heic2any 0.0.4, MIT, https://github.com/alexcorvi/heic2any
Vendored for on-device conversion. Embind named-function and dynCall wrappers use closures instead of Function constructors to avoid unsafe-eval. See heic2any-license.txt.
The generated embind invoker also uses an equivalent generic closure with argument conversion and destructor handling.
The decoder includes libheif (LGPL), source: https://github.com/strukturag/libheif and the historical JavaScript build at https://github.com/alexcorvi/heic2any/blob/master/src/libheif.js. See libheif-license.txt.