PDF.js 6.3.289 — supplementary notices for the unmodified modern browser bundles

These are original notice excerpts found in the official pdf.mjs.map and
pdf.worker.mjs.map source contents. Full component license texts are supplied
alongside this file and in /vendor/pdfjs/{cmaps,standard_fonts,wasm,iccs}/.
This collection is not an upstream NOTICE file and does not change licenses.

src/shared/murmurhash3.js (included in both main and worker)

/* Copyright 2014 Opera Software ASA
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 *
 *
 * Based on https://code.google.com/p/smhasher/wiki/MurmurHash3.
 * Hashes roughly 100 KB per millisecond on i7 3.4 GHz.
 */

external/brotli/decode.js (worker)

/* Copyright 2017 Google Inc. All Rights Reserved.

   Distributed under MIT license.
   See file LICENSE for detail or copy at https://opensource.org/licenses/MIT
*/

src/core/flate_stream.js (worker)

/* Copyright 1996-2003 Glyph & Cog, LLC
 *
 * The flate stream implementation contained in this file is a JavaScript port
 * of XPDF's implementation, made available under the Apache 2.0 open source
 * license.
 */

external/standard_fonts/README.md, v6.3.289 (Foxit origin notice)

Copyright 2014 PDFium Authors. All rights reserved.
 Use of this source code is governed by a BSD-style license that can be
 found in the LICENSE file.

Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com

dlmalloc 0.2.13, src/dlmalloc.rs (QCMS wasm allocator)

// This is a version of dlmalloc.c ported to Rust. You can find the original
// source at ftp://g.oswego.edu/pub/misc/malloc.c
//
// The original source was written by Doug Lea and released to the public domain

Distribution notes (written for this project)

- PDF.js main/worker and all rendering assets are copied without modification
  from the official pdfjs-dist 6.3.289 npm archive. npm scripts were not run.
- PDF.js: Apache-2.0. QCMS and its bridge: MIT. OpenJPEG and its bridge: BSD-2-Clause.
  PDFium JBIG2 carries BSD-3-Clause and Apache-2.0 texts; its PDF.js bridge is
  Apache-2.0. The complete original LICENSE_JBIG2 is retained.
- Adobe CMaps: BSD-3-Clause-style Adobe terms; the compressed data is supplied
  as produced by upstream. Foxit/PDFium fonts: BSD-3-Clause-style terms.
- Liberation Sans font name tables identify 1.07.4. Its supplied license is
  GPL-2.0 with the Liberation font exception, not SIL OFL. The upstream 1.07.4
  source archive, including editable SFD files and build scripts, is provided
  at /licenses/pdfjs-liberation-fonts-1.07.4-source.tar.gz. The PDF.js copies
  differ from Pagure's same-version TTF archive; byte-reproducible rebuilding
  of the PDF.js font copies has not been established. No font is modified here.
- The QCMS wasm producers/name data identifies qcms 0.3.0, wasm-bindgen 0.2.126,
  Rust 1.97.1 (8bab26f4f, 2026-07-14), and dlmalloc 0.2.13. MIT terms are selected
  for the dual MIT/Apache Rust, wasm-bindgen and dlmalloc components.
- Emscripten-generated OpenJPEG/JBIG2 glue is present. Emscripten's MIT terms
  are selected; its original full license and musl copyright notices are
  preserved from the 4.0.23 tag as supplemental notices. This tag identifies
  the notice source only: the exact toolchain version of these wasm files
  is not established by the package. Their complete binary dependency closure
  has not been independently reconstructed.
- The ICC profile carries CC0-1.0. Neither this license nor the library licenses
  promise exact color output, trademark rights, or rights in users' documents.
- Viewer UI, QuickJS scripting/sandbox, Node canvas dependency, source maps,
  legacy builds and editor/viewer assets are not distributed. The source maps
  were used for audit only. Main and worker remain full original builds and
  therefore still contain unused library code and third-party fragments.