How to maintain semver when consuming dependencies?

[claytonparnell]

We try to follow semantic versioning (https://github.com/aws/sagemaker-distribution?tab=readme-ov-file#versioning-strategy, https://semver.org/). However, there are some problems with this in the way we consume dependencies.

1. Any package we consume can just not follow semver, and there would be no way to detect it. This could introduce backward-incompatible changes. We do call this out in our Readme "it is important to note that Amazon SageMaker Distribution’s ability to follow semver guidelines is currently dependent on how its dependencies adhere to them"
2. We consume several (15 as of 1.5.2-cpu) packages with major version 0 e.g. 0.y.z. According to semver docs, these versions do not adhere to any semver specifications, and should not be considered stable (see https://semver.org/#spec-item-4). Currently these are being treated the same as any other major version.

It would be nice to have some strategy/tooling to at least try to enforce semver principles for our releases, so opening this issue to host discussion on this topic.