chore(deps): bump @types/react from 17.0.93 to 19.3.0

[dependabot]

Bumps @types/react from 17.0.93 to 19.3.0.

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Summary

Update development React type dependencies. The React 17 legacy runtime remains supported by the actual packed React 17 consumer checked during this review.

Related issue

N/A: dependency maintenance reviewed at exact SHA ef6b7b098767095fc35ab782b9ef3b0a46a81f65; no unrelated issue is closed.

Change classification

• User-visible UI or rendering change
• Non-visual change
• File-format or renderer behavior
• Public API, package, Worker, WASM, or deployment-path change

Verification

Actual local review on Node 24.20.0 and pnpm 11.0.9, at the unchanged SHA above:

Check	Result
pnpm build	Pass
pnpm type-check	Pass
pnpm test	Pass
pnpm exec vitest run --reporter=dot	Pass: 30 files, 258 tests; 1 existing skip remains a skip
pnpm audit --json --registry=https://registry.npmjs.org	Fail: 19 current shared-base advisory records, including 1 critical and 9 high; these are not introduced by this scoped update

The actual React 17 cold browser controls passed in Chromium and WebKit with a decoded 120 × 50 SVG and no browser errors; no React 17 runtime regression was reproduced.

Current shared security findings are handled in verified draft #337. This PR is not approved for landing on its unchanged vulnerable base. No merge or npm publication occurred.

Sample / fixture evidence

• Public repository fixture/source: https://github.com/flyfish-dev/file-viewer/blob/ef6b7b098767095fc35ab782b9ef3b0a46a81f65/packages/components/react-legacy/src/index.ts
• Complete local commands and focused native/cold evidence are retained for this exact SHA; original attachments and screenshots are not committed.

Visual evidence

N/A: this dependency-only update makes no intentional UI change; native rendering controls are described above with their precise scope.

Risk and compatibility

• Affected packages/formats: Development React type declarations, including the legacy component build.
• Compatibility or migration risk: Actual cold React 17.0.2/@types-react 17.0.90/@types-react-dom17.0.26 passed strict TS 6.0.3 Bundler checks with skipLibCheck=false, Vite 7.3.6 production build and Chromium/WebKit SVG rendering. NodeNext declaration compatibility is not claimed; its existing extension issue predates this PR. Current shared-base security audit still fails and must be resolved before landing.
• Rollback: revert this dependency update and its lockfile changes as one unit; preserve the independent security fixes.

Checklist

• Existing focused coverage and the actual checks above exercised this change; no duplicate source-only test was added for a metadata repair.
• Documentation scope is explained above; this change does not announce unverified API or rendering behavior.
• Actual Worker/cold consumer checks are identified above when relevant; development-only changes do not change deployment URLs or assets.
• No secrets, private samples, generated caches or unrelated source changes were committed during this review.