# Reckon Graph 0.4.2 release notes

Reckon Graph 0.4.2 is the publishable patch release of the 0.4 line. It contains
all functionality described in the 0.4.0 and 0.4.1 release notes plus a
canonical CycloneDX attestation-predicate fix.

## CycloneDX attestation verification fix

- The release workflow and final cross-channel verifier now use the canonical
  `https://cyclonedx.org/bom` predicate type emitted by GitHub's SBOM
  attestation action. The CycloneDX document's `specVersion` remains validated
  independently as 1.4, 1.5, or 1.6.
- Regression tests require the canonical attestation predicate for SBOM bundles
  and reject accidental coupling to a document-version URI.

## Why 0.4.1 was not published

The immutable `v0.4.1` tag produced a verified release tarball, signed SLSA
provenance, and a signed CycloneDX SBOM, then failed closed before npm or
Artifactory publication. Inspection of the signed bundle proved that GitHub
emitted `https://cyclonedx.org/bom`, while the verifier requested
`https://cyclonedx.org/bom/v1.5`. The tag remains unchanged for auditability;
this patch release corrects the verifier instead of rewriting it.

Version preparation alone does not certify distribution. Certification still
requires the tag workflow and byte-for-byte verification across npm, Docusign
Artifactory, GitHub SaaS, GHES, and Homebrew.