chore(deps): update dependencies

[KyleJune]

Summary

Updates every third-party dependency to its newest release that is at least
three days old (lockfile regenerated with deno install --min-dep-age=P3D, so
transitive resolutions honour the same gate). Both 0.x/major bumps (esbuild
0.28, postcss-modules 9) are taken; neither needed a code change.

Dependency	From	To
@deno/esbuild-plugin	1.2.0	1.2.1
@std/assert	1.0.15	1.0.19
@std/async	1.0.15	1.5.0
@std/path	1.1.2	1.1.6
@std/testing	1.0.16	1.0.20
esbuild	0.25.12	0.28.2
postcss	8.5.6	8.5.28
postcss-modules	6.0.1	9.0.1
sass	1.93.3	1.104.0
less	4.4.2	4.9.1
autoprefixer	10.4.21	10.5.5
tailwindcss3 (npm:tailwindcss, v3)	3.4.18	3.4.19
tailwindcss (v4)	4.1.16	4.3.3
@tailwindcss/postcss	4.1.16	4.3.3
stylus	0.64.0	0.64.0 (already latest)

Held back by the age gate: autoprefixer 10.5.6 (published 2026-09-10). The
tailwindcss3 alias stays on Tailwind v3 on purpose. It exists to test v3
support.

Major / 0.x bumps

• postcss-modules 6 → 9: the breaking changes are Node.js minimum-version
  raises only (7: Node 18, 8: Node 20, 9: Node 20.6). The plugin API we call is
  unchanged. Modules example outputs and the snapshot file are byte-identical.
• esbuild 0.25 → 0.28: the breaking items are toolchain/install-level: Go
  compiler updates raising the OS minimums (Linux kernel 3.2+, macOS 12+),
  Uint8Array.fromBase64 in the binary loader, and integrity checks on the
  fallback binary download. None of our example outputs changed. The suite also
  passes unchanged with esbuild pinned back to 0.25.12 against the new fixtures.

Consumer impact of the esbuild range

postcss.ts imports only types from esbuild (Plugin, OnLoadArgs, …),
so the published package's esbuild dependency shapes type-checking only. At
runtime every consumer uses their own esbuild. After this release the
package's types come from npm:esbuild@^0.28.2, and because 0.x carets don't
cross minors, a consumer still on 0.25 will resolve a second, type-only copy of
esbuild. I checked that Plugin types are assignable both ways (a 0.28
Plugin into 0.25 BuildOptions.plugins and vice versa pass deno check), so
consumers on 0.25 through 0.28 should see no type errors. I did not publish and
consume the package end to end. @deno/esbuild-plugin 1.2.1 still depends on
esbuild@^0.25.5, so the tests load its 0.25 copy next to our 0.28. That
affects the dev/test graph only.

Snapshot / fixture changes

Only the example outputs changed, and only by these upstream changes.
__snapshots__/postcss.test.ts.snap is unchanged.

• examples/sass/out/{a,b}.{css,js}: rgb(91.8, 91.8, 91.8) →
  rgb(36%, 36%, 36%). It's the same colour (91.8 / 255 = 36%). Sass 1.101.4
  "Avoid emitting rgb() or rgba() functions with non-percent decimal
  channels" now uses percentages for non-integer legacy colour channels.
• examples/tailwindcss4/out/main.css, from Tailwind 4.3.3:
  • the version banner;
  • the --font-sans / default font-family stack is now explicit platform
    fonts instead of ui-sans-serif, system-ui (tailwindcss#20318);
  • :-moz-focusring → :-moz-focusring:where(:not(iframe))
    (tailwindcss#20292).

Test evidence

Local, Deno 2.9.6:

• deno task check: passes (lint 10 files, fmt 45 files).
• deno task test: ok | 7 passed (30 steps) | 0 failed.
• Before the fixture refresh, the upgrade failed exactly the 4 sass steps and
  the 1 Tailwind v4 step, with the diffs above. After deno task test-update,
  the suite passes.
• deno publish --dry-run passes, including the slow-types check.
• On main before this change, check and test also passed (7 passed, 30 steps).

The npm:glob@10.x deprecation warning at install is pre-existing: main
already locked glob@10.4.5 via stylus and tailwindcss v3.

🤖 Generated with Claude Code

[github-actions]

🎉 This PR is included in version 0.4.2 🎉

The release is available on:

• JSR.io
• GitHub release

Your semantic-release bot 📦🚀