# Third-party notices

Reviewed 2026-10-31. This source distribution does not bundle GPU drivers, CUDA wheels, model weights or FFmpeg binaries. Retain upstream notices when redistributing an installed environment. Commercial permission does not waive copyright, attribution, source availability or redistribution obligations.

## Default model — weight license verified separately

- **Kim Mel-Band RoFormer**, author **Kimberley Jensen / KimberleyJSN**, `MelBandRoformer.ckpt`, 913,106,900 bytes.
- [Author repository](https://huggingface.co/KimberleyJSN/melbandroformer), pinned revision **ac9b0614ab3cd7f77219e18ba494dfd93956c348**. The author's [model card at this revision](https://huggingface.co/KimberleyJSN/melbandroformer/blob/ac9b0614ab3cd7f77219e18ba494dfd93956c348/README.md) explicitly declares **MIT**; see the [license-change commit](https://huggingface.co/KimberleyJSN/melbandroformer/commit/ac9b0614ab3cd7f77219e18ba494dfd93956c348). Earlier unclear/different-license revisions are not selected.
- [Pinned download](https://huggingface.co/KimberleyJSN/melbandroformer/resolve/ac9b0614ab3cd7f77219e18ba494dfd93956c348/MelBandRoformer.ckpt).
- Full SHA-256 **87201f4d31afb5bc79993230fc49446918425574db48c01c405e44f365c7559e**, from the author's pinned Git LFS metadata. Runtime checks this before `torch.load(weights_only=True)`. Provenance is recorded in `licenses/model-provenance.json` and the card snapshot in `licenses/kim-model-card.txt`. The complete selected checkpoint was downloaded, matched this digest, and passed a real RTX 4060 benchmark and production upload task on 2026-10-31.
- Retain Kimberley Jensen's attribution, source and MIT permission/disclaimer. Upstream supplies license metadata rather than a standalone license file; `licenses/kim-model-MIT.txt` preserves the standard MIT terms attributed to the author. StemLab claims no ownership of the weights.
- The reviewed registry now also includes SYH FT and SYH Big V1 Fast (see pinned provenance below). Model directory and optional HTTPS mirror are configurable; changing weights requires registry changes, checksum and license review.

## Reused headless architecture and configuration

`worker/vendor/roformer/mel_band_roformer.py` and `attend.py` reuse the headless architecture from [python-audio-separator **v0.41.1**](https://github.com/nomadkaraoke/python-audio-separator/tree/v0.41.1/audio_separator/separator/uvr_lib_v5/roformer), unmodified except attribution headers. [Project MIT license](https://github.com/nomadkaraoke/python-audio-separator/blob/v0.41.1/LICENSE). This architecture derives from Phil Wang's [BS-RoFormer](https://github.com/lucidrains/BS-RoFormer), also [MIT](https://github.com/lucidrains/BS-RoFormer/blob/main/LICENSE). Full notices are in `licenses/audio-separator-MIT.txt` and `licenses/BS-RoFormer-MIT.txt`. We reuse these files instead of installing the full catalog and unrelated backends. Our adapter performs CUDA chunking/overlap-add and derives instrumental = input − vocals; it never starts a GUI.

`worker/model-config.json` contains inference constructor fields from ZFTurbo's [Kimberley Jensen configuration](https://github.com/ZFTurbo/Music-Source-Separation-Training/blob/main/configs/KimberleyJensen/config_vocals_mel_band_roformer_kj.yaml), [MIT framework](https://github.com/ZFTurbo/Music-Source-Separation-Training/blob/main/LICENSE). Retain Roman Solovyev / ZFTurbo attribution and `licenses/MSST-MIT.txt`. JSON SHA-256: **90821659a006636e2f6e20af7c4014c64dec13ee8bcffabba77ad6a8a3283f7c**. We set `match_input_audio_length=true` for output alignment. No training code or datasets are shipped.

## Reference projects and rejected weights

- [UVR GUI](https://github.com/Anjok07/ultimatevocalremovergui) is the requested reference; its code is MIT. UVR and its developers are acknowledged for the ecosystem. No GUI or arbitrary UVR catalog is used. Individual MDX/VR/RoFormer weights do not inherit a common license by assumption.
- **Demucs code is MIT; its pretrained weights are not assumed to inherit that grant.** See the [maintainer's model-license discussion](https://github.com/facebookresearch/demucs/issues/327). Initial candidate htdemucs was rejected during review. No Demucs adapter/dependency remains, no Demucs weight is enabled/distributed, and any ignored review download is not part of the deliverable.

## Pinned Python dependencies

`worker/requirements.lock` pins the Windows Python 3.11 set. Exact versions, PyPI license metadata and source URLs for **every** dependency are in [`licenses/python-metadata.json`](licenses/python-metadata.json). `worker/license_inventory.py` records actual installed packages and license-file locations after setup. Preserve all wheel/native-library notices when redistributing. The following selected licenses permit commercial use subject to their terms:

| Packages | License / obligations |
|---|---|
| torch 2.5.1 | [BSD-3-Clause](https://github.com/pytorch/pytorch/blob/v2.5.1/LICENSE); retain bundled third-party notices. Official CUDA wheels contain libraries subject to separate [NVIDIA terms](https://docs.nvidia.com/cuda/eula/index.html). No driver/wheel is bundled here. |
| NumPy 1.26.4, SoundFile 0.13.1, SciPy, scikit-learn, numba, cloudpickle, decorator, fsspec, idna, Jinja2, joblib, lazy-loader, MarkupSafe, mpmath, networkx, pooch, pycparser, python-dotenv, SymPy, threadpoolctl | BSD variants; preserve notices/disclaimers. SoundFile's bundled libsndfile is LGPL-2.1-or-later; preserve source/relinking rights if redistributing binaries. |
| librosa 0.10.2.post1 | ISC; preserve copyright/permission notice. |
| beartype 0.18.5, einops 0.8.1, rotary-embedding-torch 0.6.5, audioread, charset-normalizer, filelock, narwhals, platformdirs, urllib3 | MIT; retain notices. |
| requests 2.32.5, msgpack | Apache-2.0; retain license/NOTICE and attribution as applicable. |
| packaging | Apache-2.0 OR BSD-2-Clause; retain selected license. |
| llvmlite | BSD-2-Clause AND Apache-2.0 WITH LLVM-exception; preserve LLVM notices. |
| soxr | LGPL-2.1-or-later; preserve license and native-library redistribution rights. |
| certifi | MPL-2.0; preserve notices and provide modified covered source when applicable. |
| cffi | MIT-0 plus bundled libffi notices as applicable. |
| typing-extensions | PSF-2.0; retain license and acknowledgements. |

## Website, Go API and infrastructure

- `web/package-lock.json` pins Next.js **16.4.3**, React/React DOM **19.3.1**, Tailwind CSS **4.3.3**, Radix Slot, class-variance-authority, clsx and tailwind-merge (MIT). shadcn/ui button pattern: [MIT](https://github.com/shadcn-ui/ui/blob/main/LICENSE.md), full notice `licenses/shadcn-MIT.txt`. Lucide 0.468.0: [ISC](https://github.com/lucide-icons/lucide/blob/main/LICENSE). TypeScript: Apache-2.0. Runtime package notices/versions are preserved in `licenses/web/` and `licenses/web-inventory.json`.
- Go modules: AWS SDK v2 (Apache-2.0), pgx v5 (MIT), go-redis v9 (BSD-2-Clause), Go x/crypto, x/sync, x/text (BSD-3-Clause). Module notices and exact versions: `licenses/go/`, `licenses/go-inventory.json`, `api/go.mod`, `api/go.sum`.
- Test-only miniredis v2.35.0 and gopher-lua v1.1.1: MIT. Optional portable PostgreSQL test helper downloads Zonky's packaging of PostgreSQL 17.6 ([PostgreSQL License](https://www.postgresql.org/about/licence/)), verifies Maven SHA256 and writes only ignored artifacts. No test binaries are shipped.
- PostgreSQL 17: PostgreSQL License. Redis **7.2**: [BSD-3-Clause](https://github.com/redis/redis/blob/7.2/COPYING), deliberately selected instead of later source-available versions. Nginx: BSD-2-Clause. Caddy: Apache-2.0. Official Go/Node images retain upstream notices.
- Self-hosted MinIO RELEASE.2025-04-22T22-12-26Z: [AGPL-3.0](https://github.com/minio/minio/blob/RELEASE.2025-04-22T22-12-26Z/LICENSE), permits commercial operation with AGPL obligations. Upstream Docker Hub/Quay images returned authorization errors during deployment, so Compose pins the [Coollabs/Coolify source build](https://github.com/coollabsio/minio) at `ghcr.io/coollabsio/minio:RELEASE.2025-04-22T22-12-26Z@sha256:a4938f37f1be1841b8e7b627ad0207b265345fd0d063e42d7410c78af0e63e68`. Runtime reports this release, Go 1.24.9, AGPLv3. Preserve upstream/packager notices and source availability requirements. The mc image is no longer used; initialization uses boto3 1.40.18 ([Apache-2.0](https://github.com/boto/boto3/blob/1.40.18/LICENSE)) in a short-lived Python container. Production may instead use an independently provisioned private R2/S3 service.
- FFmpeg is an external executable. Detected Windows build **8.0.1-essentials_build-www.gyan.dev**, configured with `--enable-gpl --enable-version3`, is **GPL-3.0-or-later**, not assumed LGPL. [Licensing](https://ffmpeg.org/legal.html), [upstream source](https://ffmpeg.org/download.html), [Windows source/build information](https://www.gyan.dev/ffmpeg/builds/). Commercial operation is permitted under applicable conditions; redistribution requires notices and source/source offer. Optional Mock Dockerfile installs Debian FFmpeg, governed by that build's `ffmpeg -L` and package copyright files. FFmpeg code is not linked into the application/API.

No music corpus, copyrighted sample or training dataset is shipped. User recording rights are separate. Repeat review after any model, lockfile, binary or image changes.

## Additional author checkpoints: SYH99999 (2026-11-01)

The model author's own Hugging Face model cards declare `license: mit`, checked at pinned revisions (copies in `licenses/model-card-syhft.md` and `licenses/model-card-syh-big.md`). This review uses the weight repositories' declarations, not an inference from the architecture code license. Retain attribution to SYH99999 and the upstream Kim/Phil Wang/ZFTurbo architecture notices. The author cards do not document training data or promise performance on a specific genre.

- SYH MelBandRoformerSYHFT, author SYH99999, revision `260ce3b2de4398808291092b83e7f43027740544`: https://huggingface.co/SYH99999/MelBandRoformerSYHFT/tree/260ce3b2de4398808291092b83e7f43027740544 . Checkpoint `MelBandRoformerSYHFT.ckpt`, SHA256 `f319dfcde4396ea3106658f457f5eb0bc577e113491f61ae8bab216fe84b0c0c`. MIT license declaration: https://huggingface.co/SYH99999/MelBandRoformerSYHFT/blob/260ce3b2de4398808291092b83e7f43027740544/README.md . Config taken from the same revision, rendered as inert JSON (no YAML object deserialization), checked by SHA256 in the registry.
- SYH MelBandRoformerBigSYHFTV1Fast, author SYH99999, revision `96f4ae8e3f690e51ef26b3bef84531c944f5341b`: https://huggingface.co/SYH99999/MelBandRoformerBigSYHFTV1Fast/tree/96f4ae8e3f690e51ef26b3bef84531c944f5341b . Checkpoint `MelBandRoformerBigSYHFTV1.ckpt`, SHA256 `e2327e3e81f19e67c307f8c830c54267c09ecb0e9c6ad2b40a80c310899c955f`. MIT license declaration: https://huggingface.co/SYH99999/MelBandRoformerBigSYHFTV1Fast/blob/96f4ae8e3f690e51ef26b3bef84531c944f5341b/README.md . Config from the same revision, mask estimator depth 3.

Other candidate repositories such as becruily vocals/instrumental and pcunwa Kim FT did not expose a confirmed author model license during this review; they are not enabled. A mirror's blanket MIT label was not used as authorization for those checkpoints.

## Payment API integration (2026-11-02)

PayPal Orders v2 / Webhooks REST services are used server-side over HTTPS. No PayPal client SDK or third-party payment package was added. Account password derivation uses the existing golang.org/x/crypto/scrypt dependency (BSD-3-Clause, existing Go license notices retained). New fine/ensemble modes use only the three pinned, reviewed MIT model weights already listed above; averaging and overlap changes do not introduce another model.


## Google authentication dependencies and mark (2026-11-03)

- coreos/go-oidc v3.17.0 — Apache-2.0, copyright CoreOS/Red Hat and contributors. Source/license: https://github.com/coreos/go-oidc/tree/v3.17.0 . Preserved LICENSE/NOTICE under licenses/go/.
- go-jose/go-jose/v4 v4.1.3 — Apache-2.0; source/license https://github.com/go-jose/go-jose/tree/v4.1.3 . Preserved license under licenses/go/.
- golang.org/x/oauth2 v0.28.0 — BSD-3-Clause; source/license https://cs.opensource.google/go/x/oauth2/+/refs/tags/v0.28.0:LICENSE . Preserved license under licenses/go/.
- Google multicolor G is used only with the Google sign-in action, subject to Google's brand rules: https://developers.google.com/identity/branding-guidelines . Google is a trademark of Google LLC. This mark is not the site's own brand or an endorsement. No Google identity tokens are browser analytics inputs.
- uvr online's waveform site mark and social image are original code-generated assets; no reference-site artwork is included.

## Vocal dereverb specialist (2026-11-03)

Model: anvuew/dereverb_mel_band_roformer, revision cef05ad2b5b3145ea5c149d3ad5d1f8439b34d06, gentler checkpoint dereverb_mel_band_roformer_less_aggressive_anvuew_sdr_18.8050.ckpt. Upstream declares GPL-3.0, not MIT. License and original model card are preserved in licenses/anvuew-dereverb-GPL-3.0.txt and licenses/model-card-anvuew-dereverb.md. Source and SHA-256 are pinned in both catalogs and licenses/specialist-model-review.json. GPL allows commercial use subject to its terms; do not remove notices, and provide applicable corresponding source/license if distributing covered material. Weights are fetched from upstream, not included in source/runtime archives. The existing MIT inference implementation remains separately attributed. No universal quality improvement is claimed.

Lead/backing candidate Karaoke_GaboxV2 has no general upstream license at review time; permission addressed to another app is not treated as permission for this service. It is not enabled. Multi-track candidates remain unreviewed and unavailable.

## Model expansion — 2026-11-03

The operator explicitly changed the deployment policy: models without an identified incompatible restriction may be deployed pending author confirmation. **Unspecified is not an MIT license or a statement that commercial permission has been obtained.** Explicitly noncommercial candidates remain excluded. Existing weights and license classifications are unchanged.

| Model | Author / source | Weight terms recorded | Required attribution / follow-up |
| --- | --- | --- | --- |
| Gabox Karaoke Small, V1, V2 | [GaboxR67/MelBandRoformers](https://huggingface.co/GaboxR67/MelBandRoformers) | No repository-wide license found. [Discussion 9](https://huggingface.co/GaboxR67/MelBandRoformers/discussions/9) permits another named app; site-specific scope unconfirmed. | “by Gabox”; ask author to confirm uvr.online hosted commercial inference for each checkpoint. |
| Becruily Vocals | [Model repository](https://huggingface.co/becruily/mel-band-roformer-vocals) | No license/model card or explicit commercial prohibition found for this checkpoint during this review. | by becruily; ask for the applicable weight license and hosted inference permission. |
| Becruily Instrumental | [Model repository](https://huggingface.co/becruily/mel-band-roformer-instrumental) | Same pending status; do not infer rights from inference-code licenses. | by becruily; confirm this specific checkpoint separately. |
| anvuew stronger vocal dereverb | [Pinned repository](https://huggingface.co/anvuew/dereverb_mel_band_roformer/tree/cef05ad2b5b3145ea5c149d3ad5d1f8439b34d06) | GPL-3.0, same upstream repo as the existing gentler model. | Preserve `licenses/anvuew-dereverb-GPL-3.0.txt` and existing source/attribution notices. |

Exact pinned revisions, weight SHA256, sizes, original config URLs and converted config hashes are recorded in `api/models-catalog.json` and `worker/models-catalog.json`. Original YAMLs are preserved in `licenses/source-*.yaml`. Only YAML model parameters are converted; unsafe Python YAML constructors are not enabled. All checkpoints are SHA256-verified before `torch.load(weights_only=True)`.

**Excluded:** [becruily guitar](https://huggingface.co/becruily/mel-band-roformer-guitar/discussions/9): the author explicitly limits the stated free permission to noncommercial use and asks commercial users to contact them. This checkpoint is not enabled or downloaded for this service.

Lead/backing models estimate a lead stem. With a full mix, the residual includes instrumentation and must not be described as isolated backing vocals. The UI labels it “Backing / remaining audio” and recommends isolated vocal input. Instrumental-estimator predictions are mapped to the instrumental output; their residual is the vocals output.

RoFormer adaptation: `worker/vendor/roformer/mel_band_roformer.py` now passes the configured `mlp_expansion_factor` to `MaskEstimator`. Existing default-4 models retain their architecture; the Gabox Small checkpoint requires factor 1. Upstream copyright and MIT notices remain preserved.

## Multi-instrument separation (2026-11-03)

- SCNet Four: vocals, drums, bass, other. Aname-Tommy Huge-SCNet v1.2 weights, Apache-2.0 metadata, immutable revision and full SHA256 pinned in the catalog.
- BS Six: vocals, drums, bass, other, guitar, piano. The chosen enerjazzer restoration of jarredou's checkpoint has unknown weight license. A separate restoration labels MIT, and another converted-artifact project labels NC. We do not treat a mirror's label as an original author grant. This release follows the operator's explicit pending-permission policy and labels these weights `Unspecified / author_confirmation_pending`; no commercial permission is claimed. See `licenses/multistem-model-review.json` for exact versions, hashes, conflicting claims and provenance links.
- Drum, bass, guitar and piano extraction use the **same six-stem inference**, returning the selected estimate and the residual song. These are extraction views, not separate specialist weights or a claimed quality upgrade.
- Demucs official weights are excluded: the author states in [issue327](https://github.com/facebookresearch/demucs/issues/327) that weight terms differ from MIT code and are scientific-purpose only. Becruily Guitar remains excluded because its author explicitly states noncommercial terms.
- Vendored SCNet and BS-RoFormer code: ZFTurbo/Music-Source-Separation-Training revision `f0b527736e7da24eae5b561a2bb1efd0569ec757`, MIT, copyright Roman Solovyev. Full text preserved in `licenses/MSST-multistem-LICENSE`; original SCNet MIT copyright preserved in `licenses/SCNet-LICENSE`. SCNet by Weinan Tong and coauthors; BS-RoFormer architecture by Phil Wang/lucidrains and MSST contributors. Existing lucidrains license notices remain preserved. Local changes: relative import, bounded-window inference integration, common export gain and residual reconstruction.
- Apache2 weight-license text: `licenses/SCNet-weights-APACHE-2.0.txt`. Source YAML files and SHA-pinned runtime JSON retained under `licenses/` and `worker/` respectively. Model loading uses `torch.load(weights_only=True)` with strict key matching, never upstream executable inference scripts or GUI.

SCNet checkpoint-loader adaptation: maintain torch.load(weights_only=True), allow only the known PyTorch ReduceLROnPlateau type and standard defaultdict/dict training metadata, and replace the serialized bitsandbytes AdamW8bit training object with an inert local placeholder. No bitsandbytes module or optimizer code is loaded or executed. Only the strict model_state_dict is used after pinned full-file SHA256 verification. BS-RoFormer attention adaptation removes a newer set_priority keyword to support the installed PyTorch2.5 SDPA API. These local changes are covered by the same preserved MIT notices.


PayPal JavaScript SDK is loaded from https://www.paypal.com/sdk/js for official PayPal/card buttons and provider-hosted popup checkout. It is a hosted commercial payment service, not relicensed as part of this repository; the merchant's PayPal terms and regional eligibility apply. Integration reference: https://developer.paypal.com/studio/checkout/advanced/integrate . Card details are handled by provider frames.
NOWPayments is called through its hosted HTTPS API, without embedding a third-party SDK. Merchant terms, network availability, fees and minimums apply. API/signature reference: https://documenter.getpostman.com/view/7907941/S1a32n38 . Neither merchant credentials nor the separate reference site's source/configuration are shipped in public frontend assets.


## Waffo Pancake TypeScript SDK

- Package: `@waffo/pancake-ts`, pinned version **0.28.0**, server-side only.
- Source and package: https://www.npmjs.com/package/@waffo/pancake-ts
- License: MIT; original copyright and permission notice are preserved in `docs/waffo/SDK-LICENSE.txt` and the distributed SDK package.
- Official integration guide: https://docs.waffo.ai/zh/integrate/skill
- Payment processing is a separate commercial service governed by the merchant's Waffo agreement; the SDK's MIT license does not replace that agreement.