HEIC decoding uses heic-to 1.6.6 by hoppergee (LGPL-3.0-or-later), libheif 1.23.6 and libde265 1.0.16.
The csp/heic-to.js distribution is supplied byte-for-byte without modification and loaded separately from the site's application code.
The library is dynamically loaded from /vendor/heic-to-1.6.6-csp.js. You may replace that separately hosted file with a compatible build; the application uses the exported heicTo({blob,type:'bitmap'}) API.

License notices and full GPL/LGPL text:
/vendor/HEIC-LICENSE.txt
/vendor/LIBHEIF-COPYING.txt

Matching upstream sources, available from this same server:
/vendor/heic-to-1.6.6-source.tar.gz
/vendor/libheif-1.23.6-source.tar.gz
/vendor/libde265-1.0.16-source.tar.gz
Archive origins and SHA-256: /vendor/HEIC-SOURCE-MANIFEST.json

The heic-to v1.6.6 README identifies libheif 1.23.6 and its build command uses LIBDE265_VERSION=1.0.16 USE_UNSAFE_EVAL=0 USE_WASM=0. The source archives contain the original build scripts and wrapper source. Follow that README's libheif build instructions, then heic-to's esbuild.mjs csp build, and substitute the compatible standalone file above.
Upstream source and build instructions: https://github.com/hoppergee/heic-to/tree/v1.6.6
libheif source: https://github.com/strukturag/libheif/tree/v1.23.6
libde265 source: https://github.com/strukturag/libde265/tree/v1.0.16
The application's own files are separate from this replaceable library.