chore: update react-dropzone dependency

[gjulivan]

Pull request type

---

Description

[github-actions]

AI Code Review

⚠️ Approved with suggestions — low-severity items only, safe to merge

---

What was reviewed

File	Change
packages/pluggableWidgets/file-uploader-web/package.json	Bumps react-dropzone from ^14.2.3 to ^20.1.1
packages/pluggableWidgets/rich-text-web/package.json	Bumps react-dropzone from previous to ^20.1.1
packages/pluggableWidgets/file-uploader-web/CHANGELOG.md	Adds changelog entry for the dependency upgrade
packages/pluggableWidgets/rich-text-web/CHANGELOG.md	Adds changelog entry for the dependency upgrade
patches/react-dropzone.patch	Adds a patch that tightens the isExt regex in react-dropzone

Skipped (out of scope): pnpm-lock.yaml

---

Findings

⚠️ Low — Patch registered without version pin

File: package.json line 85
Note: All other patchedDependencies entries are pinned to an exact version (e.g. "mobx@6.12.3"), but the react-dropzone patch is registered as "react-dropzone" without a version. This means the patch will be applied to any future version of the package, which could silently fail or produce incorrect results if the patched source line changes in a future upgrade. Pinning it to "react-dropzone@20.1.1" (to match the installed version) keeps the behaviour consistent with all other entries and makes it obvious if the patch needs refreshing after the next upgrade.

// package.json – pnpm.patchedDependencies
"react-dropzone@20.1.1": "patches/react-dropzone.patch"

The patch file itself would conventionally be renamed to react-dropzone@20.1.1.patch for consistency.

---

⚠️ Low — CHANGELOG prose has a grammar issue (file-uploader)

File: packages/pluggableWidgets/file-uploader-web/CHANGELOG.md line 17
Note: The entry reads "This changes added paste-to-upload, fixing issues on dropped files, and improve accessibility". Minor grammar issues: "changes" → "change", "improve" → "improves" (or restructure as a list). Changelog entries are user-facing text.

Suggested wording:

- We updated dependency react-dropzone from 14 to 20. This adds paste-to-upload support, fixes issues with dropped files, and improves accessibility of the drop area.

---

Positives

• The patch itself is targeted and correct — the new regex ^\.[^/\\?*<>|:".]+$ is strictly better than ^.*\.[\w]+$: it anchors to the start, requires the dot at the beginning (proper file extension format), and rejects path-separator characters, closing a subtle validation bypass.
• Both CHANGELOG entries correctly reflect a user-visible behaviour change, and are placed under [Unreleased] — version bump handled separately as per convention.
• Both packages are independently updated and have their own CHANGELOG entries, satisfying the multi-package PR requirement.