Constraint check fails for .0 patch prereleases

[johanneskra]

I think I have found a bug in the constraint check in FindMatchingVersion() for .0 patch prereleases. It seems to be caused by the dependency blang/semver, that's why I already created an issue in that repository: blang/semver#78

I upgraded to the newest dependency version, but that did not help:

//go.mod
replace github.com/blang/semver v3.5.1+incompatible => github.com/blang/semver/v4 v4.0.0

An example of the bug can be found in the Go Playground https://go.dev/play/p/ZpyJYDC4PD2 or in the main.go:

main.go (expand)

package main

import (
  "fmt"

  "github.com/cloudfoundry/libbuildpack"
)

func main() {
  constraint := "0.49.x"

  versions := [][]string{
  	{"0.49.0-alpha"},
  	{"0.49.1-alpha"},
  	{"0.49.0"},
  	{"0.49.1"},
  }

  for _, ver := range versions {
  	if found, err := libbuildpack.FindMatchingVersion(constraint, ver); err != nil {
  		fmt.Printf("❌ constraint %v did not match for %v: %v \n\n", constraint, ver, err)
  	} else {
  		fmt.Printf("✅ constraint %v did match for %v: %#v \n\n", constraint, ver, found)
  	}
  }
}

The output of this is:

❌ constraint 0.49.x did not match for [0.49.0-alpha]: no match found for 0.49.x in [0.49.0-alpha] 

✅ constraint 0.49.x did match for [0.49.1-alpha]: "0.49.1-alpha" 

✅ constraint 0.49.x did match for [0.49.0]: "0.49.0" 

✅ constraint 0.49.x did match for [0.49.1]: "0.49.1" 

According to this SemVer check, that's incorrect: https://jubianchi.github.io/semver-check/#/0.49.x/0.49.0-alpha.

This is a problem, because FindMatchingVersion() is transitively called here in InstallDependency(). This makes it impossible for me to install prerelease versions that have a patch version of 0, such as:

• 0.49.0-alpha
• 0.49.0-sap-0.0.1, etc.

[ForestEckhardt]

I have done a little investigation I think that it would make the most sense if we modified the warnNewerPatch to be more permissive is the pre-release version that it warns you about. That way you can specify the .0 patch pre-release versions and only get a warning.