Home › Open Source & Third-Party Components

Open Source & Third-Party Components

ToolLott keeps a permanent register of third-party and open-source software used by production tools so dependencies can be reviewed, updated, replaced or removed deliberately.

Current production use

Approved components supporting ToolLott's current self-hosted runtime tools are listed below. Coming Soon AI pages do not invoke external services.17 approved component(s) currently affect 30 public tool(s).

ToolLott does not treat open-source software as ToolLott-owned IP. Copyright remains with the respective authors and projects, and required licence or NOTICE material is retained whenever a component is approved for production.

Open Source & Third-Party Components table
Component	Pinned version	Licence	Affected ToolLott tools	Processing	Status	Update / removal impact
libheif Official project source	1.19.8	LGPL-3.0-or-later (library); MIT/Expat-style sample CLI notice	0023 - HEIC to JPG Converter	ToolLott self-hosted runtime (server-side; no external vendor API)	approved production	Build 0023 returns to Under Development until another approved HEIC/HEIF decoder is integrated and revalidated.
libde265 Official project source	1.0.15	LGPL-3.0-or-later (decoder library; package contains separately licensed utility/source files)	0023 - HEIC to JPG Converter	ToolLott self-hosted runtime (server-side; loaded by libheif)	approved production	Build 0023 loses HEVC/HEIC decoding and must return to Under Development unless replaced.
FFmpeg Official project source	7.1.5-0+deb13u1	GPL-2.0-or-later for the tested GPL-enabled runtime build	0024 - MP4 to MP3 Converter, 0027 - WAV to MP3 Converter	ToolLott self-hosted runtime (server-side; no external vendor API)	approved production	Builds 0024 and 0027 return to Under Development until an approved audio transcoder is integrated and revalidated.
LAME / libmp3lame Official project source	3.100	LGPL-2.0-or-later (see retained package notices for file-level exceptions)	0024 - MP4 to MP3 Converter, 0027 - WAV to MP3 Converter	ToolLott self-hosted runtime (server-side; loaded by FFmpeg)	approved production	Builds 0024 and 0027 lose MP3 encoding and must return to Under Development unless replaced.
Tesseract OCR Official project source	5.5.0	Apache-2.0	0279 - PDF OCR (text recognition)	ToolLott self-hosted runtime (server-side; no external vendor API)	approved production	Build 0279 returns to Under Development until an approved OCR engine is integrated and revalidated.
Leptonica Official project source	1.84.1	BSD-2-Clause-style licence	0279 - PDF OCR (text recognition)	ToolLott self-hosted runtime (server-side; loaded by Tesseract)	approved production	Build 0279 OCR runtime becomes incomplete and must return to Under Development unless replaced.
pypdf Official project source	5.9.0	BSD-3-Clause	0272 - Compare PDFs, 0273 - Compress PDF, 0274 - Crop PDF, 0276 - Extract Pages from PDF, 0278 - Merge PDF, 0279 - PDF OCR (text recognition), 0280 - PDF to Excel, 0281 - PDF to JPG, 0282 - PDF to Word, 0284 - Protect PDF (add password), 0285 - Remove Pages from PDF, 0286 - Repair PDF, 0287 - Rotate PDF, 0288 - Sign PDF (e-signature), 0289 - Split PDF, 0290 - Unlock PDF (remove password), 0291 - Watermark PDF, 0320 - Edit PDF	ToolLott self-hosted runtime (server-side; no external vendor API)	approved production	Core modern PDF operations return to Under Development until a replacement PDF parser/writer is approved and revalidated.
pyca/cryptography Official project source	46.0.4	Apache-2.0 OR BSD-3-Clause	0284 - Protect PDF (add password), 0290 - Unlock PDF (remove password)	ToolLott self-hosted Python runtime (server-side; no external vendor API)	approved production	AES protection/decryption support for Builds 0284 and 0290 becomes unavailable; affected tools must return to Under Development unless replaced.
pypdfium2 + PDFium Official project source	5.8.0	Apache-2.0 OR BSD-3-Clause for pypdfium2; PDFium and bundled build dependencies have retained upstream licences	0279 - PDF OCR (text recognition), 0281 - PDF to JPG	ToolLott self-hosted runtime (pinned Python wheel with PDFium binary)	approved production	PDF OCR rendering and PDF-to-JPG return to Under Development until an approved renderer is integrated.
reportlab Official project source	4.4.9	BSD-style	0288 - Sign PDF (e-signature), 0291 - Watermark PDF, 0320 - Edit PDF	ToolLott self-hosted runtime (server-side; no external vendor API)	approved production	PDF e-signature, watermark and edit-overlay generation must be reimplemented or returned to Under Development.
openpyxl Official project source	3.1.5	MIT/Expat	0275 - Excel to PDF, 0280 - PDF to Excel	ToolLott self-hosted runtime (server-side; no external vendor API)	approved production	Excel-to-PDF sheet selection and PDF-to-Excel output must be reimplemented or returned to Under Development.
python-docx Official project source	1.2.0	MIT	0282 - PDF to Word, 0292 - Word to PDF	ToolLott self-hosted runtime (server-side; no external vendor API)	approved production	PDF-to-Word and Word-to-PDF document inspection/output must be reimplemented or returned to Under Development.
python-pptx Official project source	1.0.2	MIT	0283 - PowerPoint to PDF	ToolLott self-hosted runtime (server-side; no external vendor API)	approved production	PowerPoint-to-PDF validation must be reimplemented or returned to Under Development.
Pillow Official project source	12.3.0	HPND	0279 - PDF OCR (text recognition), 0281 - PDF to JPG	ToolLott self-hosted runtime (server-side; no external vendor API)	approved production	PDF raster rendering and image output require another approved image library if Pillow is removed.
libreoffice Official project source	25.2.3.2 (tested Linux runtime)	MPL-2.0 plus bundled third-party licences; deployment installation notices apply	0275 - Excel to PDF, 0283 - PowerPoint to PDF, 0292 - Word to PDF	Optional local system executable used by ToolLott self-hosted runtime	approved production	Office-to-PDF tools remain unavailable until LibreOffice is installed or an approved fidelity-preserving converter replaces it.
imageio-ffmpeg Official project source	0.6.0	BSD-2-Clause (Python wrapper); packaged FFmpeg executable retains FFmpeg licensing	0024 - MP4 to MP3 Converter, 0027 - WAV to MP3 Converter	ToolLott local self-hosted runtime; Windows fallback when no system FFmpeg is available	approved production fallback	Builds 0024 and 0027 require a system FFmpeg executable or return to Under Development.
pillow-heif Official project source	1.5.0	BSD-3-Clause for the Python project; wheel-bundled libraries retain their own licences/notices	0023 - HEIC to JPG Converter	ToolLott local self-hosted runtime; Windows fallback when heif-convert is not installed	approved production fallback	Build 0023 requires a system HEIF decoder or returns to Under Development.

External services (disabled for launch)

TL46H contains no active external AI service integration, API-key setup or provider request path.

Open Source & Third-Party Components table 2
Service	Type	Configured models	Affected ToolLott tools	Processing	Status	Removal impact
AI provider integration	external service	None	19 planned AI pages	No external processing in TL46H	Disabled — Coming Soon	Future activation requires a new privacy, security, cost and quality checkpoint.

Component licence and notice details

libheif 1.19.8

Licence: LGPL-3.0-or-later (library); MIT/Expat-style sample CLI notice

SHA-256: sha256:8f1d6e3e7966ccc7fd9f5168706e5c92c71ff8934c55236f421b9c52cc16634c

Required notices: Retain libheif LGPL licence/copyright notices. ToolLott invokes the separately installed heif-convert utility and libheif shared library; do not disable libheif security limits in production.

ToolLott modifications: None; invoked as a separate runtime executable/library.

Processing: ToolLott self-hosted runtime (server-side; no external vendor API)

Official project source · Retained licence/notice file

libde265 1.0.15

Licence: LGPL-3.0-or-later (decoder library; package contains separately licensed utility/source files)

SHA-256: sha256:c93eba9648e24820b6938f939e05c9ba1f3c477c13882289940da7c55e26efeb

Required notices: Retain libde265 copyright and LGPL notices. This is the HEVC decoder plugin used by the tested libheif runtime.

ToolLott modifications: None.

Processing: ToolLott self-hosted runtime (server-side; loaded by libheif)

Official project source · Retained licence/notice file

FFmpeg 7.1.5-0+deb13u1

Licence: GPL-2.0-or-later for the tested GPL-enabled runtime build

SHA-256: sha256:e8a8d46f5225f3062cec7c07fb145d58ae73c603cb740dcd5bad34bfb54e455a

Required notices: Retain FFmpeg copyright/licence notices and comply with the FFmpeg legal/licence checklist. The tested Debian runtime is built with --enable-gpl; do not relabel it as LGPL-only.

ToolLott modifications: None; invoked as a separate executable.

Processing: ToolLott self-hosted runtime (server-side; no external vendor API)

Official project source · Retained licence/notice file

LAME / libmp3lame 3.100

Licence: LGPL-2.0-or-later (see retained package notices for file-level exceptions)

SHA-256: sha256:98d0d7579c760053242a1deac2ebe335b8f8636f44235580f05b732f5fa207bb

Required notices: Retain the LAME/libmp3lame copyright and LGPL notices. Used by FFmpeg as the MP3 encoder in the tested runtime.

ToolLott modifications: None.

Processing: ToolLott self-hosted runtime (server-side; loaded by FFmpeg)

Official project source · Retained licence/notice file

Tesseract OCR 5.5.0

Licence: Apache-2.0

SHA-256: sha256:74b76a5b994adcc18be362bf64ed5118082b2401d5d9a35242e92fc4c62e2b4b

Required notices: Retain the Apache-2.0 licence and Tesseract copyright notices. OCR output is derived text and must be presented as fallible recognition, not guaranteed transcription.

ToolLott modifications: None; invoked as a separate executable.

Processing: ToolLott self-hosted runtime (server-side; no external vendor API)

Official project source · Retained licence/notice file

Leptonica 1.84.1

Licence: BSD-2-Clause-style licence

SHA-256: sha256:3d56e8982393abbae4e5ba8717e73b347cf78fd4f24070c9970ff08ec0e01822

Required notices: Retain the Leptonica copyright, redistribution conditions and disclaimer. Used by the Tesseract OCR runtime.

ToolLott modifications: None.

Processing: ToolLott self-hosted runtime (server-side; loaded by Tesseract)

Official project source · Retained licence/notice file

pypdf 5.9.0

Licence: BSD-3-Clause

SHA-256: installed-tree-sha256:a1db5a152143ed33ee4db3f7453cc8b9d63c47064693d6f587988ae9d5d08521

Required notices: Retain the pypdf BSD-3-Clause licence and copyright notice.

ToolLott modifications: None; used as an installed runtime dependency.

Processing: ToolLott self-hosted runtime (server-side; no external vendor API)

Official project source · Retained licence/notice file

pyca/cryptography 46.0.4

Licence: Apache-2.0 OR BSD-3-Clause

SHA-256: sha256:3e5b8d007c267753264142ae734798635897dfe64809d042f7135496973549ff

Required notices: Retain the chosen Apache-2.0 or BSD-3-Clause licence notices as applicable. Used by pypdf to provide AES PDF cryptography.

ToolLott modifications: None; imported by the PDF runtime.

Processing: ToolLott self-hosted Python runtime (server-side; no external vendor API)

Official project source · Retained licence/notice file

pypdfium2 + PDFium 5.8.0

Licence: Apache-2.0 OR BSD-3-Clause for pypdfium2; PDFium and bundled build dependencies have retained upstream licences

SHA-256: tested-libpdfium-sha256:fcd602cd518476d712f661b08e010700490875288fb17069b5b5a2f8b7724118

Required notices: Retain pypdfium2 Apache/BSD licence texts plus the PDFium/build dependency notices shipped with the wheel.

ToolLott modifications: None; used as an installed runtime dependency.

Processing: ToolLott self-hosted runtime (pinned Python wheel with PDFium binary)

Official project source · Retained pypdfium2/PDFium licence notices

reportlab 4.4.9

Licence: BSD-style

SHA-256: installed-tree-sha256:7a7d38c02a7e87c4ac58b2847533676b0957bff16bfdca17454d5b82275350cd

Required notices: Retain the ReportLab open-source BSD licence/copyright notice.

ToolLott modifications: None; used as an installed runtime dependency.

Processing: ToolLott self-hosted runtime (server-side; no external vendor API)

Official project source · Retained licence/notice file

openpyxl 3.1.5

Licence: MIT/Expat

SHA-256: installed-tree-sha256:9a13b2f3f43354582804e8bd1f3754a80fae7e0103e454983f5f9013c79f1546

Required notices: Retain the openpyxl MIT/Expat licence notice.

ToolLott modifications: None; used as an installed runtime dependency.

Processing: ToolLott self-hosted runtime (server-side; no external vendor API)

Official project source · Retained licence/notice file

python-docx 1.2.0

Licence: MIT

SHA-256: installed-tree-sha256:c60b79dacf1597eafc077c3d99688f75e7b7ae9c869e83560e72afe73da96ca4

Required notices: Retain the python-docx MIT licence/copyright notice.

ToolLott modifications: None; used as an installed runtime dependency.

Processing: ToolLott self-hosted runtime (server-side; no external vendor API)

Official project source · Retained licence/notice file

python-pptx 1.0.2

Licence: MIT

SHA-256: installed-tree-sha256:7a3fa7d8902659b4dfc366c1c3afaa4c959572f5b0c2d755aa5d5a2421e143c7

Required notices: Retain the python-pptx MIT licence/copyright notice.

ToolLott modifications: None; used as an installed runtime dependency.

Processing: ToolLott self-hosted runtime (server-side; no external vendor API)

Official project source · Retained licence/notice file

Pillow 12.3.0

Licence: HPND

SHA-256: installed-tree-sha256:d982c6ec3a6574e4df999bd3b428bb9b2ff0f7bf8f1d88ad1bb024efe8f38280

Required notices: Retain the Pillow HPND licence/copyright notice and relevant bundled-library notices from the deployed wheel.

ToolLott modifications: None; used as an installed runtime dependency.

Processing: ToolLott self-hosted runtime (server-side; no external vendor API)

Official project source · Retained licence/notice file

libreoffice 25.2.3.2 (tested Linux runtime)

Licence: MPL-2.0 plus bundled third-party licences; deployment installation notices apply

SHA-256: tested-soffice-sha256:adf468b45764b2abce53a7d91bbf3056b33f2734c5d5f628c075753e73903c43

Required notices: Retain/comply with the LibreOffice installation licence and bundled third-party notices. ToolLott invokes LibreOffice as a separate installed executable; it is not bundled in this ZIP.

ToolLott modifications: None; used as an installed runtime dependency.

Processing: Optional local system executable used by ToolLott self-hosted runtime

Official project source · Retained licence/notice file

imageio-ffmpeg 0.6.0

Licence: BSD-2-Clause (Python wrapper); packaged FFmpeg executable retains FFmpeg licensing

SHA-256: platform-specific-wheel; package is installed into the local ToolLott venv rather than bundled in this ZIP

Required notices: Retain imageio-ffmpeg BSD-2-Clause notice and the licensing/notices for the FFmpeg executable included by the platform wheel.

ToolLott modifications: None; ToolLott uses get_ffmpeg_exe() to locate the wheel-provided executable.

Processing: ToolLott local self-hosted runtime; Windows fallback when no system FFmpeg is available

Official project source

pillow-heif 1.5.0

Licence: BSD-3-Clause for the Python project; wheel-bundled libraries retain their own licences/notices

SHA-256: platform-specific-wheel; package is installed into the local ToolLott venv rather than bundled in this ZIP

Required notices: Retain pillow-heif BSD-3-Clause notice and LICENSES_bundled material supplied by the installed wheel.

ToolLott modifications: None; registered as a Pillow HEIF/HEIC decoder.

Processing: ToolLott local self-hosted runtime; Windows fallback when heif-convert is not installed

Official project source

Controlled update and removal

ToolLott's local CMS includes a Dependency Manager for owner-controlled updates and removals. Before a change is written, the existing registry is snapshotted. Updating or removing a production dependency enumerates every affected Build Number and returns any impacted Ready tools to Under Development until the changed implementation is revalidated. Removed components remain in retired history instead of disappearing from the audit trail.

Pending dependency decisions

These capabilities are not currently counted as production open-source usage. Their ToolLott tools remain blocked until an implementation is explicitly approved and passes real-output QA.

Open Source & Third-Party Components table 3
Required capability	Affected tools	Status
No pending dependency reviews.

Retired component history

When a production dependency is removed, its identity, last pinned version, affected tools and removal reason stay visible here for traceability.

Open Source & Third-Party Components table 4
Component	Last version	Affected tools	Retired	Reason
Poppler / pdftoppm	25.06.0	0279 - PDF OCR (text recognition)	2026-08-12	PDF page rasterisation migrated to pinned pypdfium2/PDFium, eliminating Poppler as a ToolLott runtime requirement.

What ToolLott records before approval

For every approved component we record the exact version, official source, licence, checksum, required notices, affected Build Numbers/slugs, any ToolLott modifications, where processing occurs, and the impact of updating or removing it.

Why this register exists

This makes dependency changes reversible and auditable. If a component is upgraded, replaced or removed, ToolLott can immediately identify every affected tool and rerun the required regression tests. If no approved replacement exists, an affected tool returns to Under Development/BLOCKED instead of remaining misleadingly Ready.

Registry review date: 2026-08-12.