Note that we're using 4.2.7.SP3, not SP2. The SP2 tag was part of a botched upgrade back on EAP 6.2.0.
Also note that we'll be tagging the internal git repo only, not upstream ORM. The 2 fixes going into CP03 were released under ORM 4.2.9.Final upstream, but the delta between 4.2.7 and 4.2.9 is too large to simply use that for CP03.