libvips — licence and source offer
Speechable's server uses libvips, an image-processing library licensed under the GNU Lesser General Public License, version 3 or later. It is used to resize and re-encode images — page thumbnails and the images served through our image optimiser.
What is covered
| Component | Version | Licence |
|---|---|---|
| libvips (prebuilt shared library) | 8.17.3 | LGPL-3.0-or-later |
@img/sharp-libvips-* (packaging) | 1.2.4 | LGPL-3.0-or-later |
sharp (Node.js binding) | 0.34.5 | Apache-2.0 |
Only libvips is copyleft. The sharp binding is Apache-2.0 and Next.js, which uses it, is MIT. Neither becomes subject to the LGPL by calling into libvips.
Licence text
The LGPL-3.0 operates as a set of additional permissions on top of the GPL-3.0, so both texts apply and both are reproduced verbatim:
- GNU Lesser General Public License v3.0
- GNU General Public License v3.0 (incorporated by reference into the LGPL)
Written offer of source code
The complete corresponding source code for every library in the binary we distribute — not libvips alone — is publicly available. Each of the 29 libraries listed below links to its own source, at the version actually built in. libvips itself is at:
https://github.com/libvips/libvips/releases/tag/v8.17.3
The scripts used to compile those sources into the binary we ship are published by the sharp project, pinned to the tag that produced it: github.com/lovell/sharp-libvips/tree/v1.2.4. The tag matters: the project's default branch has moved on to a later libvips, so the scripts there would not rebuild this binary. Corresponding source has to correspond.
If you would prefer to receive the corresponding source on a physical medium, or if any link above has ceased to work, write to [email protected] and we will provide it. This offer is valid for three years from the date on which we distributed the software to you.
Libraries bundled inside the binary
The file we distribute, libvips-cpp.so.8.17.3, is not libvips alone. It is a single shared object with 29 upstream projects linked into it, 9 of them under copyleft licences. The source offer above, and the relinking right below, cover all 29 — not libvips alone.
The packager's own notice for this exact build is reproduced verbatim at sharp-libvips 1.2.4 THIRD-PARTY-NOTICES. The table below adds the version of each library actually built in, a source location for each, and two corrections noted underneath.
| Library | Version | Licence |
|---|---|---|
| libvips | 8.17.3 | LGPL-2.1-or-later, used under LGPLv3 |
| libheif | 1.20.2 | LGPL-2.1-or-later, used under LGPLv3The most restrictive item, and the reason the package declares LGPL-3.0 |
| glib | 2.86.1 | LGPL-2.1-or-later, used under LGPLv3 |
| pango | 1.57.0 | LGPL-2.1-or-later, used under LGPLv3 |
| librsvg | 2.61.2 | LGPL-2.1-or-later, used under LGPLv3 |
| fribidi | 1.0.16 | LGPL-2.1-or-later, used under LGPLv3 |
| libexif | 0.6.25 | LGPL-2.1-or-later, used under LGPLv3 |
| proxy-libintl | 0.5 | LGPL-2.1-or-later, used under LGPLv3 |
| cairo | 1.18.4 | LGPL-2.1 or MPL-1.1 — we elect LGPL-2.1Upstream's notices state MPL-2.0; cairo has never offered that. Its own COPYING offers LGPL-2.1 or MPL-1.1 |
| libimagequant | 2.4.1 | BSD-2-ClauseLater releases are GPL-3.0; 2.4.1 predates that relicensing and is pinned for exactly that reason |
| freetype | 2.14.1 | FreeType Licence (BSD-like)Dual FTL/GPL-2.0 upstream; the FTL election was made by sharp-libvips when it built the binary |
| aom | 3.13.1 | BSD-2-Clause + AOM Patent License 1.0 |
| libarchive | 3.8.2 | BSD-2-Clause |
| cgif | 0.5.0 | MIT |
| expat | 2.7.3 | MIT |
| libffi | 3.5.2 | MIT |
| fontconfig | 2.17.1 | fontconfig Licence (BSD-like) |
| harfbuzz | 12.1.0 | MIT (Old Style) |
| highway | 1.3.0 | Apache-2.0 and BSD-3-ClauseApache-2.0 §4(d) carries a NOTICE-propagation duty |
| lcms | 2.17 | MIT |
| libnsgif | vendored in libvips 8.17.3 | MITVendored inside the libvips source tree, so it does not appear in versions.json — but it is linked and exports symbols |
| mozjpeg | 0826579 | zlib, IJG and BSD-3-Clause |
| pixman | 0.46.4 | MIT |
| libpng | 1.6.50 | libpng Licence |
| libspng | 0.7.4 | BSD-2-Clause and libpng Licence |
| libtiff | 4.7.1 | libtiff Licence (BSD-like) |
| libwebp | 1.6.0 | BSD-3-Clause |
| libxml2 | 2.15.1 | MIT |
| zlib-ng | 2.2.5 | zlib Licence |
Required attributions
Two of the licences above require a specific credit, reproduced here as they require:
- mozjpeg / IJG: “This software is based in part on the work of the Independent JPEG Group.”
- FreeType: Portions of this software are copyright © The FreeType Project (www.freetype.org). All rights reserved.
Two corrections to the packager's notice
cairo. The upstream notice states “Mozilla Public License 2.0”. Cairo has never been offered under MPL-2.0 — its own COPYING offers LGPL-2.1 or MPL-1.1. We record cairo's own terms and elect LGPL-2.1, consistent with the other copyleft components here. That election is recorded and signed at LICENSE-ELECTIONS.md in the application repository, Addendum 1, dated 9 August 2026. Both texts are served: LGPL-2.1 and MPL-1.1.
libnsgif. It does not appear in the package's versions.json, because it is vendored inside the libvips source tree rather than fetched as a dependency. It is nonetheless compiled in and exports symbols, so it is listed above.
Licence texts
Full texts for the copyleft licences are served here: LGPL-3.0, LGPL-2.1, GPL-3.0 (which LGPL-3.0 builds on), and MPL-1.1. For the permissive licences, each library above links to its own licence text at source. A copy of any of them, or of the copyright notices for a specific library, is available on request from [email protected], on the same terms as the source offer.
Modification and relinking
We have not modified libvips. We distribute it unmodified, as built and published by the sharp project.
libvips is used as a dynamically-loaded shared library, not statically linked into our application. You may replace it with your own build — modified or otherwise — of the same or a later version. To do so, substitute the shared library inside the @img/sharp-libvips-<platform> package with your own, keeping the same filename and ABI. No part of our application needs to be recompiled for the replacement to take effect.
This right extends to every library in the table above. Those 29 projects are linked inside the shared object rather than loaded separately, so replacing the single file replaces the whole set — which is what the LGPL requires you to be able to do, and is why the source offer covers all of them rather than libvips alone.