This directory contains the canonical verified third-party baseline for PostQ Code Scanner.

Product builds filter COMPONENTS.json and copy only the license/notice files referenced by the
components distributed in that artifact. LICENSE_HASHES.sha256 records the source-baseline hashes;
the release legal manifest records generated product-bundle and final-artifact hashes.

The OpenGrep license was retrieved from the exact reviewed source ref
v1.28.0-interfile.alpha.1 on 19 August 2026. The Red Hat UBI EULA was retrieved from the official Red
Hat license URL on the same date. Java license/NOTICE files were extracted from the exact runtime
JARs; JavaScript licenses were copied from the exact npm packages installed from the lockfile.

Do not edit upstream license text. Replace a file only after verifying the exact component/version,
source, required notices, and SHA-256 for the new release.