Bump Vendir to v0.45.3 & Update root directory imports from k14s/semver to carvel-dev/semver.

[sameerforge]

What this PR does / why we need it:

• Bump carvel.dev/vendir dependency to v0.45.3
• Bump Semver to latest.
• Swapped root directory imports from k14s/semver to carvel-dev/semver.
• Removed legacy k14s/semver files from root vendor directories.

Changes :

Which issue(s) this PR fixes:

Fixes #

Does this PR introduce a user-facing change?

Additional Notes for your reviewer:

Review Checklist:

• Follows the developer guidelines
• Relevant tests are added or updated
• Relevant docs in this repo added or updated
• Relevant carvel.dev docs added or updated in a separate PR and there's
  a link to that PR
• Code is at least as readable and maintainable as it was before this
  change

Additional documentation e.g., Proposal, usage docs, etc.:

[Copilot]

Pull request overview

Bumps the root module’s carvel.dev/vendir dependency to v0.45.3 and refreshes the corresponding vendored dependency set, including an updated snapshot of github.com/carvel-dev/semver/v4 that changes version comparison behavior.

Changes:

• Update carvel.dev/vendir from v0.45.2 → v0.45.3 in the root go.mod / go.sum.
• Refresh root vendor/modules.txt to reflect updated vendored module versions.
• Update vendored github.com/carvel-dev/semver/v4 implementation (notably comparison/sorting logic).

Reviewed changes

Copilot reviewed 1 out of 4 changed files in this pull request and generated 1 comment.

File	Description
go.mod	Bumps root module vendir + semver pseudo-version requirements.
go.sum	Updates root module checksums for the vendir + semver bumps.
vendor/modules.txt	Refreshes root vendoring metadata to reflect new module versions.
vendor/github.com/carvel-dev/semver/v4/semver.go	Pulls in updated semver implementation, including new “natural sort”/special-cased compare behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Updates kapp-controller’s vendored dependencies by bumping carvel.dev/vendir to v0.45.3, which also refreshes the vendored github.com/carvel-dev/semver/v4 snapshot used by vendir for version parsing/selection.

Changes:

• Bump carvel.dev/vendir from v0.45.2 → v0.45.3 in both root and cli/ Go modules.
• Refresh corresponding go.sum entries and vendored module metadata (vendor/modules.txt, cli/vendor/modules.txt).
• Update vendored github.com/carvel-dev/semver/v4 implementation in both vendor trees.

Reviewed changes

Copilot reviewed 2 out of 8 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
vendor/modules.txt	Updates vendir + semver module versions recorded in vendoring metadata.
vendor/github.com/carvel-dev/semver/v4/semver.go	Pulls in updated semver comparison implementation used by vendir’s version sorting.
go.sum	Updates checksums for vendir and updated transitive deps.
go.mod	Bumps vendir and semver pseudo-version in the root module.
cli/vendor/modules.txt	Mirrors vendir + semver vendoring metadata update for the cli/ module.
cli/vendor/github.com/carvel-dev/semver/v4/semver.go	Mirrors updated semver implementation in cli/’s vendor tree.
cli/go.sum	Updates checksums for the cli/ module’s vendir dependency.
cli/go.mod	Bumps vendir and semver pseudo-version in the cli/ module.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[praveenrewar]

PR looks good to me. If the intention is to bump vendir for fixing any CVEs, then I hope you will also bump kbld to 0.47.3 since kbld also uses vendir.

[sameerforge]

PR looks good to me. If the intention is to bump vendir for fixing any CVEs, then I hope you will also bump kbld to 0.47.3 since kbld also uses vendir.

Yes, vendir is bumped in KBLD. And v0.47.3 release has been published https://github.com/carvel-dev/kbld/releases/tag/v0.47.3

[Copilot]

Pull request overview

Updates kapp-controller’s vendored Go dependencies to pick up carvel.dev/vendir v0.45.3, including the associated semver library snapshot and regenerated vendored module metadata for both the root module and the nested cli/ module.

Changes:

• Bump carvel.dev/vendir from v0.45.2 to v0.45.3 (root + cli/ modules) and refresh go.sum / vendoring metadata.
• Switch semver imports from github.com/k14s/semver/v4 to github.com/carvel-dev/semver/v4 and remove the vendored k14s/semver tree.
• Refresh vendored transitive dependencies (notably github.com/stretchr/testify and golang.org/x/sys) under cli/vendor/.

Reviewed changes

Copilot reviewed 13 out of 66 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
vendor/modules.txt	Updates vendored module list for root module (vendir + semver).
vendor/github.com/k14s/semver/v4/sql.go	Removes vendored legacy semver implementation.
vendor/github.com/k14s/semver/v4/sort.go	Removes vendored legacy semver implementation.
vendor/github.com/k14s/semver/v4/semver.go	Removes vendored legacy semver implementation.
vendor/github.com/k14s/semver/v4/range.go	Removes vendored legacy semver implementation.
vendor/github.com/k14s/semver/v4/json.go	Removes vendored legacy semver implementation.
vendor/github.com/k14s/semver/v4/LICENSE	Removes vendored legacy semver license (no longer vendored).
vendor/github.com/carvel-dev/semver/v4/semver.go	Updates vendored semver behavior and helpers.
pkg/packageinstall/packageinstall_test.go	Updates semver import path in tests.
pkg/packageinstall/packageinstall_downgrade_test.go	Updates semver import path in tests.
pkg/packageinstall/packageinstall_deletion_test.go	Updates semver import path in tests.
pkg/packageinstall/packageinstall.go	Updates semver import path in controller code.
pkg/componentinfo/component_info.go	Updates semver import path used for version parsing.
pkg/app/app_test.go	Updates semver import path in tests.
pkg/app/app_template_test.go	Updates semver import path in tests.
pkg/app/app_reconcile_test.go	Updates semver import path in tests.
pkg/app/app.go	Updates semver import path in app logic.
pkg/apiserver/apiserver.go	Updates semver import path in apiserver.
pkg/apiserver/apis/datapackaging/validation/validations.go	Updates semver import path in validations.
go.sum	Updates checksums for vendir + semver dependency bump.
go.mod	Bumps vendir and switches semver dependency to carvel-dev snapshot.
cli/vendor/modules.txt	Updates CLI vendored module list (vendir/semver/testify/xsys) and records replace.
cli/vendor/golang.org/x/sys/unix/ztypes_netbsd_arm.go	Updates vendored x/sys NetBSD types.
cli/vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.go	Updates vendored x/sys Linux ioctl constants.
cli/vendor/golang.org/x/sys/unix/zerrors_linux_s390x.go	Updates vendored x/sys Linux ioctl constants.
cli/vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.go	Updates vendored x/sys Linux ioctl constants.
cli/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.go	Updates vendored x/sys Linux ioctl constants.
cli/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.go	Updates vendored x/sys Linux ioctl constants.
cli/vendor/golang.org/x/sys/unix/zerrors_linux_ppc.go	Updates vendored x/sys Linux ioctl constants.
cli/vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.go	Updates vendored x/sys Linux ioctl constants.
cli/vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.go	Updates vendored x/sys Linux ioctl constants.
cli/vendor/golang.org/x/sys/unix/zerrors_linux_mips64.go	Updates vendored x/sys Linux ioctl constants.
cli/vendor/golang.org/x/sys/unix/zerrors_linux_mips.go	Updates vendored x/sys Linux ioctl constants.
cli/vendor/golang.org/x/sys/unix/zerrors_linux_loong64.go	Updates vendored x/sys Linux ioctl constants.
cli/vendor/golang.org/x/sys/unix/zerrors_linux_arm64.go	Updates vendored x/sys Linux ioctl constants.
cli/vendor/golang.org/x/sys/unix/zerrors_linux_arm.go	Updates vendored x/sys Linux ioctl constants.
cli/vendor/golang.org/x/sys/unix/zerrors_linux_amd64.go	Updates vendored x/sys Linux ioctl constants.
cli/vendor/golang.org/x/sys/unix/zerrors_linux_386.go	Updates vendored x/sys Linux ioctl constants.
cli/vendor/golang.org/x/sys/unix/zerrors_linux.go	Updates vendored x/sys Linux ioctl constants.
cli/vendor/golang.org/x/sys/unix/mkerrors.sh	Updates vendored x/sys generator inputs/filters (MEI ioctls).
cli/vendor/github.com/stretchr/testify/require/require_forward.go	Updates vendored testify require wrappers/docs.
cli/vendor/github.com/stretchr/testify/require/require.go	Updates vendored testify require implementation/docs.
cli/vendor/github.com/stretchr/testify/require/doc.go	Updates vendored testify require package docs.
cli/vendor/github.com/stretchr/testify/assert/yaml/yaml_fail.go	Updates vendored testify yaml build constraints.
cli/vendor/github.com/stretchr/testify/assert/yaml/yaml_default.go	Updates vendored testify yaml build constraints.
cli/vendor/github.com/stretchr/testify/assert/yaml/yaml_custom.go	Updates vendored testify yaml build constraints.
cli/vendor/github.com/stretchr/testify/assert/http_assertions.go	Updates vendored testify error formatting.
cli/vendor/github.com/stretchr/testify/assert/doc.go	Updates vendored testify assert docs.
cli/vendor/github.com/stretchr/testify/assert/assertions.go	Updates vendored testify core assertions (incl. ordering/empty/type helpers).
cli/vendor/github.com/stretchr/testify/assert/assertion_order.go	Updates vendored testify ordering error messages.
cli/vendor/github.com/stretchr/testify/assert/assertion_forward.go	Updates vendored testify assertion forwarders/docs.
cli/vendor/github.com/stretchr/testify/assert/assertion_format.go	Updates vendored testify formatted assertion wrappers/docs.
cli/vendor/github.com/stretchr/testify/assert/assertion_compare.go	Updates vendored testify compare assertion messages/logic.
cli/vendor/github.com/k14s/semver/v4/sql.go	Removes vendored legacy semver implementation from CLI vendor.
cli/vendor/github.com/k14s/semver/v4/sort.go	Removes vendored legacy semver implementation from CLI vendor.
cli/vendor/github.com/k14s/semver/v4/semver.go	Removes vendored legacy semver implementation from CLI vendor.
cli/vendor/github.com/k14s/semver/v4/range.go	Removes vendored legacy semver implementation from CLI vendor.
cli/vendor/github.com/k14s/semver/v4/json.go	Removes vendored legacy semver implementation from CLI vendor.
cli/vendor/github.com/k14s/semver/v4/LICENSE	Removes vendored legacy semver license from CLI vendor.
cli/vendor/github.com/carvel-dev/semver/v4/semver.go	Updates vendored semver in CLI vendor tree.
cli/vendor/carvel.dev/kapp-controller/pkg/packageinstall/packageinstall.go	Updates vendored kapp-controller code used by CLI to new semver import.
cli/vendor/carvel.dev/kapp-controller/pkg/config/config.go	Syncs vendored kapp-controller config code.
cli/vendor/carvel.dev/kapp-controller/pkg/componentinfo/component_info.go	Updates vendored kapp-controller componentinfo semver import.
cli/vendor/carvel.dev/kapp-controller/pkg/app/app.go	Updates vendored kapp-controller app semver import.
cli/go.sum	Updates CLI module checksums for dependency bump(s).
cli/go.mod	Bumps vendir + semver snapshot, updates testify/xsys, adds replace to local root module.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Updates kapp-controller’s vendored dependencies to pick up the latest vendir and move semver usage off the legacy github.com/k14s/semver module.

Changes:

• Bump carvel.dev/vendir from v0.45.2 to v0.45.3 (root + cli/ module) and update vendored manifests.
• Switch in-repo Go imports from github.com/k14s/semver/v4 to github.com/carvel-dev/semver/v4.
• Remove the legacy vendored github.com/k14s/semver/v4 directory from the root vendor/.

Reviewed changes

Copilot reviewed 13 out of 25 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
vendor/modules.txt	Updates vendored module list for root module (vendir + semver changes reflected).
vendor/github.com/k14s/semver/v4/sql.go	Removes legacy vendored k14s/semver implementation from root vendor.
vendor/github.com/k14s/semver/v4/sort.go	Removes legacy vendored k14s/semver implementation from root vendor.
vendor/github.com/k14s/semver/v4/semver.go	Removes legacy vendored k14s/semver implementation from root vendor.
vendor/github.com/k14s/semver/v4/range.go	Removes legacy vendored k14s/semver implementation from root vendor.
vendor/github.com/k14s/semver/v4/json.go	Removes legacy vendored k14s/semver implementation from root vendor.
vendor/github.com/k14s/semver/v4/LICENSE	Removes legacy vendored k14s/semver license file from root vendor.
vendor/github.com/carvel-dev/semver/v4/semver.go	Updates vendored carvel-dev/semver implementation to the bumped version.
pkg/packageinstall/packageinstall_test.go	Updates tests to import github.com/carvel-dev/semver/v4.
pkg/packageinstall/packageinstall_downgrade_test.go	Updates tests to import github.com/carvel-dev/semver/v4.
pkg/packageinstall/packageinstall_deletion_test.go	Updates tests to import github.com/carvel-dev/semver/v4.
pkg/packageinstall/packageinstall.go	Switches semver import to github.com/carvel-dev/semver/v4.
pkg/componentinfo/component_info.go	Switches semver import to github.com/carvel-dev/semver/v4.
pkg/app/app_test.go	Updates tests to import github.com/carvel-dev/semver/v4.
pkg/app/app_template_test.go	Updates tests to import github.com/carvel-dev/semver/v4.
pkg/app/app_reconcile_test.go	Updates tests to import github.com/carvel-dev/semver/v4.
pkg/app/app.go	Switches semver import to github.com/carvel-dev/semver/v4.
pkg/apiserver/apiserver.go	Switches semver import to github.com/carvel-dev/semver/v4.
pkg/apiserver/apis/datapackaging/validation/validations.go	Switches semver import alias to github.com/carvel-dev/semver/v4.
go.sum	Updates root checksums for vendir + semver and removes legacy k14s/semver sums.
go.mod	Bumps vendir + semver and removes k14s/semver requirement in the root module.
cli/vendor/modules.txt	Updates vendored module list for the cli/ module (vendir + semver versions).
cli/vendor/github.com/carvel-dev/semver/v4/semver.go	Updates vendored carvel-dev/semver implementation for the cli/ module.
cli/go.sum	Updates cli/ checksums for vendir + semver.
cli/go.mod	Bumps cli/ module vendir + semver versions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sameerforge]

@joaopapereira Please review the PR.