fix(plugin): loosen the react peer to ~19.1.0 (#4100)

* fix(plugin): loosen the react peer to ~19.1.0

The plugin SDK pins its react peer to exactly 19.1.0, and that pin is
what a downstream `npm i -g @getpaseo/cli` resolves against. So every
user ends up with react 19.1.0 in their global node_modules, where
corporate dependency scanners flag it: the CVE-2025-55182 advisory range
covers 19.1.0 even though the vulnerability itself lives in
react-server-dom-webpack/-parcel/-turbopack, none of which the CLI
installs. The user is then left hand-patching node_modules or
uninstalling Paseo.

Widening the peer to ~19.1.0 lets a downstream install pick the latest
19.1.x patch (19.1.9 today) while this repo stays on 19.1.0, which the
root override still pins.

Keeping the repo itself on 19.1.0 is deliberate. react-native 0.81.5
embeds a 19.1.0 Paper renderer that hard-throws "Incompatible React
versions" on any exact mismatch, and it is reachable from Fabric builds
too: RendererImplementation.js requires the Paper shim unconditionally
in findNodeHandle, unstable_batchedUpdates, sendAccessibilityEvent and
three other entry points, and react-native-gesture-handler re-exports
findNodeHandle. Bumping the app's react is therefore not safe until
react-native moves.

The published CLI tree contains no react-native, so downstream installs
are not subject to that constraint.

Supersedes the earlier 19.1.5/19.1.9 version-bump approach on this
branch, which would have broken the mobile app.

* Update Nix dependency hash for plugin peer metadata

---------

Co-authored-by: Mohamed Boudra <boudra.moha@gmail.com>

nix/npm-deps.hash

@@ -1 +1 @@
-sha256-1MBzb+r/t92G9uR/jBuc3oNEfEloHeRg9uUgzSHS4UM=
+sha256-zpE2CbXKy0D4tsYdeBo7JiNBNxSnB1JlnS3PtCmXKiw=

package-lock.json

@@ -38715,7 +38715,7 @@
       "peerDependencies": {
         "@getpaseo/client": "0.7.2",
         "@getpaseo/protocol": "0.7.2",
-        "react": "19.1.0",
+        "react": "~19.1.0",
         "react-native": ">=0.81.5",
         "zod": "^4.4.3"
       },

packages/plugin/package.json

@@ -73,7 +73,7 @@
   "peerDependencies": {
     "@getpaseo/client": "0.7.2",
     "@getpaseo/protocol": "0.7.2",
-    "react": "19.1.0",
+    "react": "~19.1.0",
     "react-native": ">=0.81.5",
     "zod": "^4.4.3"
   },