We currently use github.com/hashicorp/go-version to represent versions throughout the project. There are many limitations and unexpected behavior that that this project contains that warrant a move away from its use.

Issues

No way to construct a new value without also returning an error.

If you want to create a new version.Version you can only do so by passing a string that is parsed with version.NewVersion. This means an error type is always returned with the parsed version. If you know the version is valid (i.e. a static value in a test), you should be able to create a version directly

Comparisons are not evaluated according to semantic conventions

We use version.Constraints to match package versioning. However, github.com/hashicorp/go-version does not evaluate these as specified by semantic versioning.

• Version v1.0.2-alpha.0 should be greater than v1.0.1 but version.NewConstraint(...).Check returns false hashicorp/go-version#130
• Prerelease constraint handling hashicorp/go-version#36

The package takes its own approach to handling prereleases.

This means if we add a package constraint like > 1.34.0 and use a package with a version like "1.34.1-0.20250205150531-85fab8be9320" it will evaluate to false even though according to semantic versioning this should be true

Version is not comparable

The Version type is defined as such:

// Version represents a single version.
type Version struct {
	metadata string
	pre      string
	segments []int64
	si       int
	original string
}

Based on the way the segments field is defined, this type is not comparable.

An Equal method is provided, but it would be more idiomatic if we could compare equality with the = Go operator.

Also, this mean the Version cannot be used directly as a map key. This results in us having to manually make the parts comparable:

The version package name sits on a useful variable name

Commonly using version for a variable name will be descriptive of what we are trying to hold. However, this will conflict with the package name.

Code health

Over the last 11 years there have been 73 commits: https://github.com/hashicorp/go-version/graphs/contributors

There are 23 open Pull Requests (some > 10 years old): https://github.com/hashicorp/go-version/pulls

There are 18 open issues and 30 closed issues: https://github.com/hashicorp/go-version/issues

There are 8 releases: https://github.com/hashicorp/go-version/releases

Licensing

github.com/hashicorp/go-version is licensed under the Mozilla Public License, version 2.0. This is a weak copyleft license that prohibits trademark use, and requires source disclosure, license and copyright notice, and same license inheritance.

This is not a blocking issue as we are complying with all the terms currently, however there are more permissively licensed projects we could consider.

Proposal

Switch to using github.com/Masterminds/semver/v3

• versions can be constructed directly without needed to handle an error: https://pkg.go.dev/github.com/Masterminds/semver/v3#New
• the Version type is comparable
• comparison is done based on semantic versioning: https://pkg.go.dev/github.com/Masterminds/semver/v3#hdr-Basic_Comparisons
• the package name is not version, it is semver
• code health
  • 157 commits over the last 10 years
  • 11 open PRs (oldest 3 years old)
  • 13 opne issues, 84 closed issues
  • 22 releases
• Licensed under the MIT License which is a permissive license with conditions only requiring preservation of copyright and license notices.

Auditing the package, there appears to be a 100% feature overlap with how we currently use github.com/hashicorp/go-version

• There is a Version type that represents Go versions
• The Version type supports comparison
• There is a Constraint type that supports matching versions
• Supports sorting versions.
• Supports JSON and other text marshaling
• Supports Go >= 1.21

Additionally ...

• the Version type can be used as a map key given its comparability.
• wildcard validation is supported.
• has no dependencies other than the Go standard library