{
  "schema": 1,
  "upstreamProject": "https://github.com/ffmpegwasm/ffmpeg.wasm",
  "upstreamRelease": "https://github.com/ffmpegwasm/ffmpeg.wasm/releases/tag/v12.15",
  "packages": [
    {
      "name": "@ffmpeg/ffmpeg",
      "version": "0.12.15",
      "license": "MIT",
      "tarball": "https://registry.npmjs.org/@ffmpeg/ffmpeg/-/ffmpeg-0.12.15.tgz",
      "tarballBytes": 18455,
      "sha512Integrity": "sha512-1C8Obr4GsN3xw+/1Ww6PFM84wSQAGsdoTuTWPOj2OizsRDLT4CXTaVjPhkw6ARyDus1B9X/L2LiXHqYYsGnRFw==",
      "integrityVerified": true,
      "tarballSHA256": "c8a23365fb39b46d3d1d9baa2e74b522d00ce5d57e8b20471ad2665eaad38e3e",
      "publishedAt": "2025-01-07T10:10:00.739Z"
    },
    {
      "name": "@ffmpeg/core",
      "version": "0.12.10",
      "license": "GPL-2.0-or-later",
      "tarball": "https://registry.npmjs.org/@ffmpeg/core/-/core-0.12.10.tgz",
      "tarballBytes": 20634719,
      "sha512Integrity": "sha512-dzNplnn2Nxle2c2i2rrDhqcB19q9cglCkWnoMTDN9Q9l3PvdjZWd1HfSPjCNWc/p8Q3CT+Es9fWOR0UhAeYQZA==",
      "integrityVerified": true,
      "tarballSHA256": "d00089ce82e1bdf637ddbe42e0c3d41a1ba8cf4c9e825e7fa4d0bb970e844bd4",
      "publishedAt": "2025-01-07T10:13:14.328Z"
    }
  ],
  "runtimeFlavor": "ESM, single-thread core; no multi-thread core or core worker vendored",
  "runtimeBytes": 32360894,
  "runtimeFiles": [
    {
      "file": "wrapper/classes.js",
      "bytes": 9747,
      "sha256": "7a829c898bdbc3a8806652a5502d9101178ce4e988a2c50b3abc1306ce4fc919",
      "upstreamPath": "package/dist/esm/classes.js"
    },
    {
      "file": "wrapper/const.js",
      "bytes": 1016,
      "sha256": "9e3bc9dd84781c81daf459e2c46eeec815edac35089832681d9a9a0f383060d0",
      "upstreamPath": "package/dist/esm/const.js"
    },
    {
      "file": "wrapper/errors.js",
      "bytes": 332,
      "sha256": "619310d7ef5fe5fefa0a31927db862b7c291713cfef4d71753fa8aafd18f4db6",
      "upstreamPath": "package/dist/esm/errors.js"
    },
    {
      "file": "wrapper/index.js",
      "bytes": 58,
      "sha256": "cad19572420f7ead17272082d9582ebaed7f2856e19875542f83daf8d25d3b5d",
      "upstreamPath": "package/dist/esm/index.js"
    },
    {
      "file": "wrapper/types.js",
      "bytes": 295,
      "sha256": "72f80e6fd44fcd18b55c9a0deb3bc70b9bb37480cf969045ca4521f5a11300f5",
      "upstreamPath": "package/dist/esm/types.js"
    },
    {
      "file": "wrapper/utils.js",
      "bytes": 138,
      "sha256": "8c2e0e16445f8d3a0acbb812f2c60541a92c88ed0bf9ffe96c52e7fb6c8b1d72",
      "upstreamPath": "package/dist/esm/utils.js"
    },
    {
      "file": "wrapper/worker.js",
      "bytes": 5085,
      "sha256": "feff0ac937ea225e997e1fae997a74f8b8d572423a526da59eb56624b1f3cde7",
      "upstreamPath": "package/dist/esm/worker.js"
    },
    {
      "file": "core/ffmpeg-core.js",
      "bytes": 111804,
      "sha256": "67a48f11645f85439f3fde4f2119042c16b374b910206b7a7a24f342e28dcae3",
      "upstreamPath": "package/dist/esm/ffmpeg-core.js"
    },
    {
      "file": "core/ffmpeg-core.wasm",
      "bytes": 32232419,
      "sha256": "9f57947a5bd530d8f00c5b3f2cb2a3492faa7e5d823315342d6a8656d0a6b7b7",
      "upstreamPath": "package/dist/esm/ffmpeg-core.wasm"
    }
  ],
  "modifications": "None: runtime files copied byte-for-byte from official npm tarballs. No package.json/project dependency changes.",
  "notices": [
    {
      "file": "LICENSE-wrapper-MIT.txt",
      "url": "https://raw.githubusercontent.com/ffmpegwasm/ffmpeg.wasm/v12.15/LICENSE",
      "sha256": "3e123e29517d76504ffce77b3f8e2ccffd4712493f27694b0aba3e376676459f",
      "bytes": 1066,
      "ok": true
    },
    {
      "file": "LICENSE-core-GPL-2.0.txt",
      "url": "https://raw.githubusercontent.com/FFmpeg/FFmpeg/n5.1.4/COPYING.GPLv2",
      "sha256": "8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643",
      "bytes": 18092,
      "ok": true
    },
    {
      "file": "FFmpeg-LICENSE.md",
      "url": "https://raw.githubusercontent.com/FFmpeg/FFmpeg/n5.1.4/LICENSE.md",
      "sha256": "cb48bf09a11f5fb576cddb0431c8f5ed0a60157a9ec942adffc13907cbe083f2",
      "bytes": 4376,
      "ok": true
    },
    {
      "file": "upstream-Dockerfile",
      "url": "https://raw.githubusercontent.com/ffmpegwasm/ffmpeg.wasm/v12.15/Dockerfile",
      "sha256": "2501ef0a2c0a374b7e575160fb3d203cb36e698f5d72f963c70f050f02bb7dee",
      "bytes": 6329,
      "ok": true
    },
    {
      "file": "upstream-ffmpeg.sh",
      "url": "https://raw.githubusercontent.com/ffmpegwasm/ffmpeg.wasm/v12.15/build/ffmpeg.sh",
      "sha256": "be107d2237b61ad301b488954e25c42cdae9e198ff4398b4a3455a3ccc2192bc",
      "bytes": 1019,
      "ok": true
    },
    {
      "file": "upstream-ffmpeg-wasm.sh",
      "url": "https://raw.githubusercontent.com/ffmpegwasm/ffmpeg.wasm/v12.15/build/ffmpeg-wasm.sh",
      "sha256": "ed4cf14aad203491345b3da7ab5711bb70df1a483afd13837bb174d9b8ac8658",
      "bytes": 1808,
      "ok": true
    }
  ],
  "sourceArchive": {
    "file": "audit-r35/ffmpeg-wasm-v12.15-source.tar.gz",
    "sourceURL": "https://codeload.github.com/ffmpegwasm/ffmpeg.wasm/tar.gz/refs/tags/v12.15",
    "bytes": 1329034,
    "sha256": "98e473f975e4aa6e5836d99078c40db5d8f4ea52685e6411025f2d7b876a7569",
    "archiveEntries": 375,
    "scope": "wrapper, binding modifications, build scripts, FFmpeg frontend files; external dependencies are fetched separately by upstream Dockerfile",
    "distribution": "audit only; not shipped publicly"
  },
  "coreSourceStatus": {
    "completeCorrespondingSourceVerified": false,
    "reason": "Official core npm distribution contains binaries and metadata only. The release commit and build recipe are identified, and every named external source ref now resolves to an exact candidate commit. The recipe uses unpinned x264 4-cores and lame master branches; current refs predate publication but no recorded release build manifest proves their historical checkout. The audit source archive does not include external dependency source trees or toolchain port sources, and a complete equivalent-access source distribution has not been prepared or verified.",
    "releaseCommit": "71aa99d37c02a7b4c435275ca9ef50e612f6efa1",
    "releaseCommitDate": "2025-01-07T10:12:48Z",
    "coreNpmPublicationDate": "2025-01-07T10:13:14.328Z",
    "ffmpegBaseSource": "https://github.com/FFmpeg/FFmpeg/tree/4729204c17f756e186d622060088371d10b34f7e",
    "buildSource": "https://github.com/ffmpegwasm/ffmpeg.wasm/tree/71aa99d37c02a7b4c435275ca9ef50e612f6efa1",
    "mutableRecipeRefs": [
      {
        "repo": "ffmpegwasm/x264",
        "ref": "4-cores",
        "sha": "33cac6b77d5b9259c552156013a817ab23119612",
        "date": "2022-08-22T01:45:45Z"
      },
      {
        "repo": "ffmpegwasm/lame",
        "ref": "master",
        "sha": "2badea1974ae36cb8312afe99cff1e6b3b5decee",
        "date": "2020-10-29T03:19:54Z"
      }
    ],
    "exactCandidateManifest": "audit-r35/ffmpeg-external-source-candidates.json",
    "requiredFollowup": "Before production distribution, establish the historical mutable dependency checkouts (or build from the reviewed exact source commits), assemble and verify all corresponding source plus build modifications and applicable notices, and provide an appropriate complete source distribution. Notices and repository links are not asserted to replace this step."
  },
  "selfHosting": {
    "requiredLoadOptions": [
      "classWorkerURL",
      "coreURL",
      "wasmURL"
    ],
    "classWorkerURL": "./wrapper/worker.js",
    "coreURL": "./core/ffmpeg-core.js",
    "wasmURL": "./core/ffmpeg-core.wasm",
    "externalRuntimeFetchRequired": false,
    "note": "Upstream wrapper has a CDN default; application must always supply the three self-hosted URLs. Optional @ffmpeg/util is not required."
  },
  "actualCoreValidation": {
    "method": "Instantiated the unchanged WASM in Node with a minimal self.location shim and wasmBinary bytes, then called its own exec API. Browser wrapper functionality still requires a browser smoke test.",
    "ffmpegVersion": "5.1.4",
    "emscriptenVersion": "3.1.40",
    "decodersConfirmed": [
      "h264",
      "aac",
      "aac_fixed",
      "aac_latm"
    ],
    "encodersConfirmed": [
      "libx264",
      "libx264rgb",
      "aac"
    ],
    "workerFSConfirmed": true,
    "licenseCommand": "-L returned 0 and GPL version 2 or later",
    "auditFiles": [
      "audit-r35/ffmpeg-core-version-validation.json",
      "audit-r35/ffmpeg-core-codecs-license-validation.json",
      "audit-r35/ffmpeg-x264-version-validation.json",
      "audit-r35/ffmpeg-ffprobe-return-validation.json"
    ],
    "ffprobeReturnCaveat": "The pinned binding discards the C ffprobe return and reports Module.ret (-1 after reset) for both success and failure. Require newly written valid streams JSON and reject a parsed error object; status -1 alone does not establish success."
  }
}