LAME 4.0 (official release)
Source: https://sourceforge.net/projects/lame/files/lame/4.0/lame-4.0.tar.gz/download
sha256 (lame-4.0.tar.gz): 3df5124d5ad3a98312ffd7ba6a9b36230e4f8a3e66d3ce0f425e336c32d216eb

Vendored byte-identical from the tarball:
  Sources/CLame/*.c, *.h       <- lame-4.0/libmp3lame/ (encoder only; mpglib_interface.c,
                                  vector/xmm_quantize_sub.c (SSE, unused: HAVE_XMMINTRIN_H undefined),
                                  i386/ (assembler and nasm.h), lame.rc, logoe.ico, lame.pc.in,
                                  depcomp and Makefiles are not vendored)
  Sources/CLame/vector/lame_intrin.h <- lame-4.0/libmp3lame/vector/lame_intrin.h
  Sources/CLame/include/lame.h <- lame-4.0/include/lame.h
  COPYING, LICENSE, README     <- lame-4.0/COPYING, LICENSE, README

The only file not from upstream is Sources/CLame/config.h (hand-written; see its header).
No mpglib / mpg123 decoder is built: HAVE_MPGLIB, HAVE_MPG123 and DECODE_ON_THE_FLY are undefined.