chore: bump dev dependencies (eslint 10, vite 8, typescript 6, jsdom 29)

[JSv4]

Summary

Picks up the 17-package dev-dependencies group Dependabot proposed in #25, which was failing CI and had drifted out of mergeable state (conflicts with main after #28). docxodus is excluded here — main already carries 7.0.1 from #28/#29.

Package	From	To
@eslint/js	9.39.1	10.0.1
@vitejs/plugin-react	5.1.1	6.0.2
eslint	9.39.1	10.4.1
eslint-plugin-react-refresh	0.4.24	0.5.2
jsdom	27.2.0	29.1.1
typescript	5.9.3	6.0.3
vite	7.2.4	8.0.16
(+ transitive updates to @types/*, react, react-dom, vitest, etc. within existing ranges)

This closes #25 (superseded).

Why this needed source changes, not just version bumps

react-hooks/static-components (new in eslint-plugin-react-hooks@7.1.1, force-installed as an eslint 10 peer dependency): Toolbar and SettingsModal in DocumentViewer.tsx were defined as const Toolbar = () => (...) inside the component body and invoked as <Toolbar /> — a new component type created on every render, which resets any DOM/focus state in that subtree each time. Fixed by calling them as plain functions (renderToolbar() / renderSettingsModal()) instead of JSX elements — identical output, but no longer treated as a distinct component type.

react-hooks/set-state-in-effect (same plugin bump) flagged two effects:

• The worker-init effect: workerLoading is now derived (useWorker && isWorkerSupported() && !workerReady && !workerError) instead of tracked as separate state set synchronously in the effect. Bonus: this also fixes a pre-existing staleness bug where workerLoading could get stuck true if useWorker toggled off mid-flight.
• The auto-convert effect calling convert(file): isConverting is genuinely imperative state here and can't be cleanly derived without breaking controlled-html mode (a parent can keep html non-null across a reconvert). This one is suppressed with eslint-disable-next-line and a comment explaining why — verified there's no behavior-preserving derivation, and confirmed a microtask-wrapper "fix" only fools the lint pattern-matcher without changing actual render timing, so rejected that in favor of an honest suppression.

TypeScript 6.0 requires tsconfig.lib.json's rootDir to be explicit rather than inferred from outDir + include. Added "rootDir": "src".

Verification

• npm test — 33/33 passing
• npm run lint — clean
• npm run build — lib + demo build succeed
• Fresh npm install resolves with 0 vulnerabilities (down from 13 on the old toolchain)
• Smoke-tested in the browser: worker init, document conversion, toolbar, and settings modal (open/toggle/close/reconvert) all work with zero console errors