[core] Upgrade the dependencies

[oliviertassinari]

Bonus, closes #16953

[mui-pr-bot]

Details of bundle changes.

Comparing: 7101bad...7413279

bundle	parsed diff	gzip diff	prev parsed	current parsed	prev gzip	current gzip
@material-ui/core	+0.05% 🔺	+0.09% 🔺	328,898	329,073	89,914	89,994
@material-ui/core/Paper	+0.23% 🔺	+0.23% 🔺	68,684	68,843	20,476	20,524
@material-ui/core/Paper.esm	+0.26% 🔺	+0.22% 🔺	62,058	62,217	19,206	19,249
@material-ui/core/Popper	0.00%	0.00%	28,468	28,468	10,177	10,177
@material-ui/core/Textarea	0.00%	0.00%	5,094	5,094	2,136	2,136
@material-ui/core/TrapFocus	0.00%	0.00%	3,834	3,834	1,614	1,614
@material-ui/core/styles/createMuiTheme	0.00%	0.00%	16,386	16,386	5,826	5,826
@material-ui/core/useMediaQuery	0.00%	0.00%	2,541	2,541	1,059	1,059
@material-ui/lab	+0.11% 🔺	+0.14% 🔺	152,999	153,172	46,659	46,726
@material-ui/styles	+0.31% 🔺	+0.32% 🔺	51,401	51,560	15,290	15,339
@material-ui/system	0.00%	-0.02%	15,658	15,658	4,361	4,360
Button	+0.20% 🔺	+0.20% 🔺	78,687	78,846	24,044	24,092
Modal	0.00%	+0.02% 🔺	14,346	14,346	5,011	5,012
Portal	0.00%	0.00%	2,907	2,907	1,318	1,318
Rating	+0.23% 🔺	+0.20% 🔺	70,047	70,206	21,881	21,925
Slider	+0.21% 🔺	+0.19% 🔺	74,362	74,521	23,056	23,100
colorManipulator	0.00%	0.00%	3,904	3,904	1,543	1,543
docs.landing	+2.68% 🔺	0.00%	51,846	53,237	13,780	13,780
docs.main	+1.37% 🔺	+1.28% 🔺	590,557	598,663	188,449	190,861
packages/material-ui/build/umd/material-ui.production.min.js	+0.07% 🔺	+0.11% 🔺	299,897	300,092	86,270	86,369

Generated by 🚫 dangerJS against 7413279

[merceyz]

I highly suggest only updating the jss related packages and letting dependabot take care of the rest

[merceyz]

👍 for specifying the version here, otherwise the benchmark results can differ depending on when yarn install was ran

[oliviertassinari]

@merceyz What would be the advantage? Is this about having x individual pull requests vs one? I find the granularity of dependabot interesting when batching everything doesn't work. I had a few occurrences of that in the past where I had to to the upgrade in dichotomy. dependabot would have helped.
So I find it interesting how the batch approach allows us to put the upgrade of the dependencies behind us, for some time.

[oliviertassinari]

The bundle size increase seems JSS related: https://bundlephobia.com/[email protected].

[merceyz]

What would be the advantage? Is this about having x individual pull requests vs one?

Easier to see what changed in the packages, and to see why stuff breaks.

So I find it interesting how the batch approach allows us to put the upgrade of the dependencies behind us, for some time.

dependabot is limited to 5 updates a week, turn off that limit and you can update everything at once (still seperate PRs)

[eps1lon]

dependabot is limited to 5 updates a week, turn off that limit and you can update everything at once (still seperate PRs)

Actually it's 10. It's only 5 because it still hasn't settled (there's a special note about this in the PR descriptions). We could bump it to let it settle but considering after two week olivier has already declared this experiment as failed I don't think there's a point to working with it anyway.

If we want to continue using it we can pump up the limit so that it can run on every dependency, settle on 10 and see if that is a good limit for weekly updates.

Biggest hurdle right now is the deduplication task. I would rather have it run on a schedule so that dependabot PRs are laser focused (i.e. just updating a single dependency). Deduplication is just about keeping node_modules size in check right now. The instances where duplicate packages are an issue are likely an issue with how we require some packages (e.g. declaring plugins by string and not require.resolve).

[merceyz]

Actually it's 10. It's only 5 because it still hasn't settled (there's a special note about this in the PR descriptions).

I'm aware ;)

Biggest hurdle right now is the deduplication task

Dependabot already does this for us, they shouldn't collide (Not saying it doesn't as I saw it collide in one PR).
It would be possible to update the task to use their implementation instead.
https://github.com/dependabot/dependabot-core/blob/b6105f7d55d79a99d65e13641956002f697223b2/npm_and_yarn/helpers/lib/yarn/fix-duplicates.js#L15

[oliviertassinari]

I think that dependabot is interesting no matter if we upgrade all the dependencies or not. The experiment seems to work so far. Dependabot delivers his promise, it works as we have configured it for. It's this nice weekly background job that help us keeping up to date with the dependencies.

[merceyz]

Another reason to let dependabot do it: it updates the package.json file so to resolve a conflict you only have to run yarn