/libheif/heif_security.h
at the exact source commit above. uint64 fields use 8-byte alignment, little
endian. The worker tightens (does not disable) these limits before metadata parse:
offset 8: max_image_size_pixels = 16000000
offset 16: max_number_of_tiles = 256
offset 28: max_items = 2048
offset 32: max_color_profile_size = 2097152 bytes
offset 40: max_memory_block_size = 134217728 bytes
offset 60: max_children_per_box = 2048
offset 64: max_total_memory = 268435456 bytes
offset 80: max_sequence_frames = 1
offset 84: max_number_of_file_brands = 64
All other upstream defaults are preserved. A future decoder upgrade requires
checking this ABI, source/license notices, real fixtures and browser output.

These are product limits, not claims about all HEIF files or all device memory.
The operation is terminated at cancellation/deadline in its dedicated worker.
JPEG encoding uses the browser canvas and is cooperatively checked; unsupported
codec variants fail without any upload/remote conversion fallback.