# Third-party notices (DRAFT)

DRAFT from the ROADMAP 13.6 licence audit (`docs/notes/licence-audit.md`); not yet reviewed by a lawyer.
The package lists at the end are generated: `python3 tools/licence_inventory.py --notices`.

This product is free software under the GNU General Public License version 3 (`LICENSE`). It includes or
loads the third-party components below. Each keeps its own licence; the full licence texts are in the folders
named, or at the URL given.

## Written offer for source code

For components under the GNU GPL or LGPL that we distribute in binary form (FFmpeg, Blender, libheif-js,
Chromium's FFmpeg inside Electron, and the FFmpeg inside the OpenCV wheel), we offer the complete corresponding source code, for at least three years
from the date you received the binary, to anyone who asks. The offer, where each source is, and the exact
versions / commits that ship (written from the installed files by `tools/source_versions.py`) are in
`SOURCE_OFFER.md`: FFmpeg 8.1.3 (commit 46d899d7a0) + the BtbN/FFmpeg-Builds tag used, Blender 5.2.2,
libheif-js 1.23.2, Electron 28.3.3 / Chromium 120, FFmpeg 8.1.1 inside opencv-contrib-python-headless 5.0.0.93
(+ opencv-python's build scripts at tag 93). Release step: put those source archives next to each installer.

## Bundled native libraries and data

| Component | Version | Licence | Copyright / origin | Licence text |
|---|---|---|---|---|
| FFmpeg (libavcodec, libavformat, libavutil, libavfilter, libavdevice, libswscale, libswresample; ffmpeg, ffprobe, ffplay) | 8.1 | LGPL-3.0-or-later (built with `--enable-version3`, without `--enable-gpl` or `--enable-nonfree`) | the FFmpeg developers, https://ffmpeg.org | `libav/LICENSE.txt` |
| FFmpeg inside the OpenCV wheel (`opencv_contrib_python_headless.libs/`: libavcodec, libavformat, libavutil, libswscale, libswresample) | 8.1.1 | LGPL-2.1-or-later (built without `--enable-gpl` or `--enable-nonfree`; `--enable-openssl --enable-libvpx`) | the FFmpeg developers, https://ffmpeg.org; built by the opencv-python project | the wheel's `LICENSE-3RD-PARTY.txt` |
| libvpx, libaom, libavif, libpng, OpenSSL 1.1.1k, OpenBLAS, libdrm, libgfortran / libquadmath (inside the OpenCV wheel) | see the wheel's `.libs/` | BSD-3-Clause / BSD-2-Clause / libpng / OpenSSL / MIT / GPL-3.0 with the GCC Runtime Library Exception | their respective authors | the wheel's `LICENSE-3RD-PARTY.txt` |
| OpenUSD | 26.08 | Tomorrow Open Source Technology License 1.0 | Pixar Animation Studios and contributors | `hydra/licenses/OpenUSD-LICENSE.txt`, `OpenUSD-NOTICE.txt` |
| Cycles | 5.2.0 | Apache-2.0 | Blender Foundation and contributors | `hydra/licenses/Cycles-LICENSE.txt`, `hydra/licenses/cycles-third-party/` |
| Alembic | 1.8.12 | BSD-3-Clause | Lucasfilm Ltd. and Sony Pictures Imageworks | `hydra/licenses/Alembic-LICENSE.txt` |
| OpenImageIO, OpenColorIO, OpenEXR, Imath, MaterialX, OpenSubdiv, oneTBB, OpenJPH, Embree, OpenVDB, oneAPI SYCL runtime, Vulkan loader (inside `hydra/`) | see `hydra/VERSIONS.txt` | Apache-2.0 / BSD-3-Clause / TOST / MIT | their respective authors (Contributors to the OpenImageIO / OpenColorIO / OpenEXR projects, Intel, Pixar, ...) | `hydra/licenses/` |
| Intel Open Image Denoise | see `oidn/doc` | Apache-2.0 | Intel Corporation | `oidn/doc/LICENSE.txt`, `third-party-programs-DPCPP.txt` |
| Inter font | from Blender 5.2.2 | SIL Open Font License 1.1 | Copyright 2020 The Inter Project Authors | `resources/licenses/OFL-1.1.txt` |
| Noto fonts (incl. Noto Sans CJK) | from Blender 5.2.2 | SIL Open Font License 1.1 | Copyright 2018 The Noto Project Authors | `resources/licenses/OFL-1.1.txt` |
| DejaVu Sans Mono | from Blender 5.2.2 | Bitstream Vera Font licence + Arev Fonts licence | 2003 Bitstream, Inc.; 2006 Tavmjong Bah; DejaVu changes public domain | `resources/licenses/Bitstream-Vera.txt`, `Arev-Fonts.txt` |
| OCIO colour configuration (config.ocio, Filmic and AgX LUTs) | from Blender 5.2.2 | GPL-3.0-or-later, as received with Blender (no file-level licence exists upstream; commercial use unconfirmed, licence-audit.md risk 4) | Blender Foundation; Filmic: Troy Sobotka; AgX: Eary Chow, Mark Faderbauer, Sakari Kapanen, based on Troy Sobotka's AgX | `resources/licenses/colormanagement-NOTICE.txt`, `resources/licenses/GPL-3.0-or-later.txt` |
| Blender (optional backend, GPL edition only) | 5.2.2 | GPL-3.0-or-later | Blender Foundation and contributors | `blender/<ver>/license/` |
| Electron | 28 | MIT | GitHub Inc. and contributors | `LICENSE` next to the app binary |
| Chromium (inside Electron) | per Electron 28 | BSD-3-Clause and many others | The Chromium Authors | `LICENSES.chromium.html` next to the app binary |
| nanobind (compiled into the native core) | 3.1.0 | BSD-3-Clause | Wenzel Jakob | https://github.com/wjakob/nanobind/blob/master/LICENSE |

## Vendored source code

| Component | Where | Licence | Copyright |
|---|---|---|---|
| rv-engine (from openrv-web) | `packages/review-core/vendor/rv-engine` | MIT | (c) 2024 Alex Kanunnikov (`LICENSE.upstream`) |
| Practical-RIFE network | `opencomp_ai/ops/_rife` | MIT | (c) 2021 hzwer |
| SEA-RAFT network | `opencomp_ai/ops/_searaft` | BSD-3-Clause | (c) 2024 Princeton Vision & Learning Lab |
| Video Depth Anything (incl. DINOv2 layers) | `opencomp_ai/vendor/vda` | Apache-2.0 | (c) 2025 Bytedance Ltd. and/or its affiliates; DINOv2 (c) Meta Platforms, Inc. |
| MoGe (incl. DINOv2) | `opencomp_ai/vendor/moge` | MIT (DINOv2 Apache-2.0) | (c) Microsoft Corporation |
| Cosmos-Transfer1 DiffusionRenderer (code only) | `opencomp_ai/vendor/cosmos_dr` | Apache-2.0 | (c) 2025 NVIDIA CORPORATION & AFFILIATES |
| Robust Video Matting (network only) | `opencomp_ai/vendor/rvm` | GPL-3.0 (`opencomp_ai/vendor/rvm/LICENSE`) | (c) Shanchuan Lin et al. |

The fSpy solver port (`opencomp_core/camtrack/vpsolve.py`, GPL-3.0) was removed on 2026-10-01 and replaced by a
clean-room solver (`opencomp_core/camtrack/vp_cleanroom.py`, our own code; process in `docs/notes/vp-cleanroom.md`).

Change notes for the AI code are in `opencomp_ai/vendor/NOTICE`.

## Loaded at runtime, not distributed with this product

- AI model weights and code listed in `opencomp_ai/models/*.json`: downloaded on your machine from their publishers
  after you accept each licence. Non-commercial models (FLUX.2 dev, MatAnyone 2, MiniMax-Remover; manifest flag
  `non_commercial`) are opt-in: labelled "non-commercial", never picked by Auto, and each needs your own licence
  acceptance before it downloads.
- NVIDIA CUDA / cuDNN libraries and the CUDA 12.8 compiler: NVIDIA proprietary licences, downloaded on your machine.
- ComfyUI (GPL-3.0): talked to over local HTTP in its own process when you configure one.
- PySide6 / Qt 6 (LGPL-3.0): installed by `tools/setup_qt_helper.sh` into a helper process.
- OpenFX plugins: loaded from the plugin folders you configure; each under its own licence.
- The `.vfx` cache reader (`vfxcache`): proprietary, imported from a separate installation; not part of this product.

## Packages

### Engine Python packages (engine venv) (23)

- brotli 1.2.0: MIT
- cffi 2.1.1: MIT-0
- fonttools 4.60.1: MIT
- freetype-py 2.5.1: BSD License
- glcontext 3.0.0: MIT
- moderngl 5.12.0: MIT
- numpy 2.5.3: BSD-3-Clause AND 0BSD AND MIT AND Zlib AND CC0-1.0
- opencolorio 2.5.2: BSD-3-Clause
- opencv-contrib-python-headless 5.0.0.93: Apache 2.0 (bundles LGPL FFmpeg 8.1.1 and permissive libraries: see the table above)
- OpenEXR 3.5.1: BSD-3-Clause
- OpenImageIO 3.1.17.0: Apache-2.0
- OpenTimelineIO 0.18.1: Apache 2.0 License
- packaging 26.3: Apache-2.0 OR BSD-2-Clause
- pathspec 1.1.1: Mozilla Public License 2.0 (MPL 2.0)
- pycmx 1.5.0: MIT License
- pycolmap 4.2.1: BSD-3-Clause + GPL-2.0-or-later (static SuiteSparse: CHOLMOD MatrixOps, CHOLMOD Supernodal, SPQR)
- pycparser 3.0: BSD-3-Clause
- rendercanvas 2.7.2: BSD-2-Clause
- scipy 1.18.1: BSD License
- timecode 1.5.1: MIT
- usd-core 26.8: LicenseRef-TOST-1.0
- wgpu 0.32.0: BSD 2-Clause License
- zstandard 0.25.0: BSD-3-Clause

### AI worker Python packages (AI venv, installed on the user's machine) (69)

- accelerate 1.15.0: Apache
- antlr4-python3-runtime 4.9.3: BSD
- anyio 4.15.1: MIT
- certifi 2026.7.22: MPL-2.0
- charset-normalizer 3.5.1: MIT
- diffusers 0.39.0: Apache 2.0 License
- einops 0.8.2: MIT
- filelock 4.0.3: MIT
- fsspec 2026.9.0: BSD-3-Clause
- ftfy 6.3.1: Apache-2.0
- gguf 0.19.0: MIT License
- gsplat 1.5.3: Apache-2.0
- h11 0.16.0: MIT
- hf-xet 1.6.0: Apache-2.0
- httpcore 1.0.9: BSD-3-Clause
- httpx 0.28.1: BSD-3-Clause
- huggingface_hub 0.36.2: Apache
- idna 3.20: BSD-3-Clause
- importlib_metadata 9.0.1: Apache-2.0
- jaxtyping 0.3.11: MIT License
- Jinja2 3.1.6: BSD License
- markdown-it-py 4.2.0: MIT License
- MarkupSafe 3.0.3: BSD-3-Clause
- mdurl 0.1.2: MIT License
- ml_dtypes 0.6.0: Apache-2.0
- mpmath 1.3.0: BSD
- networkx 3.7: BSD-3-Clause
- numpy 2.5.3: BSD-3-Clause AND 0BSD AND MIT AND Zlib AND CC0-1.0
- nvidia-cublas-cu12 12.8.4.1: NVIDIA Proprietary Software
- nvidia-cuda-cupti-cu12 12.8.90: NVIDIA Proprietary Software
- nvidia-cuda-nvrtc-cu12 12.8.93: NVIDIA Proprietary Software
- nvidia-cuda-runtime-cu12 12.8.90: NVIDIA Proprietary Software
- nvidia-cudnn-cu12 9.10.2.21: LicenseRef-NVIDIA-Proprietary
- nvidia-cufft-cu12 11.3.3.83: NVIDIA Proprietary Software
- nvidia-cufile-cu12 1.13.1.3: NVIDIA Proprietary Software
- nvidia-curand-cu12 10.3.9.90: NVIDIA Proprietary Software
- nvidia-cusolver-cu12 11.7.3.90: NVIDIA Proprietary Software
- nvidia-cusparse-cu12 12.5.8.93: NVIDIA Proprietary Software
- nvidia-cusparselt-cu12 0.7.1: NVIDIA Proprietary Software
- nvidia-nccl-cu12 2.27.5: BSD-3-Clause
- nvidia-nvjitlink-cu12 12.8.93: NVIDIA Proprietary Software
- nvidia-nvshmem-cu12 3.3.20: BSD-3-Clause
- nvidia-nvtx-cu12 12.8.90: Apache 2.0
- omegaconf 2.3.1: BSD License
- onnx 1.23.0: Apache-2.0
- packaging 26.3: Apache-2.0 OR BSD-2-Clause
- peft 0.21.0: Apache
- pillow 12.3.0: MIT-CMU
- protobuf 7.36.2: 3-Clause BSD License
- psutil 7.2.2: BSD-3-Clause
- PyYAML 6.0.3: MIT
- regex 2026.9.10: Apache-2.0 AND CNRI-Python
- requests 2.34.2: Apache-2.0
- rich 15.0.0: MIT
- rotary-embedding-torch 0.9.1: MIT
- safetensors 0.8.0: Apache Software License
- sympy 1.14.0: BSD
- timm 1.0.30: Apache-2.0
- tokenizers 0.22.2: Apache Software License
- torch 2.9.1+cu128: BSD-3-Clause
- torchvision 0.24.1+cu128: BSD
- tqdm 4.70.1: MPL-2.0 AND MIT
- transformers 4.57.3: Apache 2.0 License
- triton 3.5.1: MIT License
- typing_extensions 4.16.0: PSF-2.0
- urllib3 2.8.0: MIT
- wadler_lindig 0.1.7: Apache License
- wcwidth 0.9.1: MIT License
- zipp 4.1.0: MIT

### JavaScript packages (production dependency tree) (78)

- @esbuild/linux-x64 0.25.12: MIT
- @esbuild/linux-x64 0.28.2: MIT
- @jridgewell/sourcemap-codec 1.6.0: MIT
- @jsquash/jxl 1.3.0: Apache-2.0
- @napi-rs/lzma-linux-x64-gnu 1.5.1: MIT
- @rollup/rollup-linux-x64-gnu 4.63.5: MIT
- @types/chai 5.2.3: MIT
- @types/deep-eql 4.0.2: MIT
- @types/dom-mediacapture-transform 0.1.12: MIT
- @types/dom-webcodecs 0.1.13: MIT
- @types/estree 1.0.9: MIT
- @types/node 24.19.0: MIT
- @types/prop-types 15.7.15: MIT
- @types/react 18.3.28: MIT
- @vitest/expect 3.2.7: MIT
- @vitest/mocker 3.2.7: MIT
- @vitest/pretty-format 3.2.7: MIT
- @vitest/runner 3.2.7: MIT
- @vitest/snapshot 3.2.7: MIT
- @vitest/spy 3.2.7: MIT
- @vitest/utils 3.2.7: MIT
- assertion-error 2.0.1: MIT
- cac 6.7.14: MIT
- chai 5.3.3: MIT
- check-error 2.1.3: MIT
- csstype 3.2.3: MIT
- debug 4.4.3: MIT
- deep-eql 5.0.2: MIT
- dockview 5.0.0: MIT
- dockview-core 5.0.0: MIT
- dockview-react 5.0.0: MIT
- es-module-lexer 1.7.0: MIT
- esbuild 0.25.12: MIT
- esbuild 0.28.2: MIT
- estree-walker 3.0.3: MIT
- expect-type 1.4.0: Apache-2.0
- fdir 6.5.0: MIT
- gto-js 1.0.0: MIT
- js-tokens 4.0.0: MIT
- js-tokens 9.0.1: MIT
- libheif-js 1.23.2: LGPL-3.0
- loose-envify 1.4.0: MIT
- loupe 3.2.1: MIT
- magic-string 0.30.21: MIT
- mediabunny 1.60.0: MPL-2.0
- ms 2.1.3: MIT
- nanoid 3.3.19: MIT
- pathe 2.0.3: MIT
- pathval 2.0.1: MIT
- picocolors 1.1.1: ISC
- picomatch 4.0.7: MIT
- postcss 8.5.28: MIT
- react 18.3.1: MIT
- react-dom 18.3.1: MIT
- rollup 4.63.5: MIT
- scheduler 0.23.2: MIT
- siginfo 2.0.0: ISC
- source-map-js 1.2.1: BSD-3-Clause
- stackback 0.0.2: MIT
- std-env 3.10.0: MIT
- strip-literal 3.1.0: MIT
- three 0.169.0: MIT
- three 0.180.0: MIT
- tinybench 2.9.0: MIT
- tinyexec 0.3.2: MIT
- tinyglobby 0.2.17: MIT
- tinypool 1.1.1: MIT
- tinyrainbow 2.0.0: MIT
- tinyspy 4.0.6: MIT
- typescript 5.9.3: Apache-2.0
- undici-types 7.24.6: MIT
- use-sync-external-store 1.6.0: MIT
- vite 7.3.6: MIT
- vite-node 3.2.4: MIT
- vitest 3.2.7: MIT
- wasm-feature-detect 1.9.0: Apache-2.0
- why-is-node-running 2.3.0: MIT
- zustand 4.5.7: MIT

## App icon
The pig in the app and file icons is the "pet-animals-pig" icon from Streamline Pixel by Streamline
(https://www.streamlinehq.com), licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); the
rounded tile, page and colours around it are ours.