Replace Masterminds/semver with blang/semver

[stefanprodan]

The Masterminds semver is seriously flawed see fluxcd/flux#2729
In source controller we decided to use blang/semver for Git tags semver ranges.

[bigkevmcd]

I've had a look at this and I'm not sure that it would be an improvement https://play.golang.org/p/2ofl4YOXwdn

I don't think 1.1.0-alpha should be included in 1.0.x?

[squaremo]

I don't think 1.1.0-alpha should be included in 1.0.x?

Me neither. The spec doesn't talk about ranges or wildcards, but the path of least surprise would surely be to ignore prereleases unless allowed in the pattern; and in particular to ignore them given a wildcard.

Masterminds/semver/v3 has that behaviour for ranges: https://play.golang.org/p/U-v_bYmAiHQ. It also (now?) has a strict parsing mode that will error if the supplied string doesn't conform to the spec https://pkg.go.dev/github.com/Masterminds/semver/v3?tab=doc#StrictNewVersion (NB a leading v is invalid so would have to be stripped before use).

[bigkevmcd]

I agree, but one thing in favour of this change, is that it would be consistent with the https://github.com/fluxcd/source-controller

Probably better to be consistently doing the same (arguably wrong) thing?

It feels like there needs to be consensus on the desired behaviour, and whatever changes applied to get something consistent across the tooling?

[squaremo]

I posted fluxcd/source-controller#127 about including prereleases in ranges -- this is seriously broken behaviour.

[dholbach]

Hi @bigkevmcd - great to see you here. :-)

[squaremo]

Superseded by #38 .