Find a solution that will make sure the versions of our dependencies are compatible without unncessarily updating patch versions

[sofisl]

see #932

basically, for these reasons, I don't want to use syncpack anymore: #926 (comment)

But in general I still do want a solution that figures out if we have incompatible major versions within a library. Maybe this will become easier if/when we decide this monorepo should live at HEAD (rather than pulling from npm).

Some options: https://github.com/QuiiBz/sherif

[sofisl]

Some examples of changes I didn't want:

diff --git a/packages/retry-request/package.json b/packages/retry-request/package.json
index 0925b3c43..a2f41becd 100644
--- a/packages/retry-request/package.json
+++ b/packages/retry-request/package.json
@@ -36,7 +36,7 @@
   },
   "dependencies": {
     "extend": "^3.0.2",
-    "teeny-request": "^10.0.0"
+    "teeny-request": "10.1.1"
   },

jetski said this was b/c syncpack linked the local version, but we pull from npm, not from the monorepo

   "license": "Apache-2.0",
   "dependencies": {
-    "google-auth-library": "^10.0.0",
+    "google-auth-library": "10.6.1",
     "puppeteer": "^24.0.0"
   }
 }

this removes the ^, again b/c of the monorepo stuff

diff --git a/packages/gcp-metadata/package.json b/packages/gcp-metadata/package.json
index 556f71700..1406d14c5 100644
--- a/packages/gcp-metadata/package.json
+++ b/packages/gcp-metadata/package.json
@@ -42,7 +42,7 @@
   "author": "Google LLC",
   "license": "Apache-2.0",
   "dependencies": {
-    "gaxios": "7.1.3",
+    "gaxios": "7.1.4",
     "google-logging-utils": "1.1.3",
     "json-bigint": "^1.0.0"
   },

this is a good change, but it should be its own PR (from renovatebot), not hidden in a bunch of syncpack changes

diff --git a/packages/gax/test/test-application/package.json b/packages/gax/test/test-applicat
ion/package.json
index 6af31e90d..aaecf6821 100644
--- a/packages/gax/test/test-application/package.json
+++ b/packages/gax/test/test-application/package.json
@@ -24,9 +24,9 @@
     "typescript": "^5.1.6"
   },
   "dependencies": {
-    "@grpc/grpc-js": "~1.6.0",
+    "@grpc/grpc-js": "^1.12.6",
     "google-gax": "file:./google-gax.tgz",
-    "protobufjs": "^7.0.0",
+    "protobufjs": "^7.5.4",
     "pumpify": "^2.0.1",
     "showcase-echo-client": "./showcase-echo-client.tgz",
     "showcase-server": "./showcase-server.tgz"

tilde is changed to carrot

--- a/packages/gax/package.json
+++ b/packages/gax/package.json
@@ -13,7 +13,7 @@
     "@grpc/grpc-js": "^1.12.6",
     "@grpc/proto-loader": "^0.8.0",
     "duplexify": "^4.1.3",
-    "google-auth-library": "10.5.0",
+    "google-auth-library": "10.6.1",
     "google-logging-utils": "1.1.3",
     "node-fetch": "^3.3.2",
     "object-hash": "^3.0.0",

again, this should be its own PR