Update client deps

[CraigMacomber]

Description

Update client dependencies, holding back socket.io-client to avoid socketio/socket.io#5202.

Makes type tests target ~ version, to avoid duplicating previous package versions:
pnpm exec flub typetests -g client --exact "~2.3.0"

Reviewer Guidance

The review process is outlined on this wiki page.

[Abe27342]

looks mostly good, but there are a number of FF packages in pnpm-lock on version 2.3.0 as well as 2.3.1 (@fluidframework/tree is one such package). Even with pnpm's dep tree structure, seems like that could cause some strange issues.

[tylerbutler]

Thanks for doing this! It would be nice to also update the package.json files eventually too, but not critical. Maybe we need to consider some per-release maintenance tasks that we do regularly.

[CraigMacomber]

Thanks for doing this! It would be nice to also update the package.json files eventually too, but not critical. Maybe we need to consider some per-release maintenance tasks that we do regularly.

Updating the minimum supported version in our package.json files to remove support for older versions of packages seems like it could be a breaking change for prod deps in some cases, so in general I think we should probably leave them alone. Updating them for dev deps would be ok though.

[tylerbutler]

looks mostly good, but there are a number of FF packages in pnpm-lock on version 2.3.0 as well as 2.3.1 (@fluidframework/tree is one such package). Even with pnpm's dep tree structure, seems like that could cause some strange issues.

@CraigMacomber flub modify lockfile that @alexvy86 wrote might be useful: https://github.com/microsoft/FluidFramework/blob/main/build-tools/packages/build-cli/docs/modify.md#flub-modify-lockfile

[CraigMacomber]

looks mostly good, but there are a number of FF packages in pnpm-lock on version 2.3.0 as well as 2.3.1 (@fluidframework/tree is one such package). Even with pnpm's dep tree structure, seems like that could cause some strange issues.

I think this is expected? Our type tests test against the previous minor's .0 release, and those will pull in patched versions of their deps when updating, resulting in this duplication for all packages which have type tests and are also depended on by a package with type tests, and have been patched. If we don't want this behavior, our type tests should probably use ~ versions.

[CraigMacomber]

I went ahead and made the type tests target ~ versions to avoid the duplication since it was easy. If we like that we can update our type test tooling to prefer that format by default when updating their package versions.

[msfluid-bot]

⯆ @fluid-example/bundle-size-tests: -2.5 KB

Metric Name	Baseline Size	Compare Size	Size Diff
aqueduct.js	463.2 KB	461.91 KB	⯆ -1.29 KB
azureClient.js	558.69 KB	558.94 KB	⯅ +254 Bytes
connectionState.js	680 Bytes	680 Bytes	■ No change
containerRuntime.js	261.33 KB	261.35 KB	⯅ +18 Bytes
fluidFramework.js	405.32 KB	405.29 KB	⯆ -29 Bytes
loader.js	134.17 KB	134.16 KB	⯆ -14 Bytes
map.js	42.43 KB	42.43 KB	■ No change
matrix.js	148.83 KB	148.43 KB	⯆ -408 Bytes
odspClient.js	525.84 KB	525.9 KB	⯅ +62 Bytes
odspDriver.js	97.8 KB	97.82 KB	⯅ +19 Bytes
odspPrefetchSnapshot.js	42.76 KB	42.78 KB	⯅ +14 Bytes
sharedString.js	165.91 KB	164.59 KB	⯆ -1.32 KB
sharedTree.js	395.78 KB	395.75 KB	⯆ -36 Bytes
Total Size	3.32 MB	3.31 MB	⯆ -2.5 KB

---

Baseline commit: 9c58bf3

Generated by 🚫 dangerJS against 8ed6b1c