This directory contains the canonical verified third-party baseline for PostQ Code Scanner.

Product builds filter COMPONENTS.json and copy only the license/notice files referenced by the
components distributed in that artifact. LICENSE_HASHES.sha256 records the source-baseline hashes;
the release legal manifest records generated product-bundle and final-artifact hashes.

The OpenGrep license was reviewed against the exact source ref
v1.26.0 on 22 August 2026. The Red Hat UBI EULA was retrieved from the official Red
Hat license URL on the same date. Java license/NOTICE files were extracted from the exact runtime
JARs; JavaScript licenses were copied from the exact npm packages installed from the lockfile.

Do not edit upstream license text. Replace a file only after verifying the exact component/version,
source, required notices, and SHA-256 for the new release.