fix(deps): update semver to v3

go.mod

@@ -5,7 +5,7 @@ go 1.25.5
 require (
 	dario.cat/mergo v1.0.2
 	github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6
-	github.com/Masterminds/semver v1.5.0
+	github.com/Masterminds/semver/v3 v3.4.0
 	github.com/crossplane/crossplane/apis/v2 v2.0.0-20260407152912-8f8e265fb638
 	github.com/evanphx/json-patch v5.9.11+incompatible
 	github.com/go-logr/logr v1.4.3

go.sum

@@ -64,8 +64,6 @@ github.com/Azure/go-autorest/tracing v0.6.1 h1:YUMSrC/CeD1ZnnXcNYU4a/fzsO35u2Fsf
 github.com/Azure/go-autorest/tracing v0.6.1/go.mod h1:/3EgjbsjraOqiicERAeu3m7/z0x1TzjQGAwDrJrXGkc=
 github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 h1:XRzhVemXdgvJqCH0sFfrBUTnUJSBrBf7++ypk+twtRs=
 github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk=
-github.com/Masterminds/semver v1.5.0 h1:H65muMkzWKEuNDnfl9d70GUjFniHKHRbFPGBuZ3QEww=
-github.com/Masterminds/semver v1.5.0/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
 github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
 github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/alessio/shellescape v1.4.1 h1:V7yhSDDn8LP4lc4jS8pFkt0zCnzVJlG5JXy9BVKJUX0=

gomod2nix.toml

@@ -40,9 +40,9 @@ schema = 3
   [mod."github.com/Azure/go-autorest/tracing"]
     version = "v0.6.1"
     hash = "sha256-nstDZC8Btx78yzqIR4clfu+R93rebUOZalEW1ZaQfIY="
-  [mod."github.com/Masterminds/semver"]
-    version = "v1.5.0"
-    hash = "sha256-3fEInOXFdzCiGdDZ1s9otEes7VXiL8Q1RVB3zXRPJsQ="
+  [mod."github.com/Masterminds/semver/v3"]
+    version = "v3.4.0"
+    hash = "sha256-75kRraVwYVjYLWZvuSlts4Iu28Eh3SpiF0GHc7vCYHI="
   [mod."github.com/antlr4-go/antlr/v4"]
     version = "v4.13.1"
     hash = "sha256-beAuxHNRUuhzcSJUh/8ztVf1zCUiaT72fg2Jvx0AuNQ="

pkg/version/fake/mocks.go

@@ -18,7 +18,7 @@ limitations under the License.
 package fake
 
 import (
-	"github.com/Masterminds/semver"
+	"github.com/Masterminds/semver/v3"
 
 	"github.com/crossplane/crossplane-runtime/v2/pkg/version"
 )

pkg/version/version.go

@@ -18,7 +18,7 @@ limitations under the License.
 package version
 
 import (
-	"github.com/Masterminds/semver"
+	"github.com/Masterminds/semver/v3"
 )
 
 var version string

pkg/version/version_test.go

@@ -67,7 +67,7 @@ func TestInRange(t *testing.T) {
 				version: "v0a.13.0",
 			},
 			want: want{
-				err: errors.New("Invalid Semantic Version"),
+				err: errors.New("invalid semantic version"),
 			},
 		},
 		"InvalidRange": {
@@ -80,6 +80,36 @@ func TestInRange(t *testing.T) {
 				err: errors.New("improper constraint: >a2"),
 			},
 		},
+		"ValidSpaceSeparatedRange": {
+			reason: "Should return true if version is within a valid space separated ranged constraint",
+			args: args{
+				version: "v2.13.0",
+				r:       ">=v2.0.0 <v5.0.0",
+			},
+			want: want{
+				is: true,
+			},
+		},
+		"ValidCommaSeparatedRangedConstraint": {
+			reason: "Should return true if version is within a valid comma-separated ranged constraint",
+			args: args{
+				version: "v2.13.0",
+				r:       ">=v2.0.0,<v5.0.0",
+			},
+			want: want{
+				is: true,
+			},
+		},
+		"InvalidSpaceSeparatedRange": {
+			reason: "Should return error if the ranged constraint is invalid",
+			args: args{
+				version: "v1.13.0",
+				r:       ">=v2.0.0 >v5a.0.0",
+			},
+			want: want{
+				err: errors.New("improper constraint: >=v2.0.0 >v5a.0.0"),
+			},
+		},
 	}
 
 	for name, tc := range cases {

pkg/xpkg/client.go

@@ -24,7 +24,7 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/Masterminds/semver"
+	"github.com/Masterminds/semver/v3"
 	pkgmetav1 "github.com/crossplane/crossplane/apis/v2/pkg/meta/v1"
 	ociname "github.com/google/go-containerregistry/pkg/name"
 	v1 "github.com/google/go-containerregistry/pkg/v1"

pkg/xpkg/lint.go

@@ -17,7 +17,7 @@ limitations under the License.
 package xpkg
 
 import (
-	"github.com/Masterminds/semver"
+	"github.com/Masterminds/semver/v3"
 	v1 "github.com/crossplane/crossplane/apis/v2/apiextensions/v1"
 	extv1alpha1 "github.com/crossplane/crossplane/apis/v2/apiextensions/v1alpha1"
 	v2 "github.com/crossplane/crossplane/apis/v2/apiextensions/v2"