The notices listed MSIME-UI and MSIME-UiHtml as third-party components with their own repository URLs. They are directories of this repository, so the notice said the product bundles something from elsewhere when it bundles its own code; the GPL section now says where they are and what they used to be. The bundled data attribution follows the dictionary and helpcodes to MSIME-Engine, matching what product-lock.json already names, with every upstream term unchanged. The miniaudio entry described a vendored copy this branch deletes.
The server build steps still told a developer to clone the archived MSIME-Dict and build the databases by hand, through a directory layout that no longer exists. The product lock names a published release and records the SHA256 of every asset, which is the same data all three platforms ship, so the steps fetch that instead. The worked example lost a hardcoded path into one developer's machine.
A sweep for vendored third-party code turned it up after the first commit: src/voice-input/third_party/miniaudio.h in MSIME-Server is a 95,844-line single-header audio library included by cue_player.cpp and voice_input_service.cpp, so it is compiled into the Server and redistributed in the installer.
It was invisible to a dependency-manifest reading, because it is neither a vcpkg entry nor a submodule. MSIME-Linux is unaffected: it records audio by running arecord or pw-record rather than linking a library.
Its author offers a choice of the Unlicense or MIT-0; MIT-0 is taken and reproduced from the header itself.
The installer ships the engine, the Server and its dependency DLLs, the WebView2 interface resources, and the dictionary and helpcode data, and this repository had no third-party notice file at all. MSIME-Linux and MSIME-Apple both carry one; Windows is the platform with the most users and the largest redistributed surface, and it carried none.
The immediate obligation is rime-ice, which is GPL-3.0 and requires attribution and whose content forms the bulk of msime.db. MSIME-Dict's NOTICE.md records that requirement and, until now, recorded that this repository did not meet it.
The license texts for the Apache-2.0, Boost and MIT components are the ones already reviewed in MSIME-Linux/THIRD_PARTY_NOTICES.txt rather than newly transcribed. The curl, zlib, toml++ and nlohmann/json texts are taken from those projects' own LICENSE files.
The component descriptions are not copied from the Linux notices, because the two builds differ in a way that matters here. The TSF text service uses the static vcpkg triplet, so its dependencies are compiled into MetasequoiaImeTsf.dll. The Server uses the dynamic triplet and Prepare-PackageFiles.ps1 copies its entire build output, so fmt, spdlog, Boost.Locale, Boost.JSON, SQLite, libcurl and zlib are redistributed as DLLs. On Linux those same libraries come from the distribution and are explicitly not redistributed, so reusing that wording would have stated the opposite of what happens here. WebView2Loader.dll is likewise shipped as Microsoft built it.
dict_japanese.dat is covered by reference: the Mozc dictionary notice, which carries the IPAdic and Okinawa dictionary terms, is already installed beside the model as MOZC_DICTIONARY_LICENSE.txt, so it is not duplicated.
Lu Fan(SonnyCalcr)