build(deps-dev): update esbuild and keep DSH on React 18

.github/dependabot.yml

@@ -14,6 +14,15 @@ updates:
       # Migrate both packages together; see ROADMAP.md.
       - dependency-name: typescript
         update-types: ['version-update:semver-major']
+      # DSH 0.2.0-rc.2 shares React 18 with plugins; migrate with the host.
+      - dependency-name: react
+        update-types: ['version-update:semver-major']
+      - dependency-name: react-dom
+        update-types: ['version-update:semver-major']
+      - dependency-name: '@types/react'
+        update-types: ['version-update:semver-major']
+      - dependency-name: '@types/react-dom'
+        update-types: ['version-update:semver-major']
     groups:
       # Pi 0.x minor releases can break host APIs; review them separately.
       pi:

docs/repository-settings.md

@@ -121,3 +121,10 @@ standalone package/declaration checks; the current migration is tracked in the
 are ignored until their compatibility policy changes. Minor/patch updates,
 vulnerability alerts, and security-update configuration remain enabled. Review
 any security fix that requires crossing an ignored major version manually.
+
+Keep `react`, `react-dom`, and their `@types` packages on 18.x while the DSH
+validation target is 0.2.0-rc.2. The Web panel shares the host's React instance;
+its development runtime and declarations must match the host's React 18 baseline.
+Dependabot ignores major updates for all four packages until a coordinated host
+migration is validated. Minor/patch updates and vulnerability alerts remain enabled;
+review any security fix requiring a new React major manually.

integrations/dsh/package.json

@@ -42,7 +42,7 @@
     "@types/node": "^22.0.0",
     "@types/react": "18.3.28",
     "@types/react-dom": "18.3.7",
-    "esbuild": "0.25.12",
+    "esbuild": "0.28.2",
     "jsdom": "26.1.0",
     "react": "18.3.1",
     "react-dom": "18.3.1",