Cut 2.4.2

[oscarvalenzuelab]

Release prep. Everything already merged; this moves [Unreleased] under a version heading and bumps the version.

What 2.4.2 contains

The never-guess promise is ours to keep. licenses.py promises that a name identifying a licence family but not a licence is never guessed at. NEVER_RESOLVE held two entries; "BSD", "Apache", "LGPL", "Public Domain" and the rest were unresolved only because ospac did not happen to carry them. ospac is now filling in folk spellings at our own request, so a release adding bsd -> BSD-3-Clause would have made normalize("BSD") answer with a confident wrong identifier. The family names are refused before any lookup now.

A refusal survives being put inside an expression. Refusals were matched against the whole string, so GPL was refused and GPL/MIT returned GPL-1.0-or-later AND MIT — the exact wrong answer the refusal exists to prevent, in the spelling SBOMs most often use for dual licensing. (GPL) did it with one token. An adopter's own never_resolve was bypassable the same way.

Precedence is decided in one place. Adopter never_resolve → adopter aliases → our refusals → everything else, applied in both key spaces. Overrides were previously implemented by subtracting names from the refusal list, which put them after the SPDX parser and in one key space only: an overlay mapping gpl got the parser's deprecated GPL-1.0-or-later instead of the identifier they chose, and the same name answered two ways depending on a leading "The".

One rule where there were two. An explicit statement by the adopter now beats every refusal this tool would make — the ambiguity report used to be an exception. Their never_resolve still beats their own alias, being more specific.

Patch

No new surface. Nothing that names a licence stops resolving: MIT License, ISC License, Apache License 2.0, EPL-2.0, MIT AND Apache-2.0, Apache-2.0 WITH LLVM-exception all unchanged. None of the newly refused names ever resolved.

Also here

A test asserted which lookup path resolved a real licence, which is ospac's data to decide. ospac 1.7.0 moved one spelling between paths and main went red on a release nobody here made; it asserts the mechanism now.

Checks

• pyproject.toml, src/ossbomer/__init__.py and the compare link all at 2.4.2
• 1106 tests pass; ruff and mypy clean
• python -m build produces both artifacts; twine check passes on each
• 65,870 findings across every profile and every corpus document: 0 changed

Tagging v2.4.2 once this lands, which triggers the PyPI publish.