[BartWaardenburg]

Bump all crates and npm packages from 0.3.9 to 0.4.0. Update the README install versions to "0.4".

This release includes the webpki-roots 1.0.10 update for RUSTSEC-2026-0381. The minor bump marks two changes that can break callers:

• SourceMap.source() and SourceMap.name() in @srcmap/sourcemap now declare string | null.
• Parsers that do not support indexed maps now reject them.

The second commit fixes the release process. The platform packages were exact optionalDependencies that the lockfile resolved from npm. Version 0.4.0 is not on npm before the release, so pnpm install --frozen-lockfile failed in CI and would fail in the release workflow. The platform package folders are now workspace members, so pnpm links them locally.

[codspeed]

Merging this PR will not alter performance

1 warning

⚠️ 6 benchmarks are dominated by system calls

System calls cannot be simulated consistently and are left out of the measure. The reported value understates the real cost. Switch to the Walltime instrument to measure them.

Learn more about system calls

See affected benchmarks

✅ 111 untouched benchmarks
⏩ 154 skipped benchmarks¹

---

_{Comparing chore/release-v0.4.0 (71a33bf) with main (52c45e2)²}

Footnotes

1. 154 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

2. No successful run was found on main (049ed8b) during the generation of this report, so 52c45e2 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩