Open-source licences
Last updated: 2026-08-08
Files Workshop is built on open-source software. This page lists the components we ship or run, together with the licence each one is distributed under, and links to the upstream source.
The npm sections are generated from the packages actually installed in the deployed build, so the versions here are the versions running. Build-time-only development dependencies are excluded — they are never delivered to visitors. Trademarks and product names belong to their respective owners; listing a project here does not imply that it endorses Files Workshop.
Web application
Runtime dependencies of the website — some execute in your browser, some on our servers.
| Package | Version | Licence |
|---|---|---|
| @auth/prisma-adapter | 2.11.2 | ISC |
| @imgly/background-removal | 1.7.0 | SEE LICENSE IN LICENSE.md |
| @prisma/client | 6.19.3 | Apache-2.0 |
| @types/jsbarcode | 3.11.4 | MIT |
| @types/nodemailer | 8.0.1 | MIT |
| @vercel/analytics | 2.0.1 | MIT |
| @vercel/speed-insights | 2.0.0 | Apache-2.0 |
| bijoy2unicode | 1.0.2 | MIT |
| class-variance-authority | 0.7.1 | Apache-2.0 |
| clsx | 2.1.1 | MIT |
| cronstrue | 3.21.0 | MIT |
| exceljs | 4.4.0 | MIT |
| exifr | 7.1.3 | MIT |
| fabric | 7.4.0 | MIT |
| gifenc | 1.0.3 | MIT |
| heic2any | 0.0.4 | MIT |
| imagetracerjs | 1.2.6 | Unlicense |
| js-beautify | 1.15.4 | MIT |
| js-yaml | 5.2.0 | MIT |
| jsbarcode | 3.12.3 | MIT |
| jspdf | 4.2.1 | MIT |
| jsqr | 1.4.0 | Apache-2.0 |
| jszip | 3.10.1 | (MIT OR GPL-3.0-or-later) |
| libarchive.js | 2.0.2 | MIT |
| lucide-react | 1.21.0 | ISC |
| marked | 18.0.5 | MIT |
| next | 16.2.9 | MIT |
| next-auth | 5.0.0-beta.31 | ISC |
| next-themes | 0.4.6 | MIT |
| nodemailer | 7.0.13 | MIT-0 |
| openai | 6.45.0 | Apache-2.0 |
| pdf-lib | 1.17.1 | MIT |
| pdfjs-dist | 6.0.227 | Apache-2.0 |
| prisma | 6.19.3 | Apache-2.0 |
| qrcode | 1.5.4 | MIT |
| react | 19.2.4 | MIT |
| react-dom | 19.2.4 | MIT |
| react-dropzone | 15.0.0 | MIT |
| sql-formatter | 15.8.2 | MIT |
| stripe | 22.3.0 | MIT |
| tailwind-merge | 3.6.0 | MIT |
| tesseract.js | 7.0.0 | Apache-2.0 |
| turndown | 7.2.4 | MIT |
Conversion worker
Runtime dependencies of the background service that runs server-side conversions.
| Package | Version | Licence |
|---|---|---|
| bullmq | 5.34.10 | See package |
| express | 4.21.2 | See package |
| ioredis | 5.4.2 | See package |
| multer | 1.4.5-lts.1 | See package |
| nodemailer | 7.0.13 | MIT-0 |
Native and system components
Programs installed in the worker image or run as separate services. These do the heavy conversion work.
| Component | Used for | Licence |
|---|---|---|
| LibreOffice | Office ↔ PDF conversions | MPL-2.0 |
| Ghostscript | PDF compression | AGPL-3.0* |
| qpdf | PDF encryption / decryption | Apache-2.0 |
| FFmpeg | Audio and video conversion | LGPL-2.1-or-later (GPL in some distribution builds)* |
| Tesseract OCR | Server-side OCR and language packs | Apache-2.0 |
| OCRmyPDF | Searchable PDF / PDF-A output | MPL-2.0 |
| wkhtmltopdf | HTML → PDF rendering | LGPL-3.0 |
| PyMuPDF | PDF → Excel / PowerPoint extraction and rendering | AGPL-3.0* |
| pdf2docx | PDF → Word conversion | GPL-3.0* |
| openpyxl | Excel workbook generation | MIT |
| python-pptx | PowerPoint generation | MIT |
| mdbtools | Microsoft Access (.mdb) table export | GPL-2.0 / LGPL-2.0* |
| LanguageTool | Self-hosted grammar and style checking | LGPL-2.1* |
| Redis | Job queue backing store | RSALv2 / SSPLv1 |
| DejaVu & Liberation fonts | Fonts available to rendered output | Bitstream Vera / SIL OFL-1.1 |
Loaded in your browser
Components fetched at runtime rather than bundled with the site.
| Component | Used for | Licence |
|---|---|---|
| OpenCV.js | Auto-crop and deskew in the document scanner (loaded from CDN) | Apache-2.0 |
| libarchive.js (WASM) | 7z / RAR / TAR / GZ extraction, vendored under /public/libarchive | MIT |
Copyleft components
* Some components above are distributed under copyleft licences that place conditions on offering the software as a network service or on redistributing the container image. We list them explicitly rather than burying them:
- AGPL-3.0 — @imgly/background-removal, Ghostscript, PyMuPDF. The AGPL extends copyleft to software offered over a network. Operating a service built on these components can oblige the operator to offer the corresponding source of the combined work to its users. All three have commercial licences available from their vendors (IMG.LY, Artifex) for use in closed-source products.
- GPL-2.0 / GPL-3.0 — pdf2docx, mdbtools. Invoked as separate command-line processes rather than linked into our code. The binaries themselves remain under the GPL and their source must be made available to anyone we distribute the image to.
- LGPL — FFmpeg, wkhtmltopdf, LanguageTool. Used unmodified as separate programs or services. Distribution builds of FFmpeg can enable GPL-licensed components — check the build in the deployed image.
Corresponding source and requests
To request the corresponding source of any copyleft component we distribute, or to report an attribution error or omission on this page, contact us and we will correct it. Full licence texts ship inside each package and are available from the upstream links above.