Reject negative CSS sizing values after syntax-data updates

Node.js version

v26.8.1

jsdom version

The dependency-update branch in #4301, based on jsdom 30.0.1, with @csstools/css-syntax-patches-for-csstree 1.1.13.

Minimal reproduction case

const { JSDOM } = require("jsdom");

const { document } = new JSDOM("").window;
for (const property of ["max-width", "max-height"]) {
  for (const value of ["-10px", "-20%"]) {
    const element = document.createElement("div");
    element.style.setProperty(property, value);
    console.log(property, value, JSON.stringify(element.style.getPropertyValue(property)));
  }
}

Each declaration should be rejected, leaving an empty string. Instead, jsdom retains each negative value.

How does similar code behave in browsers?

The existing WPTs css/css-box/parsing/max-width-invalid.html and css/css-box/parsing/max-height-invalid.html require rejection of these values. This investigation reproduced the failures in jsdom; it did not run the example in browsers.

What is the problem?

This tracks a dependency regression encountered while updating jsdom's dependencies in #4301. Version 1.1.13 of @csstools/css-syntax-patches-for-csstree introduced a shared <box-size> grammar without the nonnegative bounds on <length-percentage>. Version 1.1.12 rejects the values correctly. The new grammar also accepts negative arguments to the sizing fit-content() function and is referenced by 13 sizing properties, so the impact extends beyond the two failing WPT files.

The incorrect grammar came from CSS specification data. The specification correction restores the nonnegative bounds both for bare lengths/percentages and inside the sizing fit-content() alternative. Webref's source data already incorporates that correction. It still needs to reach a published CSSTools syntax-patches version.

Applying the corrected grammar temporarily to the installed dependency made all 84 selected CSS box/sizing and HTML zero-character WPT files pass. The temporary dependency edit was then reverted.

The dependency-update PR will mark only the four affected negative-value subtests as expected failures. Once a syntax-patches release includes the corrected grammar, update jsdom's dependency and lockfile, remove the expectations linked to this issue, and rerun the affected WPTs. No new css-tree release should be necessary.