chore(deps): update dependencies

[KyleJune]

Summary

Updates Juniper's third-party dependencies across every workspace member
(src, example, templates/*, tutorials/blog), keeping the members on the
same ranges. Every resolved version was published before the 3-day
minimumDependencyAge cutoff (the newest is playwright 1.63.0, published
2026-09-04). The policy is unchanged.

Bumps (declared range floor, resolved version)

Named in deno outdated

• jsr:@std/collections 1.2.0 → 1.3.0
• jsr:@std/encoding 1.0.10 → 1.0.11
• jsr:@std/streams 1.1.1 → 1.1.2
• jsr:@std/testing 1.0.19 → 1.0.20
• npm:esbuild 0.28.0 → 0.28.2
• npm:global-jsdom 29.0.0 → 30.0.0 (major; peer jsdom 29.1.1 → 30.0.1)
• npm:hono 4.12.23 → 4.13.7
• npm:isbot 5.1.42 → 5.2.2 (range floor ^5.1.40 → ^5.2.2)
• npm:playwright 1.60.0 → 1.63.0
• npm:@testing-library/react 16.3.2 → 16.3.3
• npm:@testing-library/user-event 14.6.1 → 14.6.7
• npm:@tailwindcss/postcss 4.3.0 → 4.3.3
• npm:tailwindcss 4.3.0 → 4.3.3
• npm:@tanstack/react-query 5.100.14 → 5.102.8
• npm:react-error-boundary 6.1.2 → 6.1.5
• npm:react-router 8.3.0 → 8.3.1
• npm:pg 8.21.0 → 8.23.0
• npm:@types/pg 8.20.0 → 8.23.1

Declared-range floors raised to the locked or newer compatible version

deno update also moved these within their existing caret ranges:

• npm:react / npm:react-dom 19.2.7 → 19.2.8
• npm:@types/react 19.2.16 → 19.2.18
• npm:zod 4.4.3 → 4.5.4
• jsr:@std/async ^1.4.0 → ^1.5.0 (lock already resolved 1.5.0)
• jsr:@std/cli ^1.0.30 → ^1.0.32 (lock already resolved 1.0.32)
• jsr:@std/path ^1.1.5 → ^1.1.6

Transitive lock movement includes postcss 8.5.15 → 8.5.28 and
@std/data-structures 1.1.1 → 1.1.2. playwright 1.63 no longer pulls
fsevents.

Skipped

• @modelcontextprotocol/sdk 1.29.0 → 1.30.0: chore(deps): drop the unused MCP SDK declaration #127 removes
  that declaration, so this PR leaves it alone. Its lock entry still changes: its
  zod peer now resolves to 4.5.4, because zod is shared across the workspace.
  Whichever of this PR and chore(deps): drop the unused MCP SDK declaration #127 merges second needs a deno.lock refresh.
• @udibo/* (@udibo/juniper, @udibo/esbuild-plugin-postcss): bumped
  separately after their own releases.

Notes

• global-jsdom 30: kept. It requires jsdom >=30 <31. Check and every suite
  pass without code changes.

• playwright: declared in example/deno.json but never imported, so the bump
  needs no browser binaries.

• allowScripts: unchanged. It was already out of step with the lock before
  this PR:

  • The allow entry names npm:esbuild@0.27.2, but the lock resolved 0.28.0 and
    now 0.28.2.
  • The deny entries for @parcel/watcher@2.5.6 and less@4.5.1 name packages
    not in the lock.
  • Nothing in this repo checks allowScripts against the lock.
  • A clean rm -rf node_modules && deno install prints no lifecycle-script
    warnings; esbuild works through its optional platform packages.

  I left it alone because re-pointing the allow entry at 0.28.2 would start
  running esbuild's postinstall, which does not run today.

Testing

All run locally on the final committed content (Deno 2.9.6, Linux):

• deno task check: pass (check, lint, fmt, test:doc-lint, doc-lint: 9
  entrypoints clean)
• deno task test --parallel: 33 passed (382 steps)
• deno task test --coverage (serial, as CI on Ubuntu): pass
• deno task build:prod:minimal and deno task build:prod:tailwindcss: pass
• deno task test:example --parallel: 33 passed (329 steps)
• deno task test:minimal --parallel: 3 passed (4 steps)
• deno task test:tailwindcss --parallel: 3 passed (4 steps)
• deno task test:tanstack --parallel: 9 passed (78 steps)
• deno task test:blog --parallel: 3 passed (3 steps)
• deno task test:postgres --parallel: 4 passed (11 steps). This ran against a
  throwaway postgres:18 container migrated with db:migrate:test, as in CI.
• deno outdated -r '!@udibo/*' afterwards lists only
  @modelcontextprotocol/sdk.

🤖 Generated with Claude Code

[github-actions]

🎉 This PR is included in version 0.11.5 🎉

The release is available on:

• JSR.io
• GitHub release

Your semantic-release bot 📦🚀