[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@harlan-zw/comark-content (source)	^0.2.0 → ^0.2.1
@iconify-json/tabler	^1.2.41 → ^1.2.42
cssnano	9.2.2 → 9.6.0
cssnano-preset-default	9.2.2 → 9.6.0
cssnano-utils	8.1.0 → 8.2.1
execa	^10.0.1 → ^10.1.0
happy-dom	^20.14.5 → ^20.14.6
playwright-core (source)	^1.63.0 → ^1.64.0
pnpm (source)	12.8.1 → 12.11.2
postcss-calc	11.2.2 → 11.2.3
postcss-colormin	9.0.6 → 9.0.8
postcss-convert-values	9.0.7 → 9.0.9
postcss-discard-comments	9.0.6 → 9.0.8
postcss-discard-duplicates	9.0.5 → 9.0.7
postcss-discard-empty	9.0.5 → 9.0.8
postcss-discard-overridden	9.0.5 → 9.0.6
postcss-merge-longhand	9.2.0 → 9.4.0
postcss-merge-rules	9.0.8 → 9.1.4
postcss-minify-font-values	9.0.7 → 9.0.9
postcss-minify-gradients	9.0.6 → 9.0.8
postcss-minify-params	9.0.6 → 9.0.8
postcss-minify-selectors	9.0.6 → 9.0.8
postcss-normalize-charset	9.0.5 → 9.0.6
postcss-normalize-display-values	9.0.5 → 9.0.7
postcss-normalize-positions	9.0.6 → 9.0.8
postcss-normalize-repeat-style	9.0.5 → 9.0.7
postcss-normalize-string	9.0.5 → 9.0.7
postcss-normalize-timing-functions	9.0.5 → 9.0.7
postcss-normalize-unicode	9.0.5 → 9.1.1
postcss-normalize-url	9.0.5 → 9.0.7
postcss-normalize-whitespace	9.0.5 → 9.0.8
postcss-ordered-values	9.0.6 → 9.0.9
postcss-reduce-initial	9.0.6 → 9.0.7
postcss-reduce-transforms	9.0.4 → 9.0.6
postcss-svgo	9.0.4 → 9.0.6
postcss-unique-selectors	9.0.5 → 9.0.6
stylehacks	9.0.7 → 9.0.8
vite (source)	^8.3.3 → ^8.3.4
vue-router (source)	^5.3.1 → ^5.4.0
vue-tsc (source)	^3.3.12 → ^3.3.13

---

Release Notes

cssnano/cssnano (cssnano)

v9.6.0: v9.6.0

Compare Source

What's Changed

New Features

• feat(postcss-merge-longhand): merge row-gap/column-gap, overscroll-behavior-x/-y, flex-direction/flex-wrap, column-rule-* and equal overflow-x/-y into their shorthands when every target supports them

Bug Fixes

• refactor: remove cssesc dependency

• fix: improve escape handling in selectors

• fix: update postcss-calc

• fix: accept the optional leading rounding strategy of round(), such as round(up, 1s, 1s), when postcss-ordered-values orders animations and transitions and when postcss-merge-longhand folds shorthands. The rounding strategy must be separated by a comma, so round(up 1px, 2px) is no longer treated as valid.

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@9.5.0...cssnano@9.6.0

v9.5.0: v9.5.0

Compare Source

What's Changed

New Features

• Minify unicode and reduce css-grid-template white space in #​2038

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@9.4.0...cssnano@9.5.0

v9.4.0: v9.4.0

Compare Source

What's Changed

New Features

• feat(cssnano-preset-default): merge more overridden declarations in #​2033

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@9.3.2...cssnano@9.4.0

v9.3.2: v9.3.2

Compare Source

What's Changed

• fix: merge long selectors by @​ludofischer in #​2024
• fix(postcss-ordered-values): improve box-shadow and animation by @​ludofischer in #​2025
• fix: relist dev dependency as direct dependency by @​robmisasi in #​2027

New Contributors

• @​robmisasi made their first contribution in #​2027

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@9.3.1...cssnano@9.3.2

v9.3.1: v9.3.1

Compare Source

What's Changed

Bug Fixes

Fix a crash because of a dependency on an unpublished version of cssnano-utils

• Publish cssnano 9.3.1 in #​2023

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@9.3.0...cssnano@9.3.1

v9.3.0: v9.3.0

Compare Source

What's Changed

New Features

• feat: merge non-adjacent rules in #​2016

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@9.2.2...cssnano@9.3.0

sindresorhus/execa (execa)

v10.1.0

Compare Source

Behavior changes

These are bug fixes, but they might affect code that relied on the previous incorrect behavior.

• extendEnv: false without the env option no longer inherits process.env, per docs 67acf60
• Windows: Arguments of .cmd and .bat files are now escaped like Rust does, which fixes batch files reading %~1 (#​1261) 93bddc4
• Invalid stdio values, such as negative file descriptors, now throw c6bd387
• Using the same file as input and output now throws, even when the paths are written differently 587045a
• Synchronous methods now enforce per-file-descriptor maxBuffer values 9547e51
• Synchronous methods now throw on the signal option, like asynchronous methods 59de065
• Synchronous methods now write the raw output bytes to files, like asynchronous methods af6264a

Fixes

• Fix subprocess.kill() signaling the current process group when the subprocess failed to spawn 5464d43
• Fix crashes when spawning fails with EMFILE/ENFILE (#​1262), or when a file target cannot be opened 15c46cd 1cee524
• Fix error.stdout and error.stderr being undefined when synchronous methods fail to spawn (#​1263) bfe4633
• Fix the subprocess promise hanging until an output stream is read 004f3b3
• Fix subprocess.pipe() with the stdio option, and destination subprocesses left running 8d3f0a9 ecda56b
• Fix result.all when only some file descriptors are buffered or split into lines 758768f
• Fix the encoding option and line splitting in transforms 6adb3c3
• Fix input and output transforms with synchronous methods 516a5e2 e0b5dbc
• Fix template strings with emojis and line continuations b67f199
• Fix killDescendants signaling unrelated processes on Windows 9c5c71c
• Fix IPC with serialization: 'json', strict: true and the verbose option 9842f1a 698a1b8 b548d8b
• Fix the subprocess error being hidden when the current directory was deleted 91d9ded
• Fix shebang scripts on Windows when the file is small 7c1a631

---

capricorn86/happy-dom (happy-dom)

v20.14.6

Compare Source

👷‍♂️ Patch fixes

• Fixes cookie scope forgery vulnerability - By @​capricorn86

microsoft/playwright (playwright-core)

v1.64.0

Compare Source

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');

for (const tool of await page.webmcp.tools())
  console.log(tool.name, tool.description);

const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';

export default defineConfig({
  use: {
    video: {
      mode: 'on',
      size: { width: 1920, height: 1080 },
      fps: 60,
      show: {
        actions: {
          style: {
            point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
            highlight: 'outline: 2px solid #​333; background: rgba(0, 128, 255, .15)',
            title: 'font-size: 16px',
          },
        },
      },
    },
  },
});

• New fps option in testOptions.video, recordVideo and
  screencast.start(). Firefox and WebKit currently capture up to 25 frames per second.
• New style option takes CSS declarations for the point marker, the target
  highlight and the action title. It replaces the fontSize option, which is now deprecated.
• The cursor stays visible at the last action point, survives navigations and travels along a natural, eased path.
• Videos are encoded with VP9 instead of VP8, which takes less CPU and produces smaller files of the same or better
  quality.
• All video options are also available in Playwright MCP and playwright-cli.

🎯 Test runner

• New testProject.default option keeps a project in the config without running it by default. You can configure every browser you care about, and let a plain npx playwright test run just your favourite one:

  // playwright.config.ts
  import { defineConfig, devices } from '@playwright/test';
  
  export default defineConfig({
    projects: [
      { name: 'chromium', use: devices['Desktop Chrome'] },
      { name: 'firefox', use: devices['Desktop Firefox'], default: false },
      { name: 'webkit', use: devices['Desktop Safari'], default: false },
    ],
  });

  npx playwright test                     # runs chromium only
  npx playwright test --project=firefox   # runs firefox
  npx playwright test --project="*"       # runs all three, for example on CI

• New --shuffle command line option schedules tests in a random order, which helps to find tests that accidentally depend on each other.

  npx playwright test --shuffle
  # Running 42 tests using 4 workers, shuffle seed 271828182
  # ...
  
  # Pass the seed to reproduce the same order.
  npx playwright test --shuffle 271828182

• New lock option in test.describe.configure() adds test locks to all tests in a file or a group:

  test.describe.configure({ lock: 'user-settings' });

• New type option of toHaveScreenshot in testConfig.expect stores all unnamed screenshots as WebP:

  // playwright.config.ts
  export default defineConfig({
    expect: {
      toHaveScreenshot: { type: 'webp' },
    },
  });

🪆 Locator.within()

New locator.within() combines two locators that you already have, reading in the natural order —
"this button, within that dialog":

const saveButton = page.getByRole('button', { name: 'Save' });
const dialog = page.getByTestId('settings-dialog');

await saveButton.within(dialog).click();

Relative locators such as locator.nth() or locator.first() are resolved inside each parent
separately, which makes column-like queries straightforward:

// The third cell of every row, not the third cell in the table.
const thirdColumn = page.getByRole('cell').nth(2).within(page.getByRole('row'));
await expect(thirdColumn).toHaveText(['Apple', 'Banana', 'Cherry']);

New APIs

• New page.getByRef() locates an element by its aria ref, such as e2, reported by page.ariaSnapshot() in the 'ai' mode.

• New option includeShadow in page.content() and frame.content() serializes open shadow roots as declarative shadow DOM.

• New option signCount sets the initial signature counter of a virtual credential. credentials.create() and credentials.get() return the current signCount, and it is saved and restored together with the credentials in the storage state.

• New fullConfig.filteredProjects lists the projects that were selected to run after applying the --project filter. It is available in global setup and reporters.

• New apiRequestContext.addCookies(), apiRequestContext.cookies() and apiRequestContext.clearCookies() manage cookies of a request context, mirroring the BrowserContext methods:

  await request.addCookies([{ name: 'session-id', value: '42', url: 'https://example.com' }]);
  console.log(await request.cookies('https://example.com'));
  await request.clearCookies({ name: 'session-id' });

Breaking changes ⚠️

• screen property is now forwarded from the device descriptors. If you use ...devices['Desktop Chrome'] and alike, window.screen and media queries now see the emulated screen size. You can opt-out by explicitly setting screen to undefined:

  // playwright.config.ts
  export default defineConfig({
    use: {
      ...devices['Desktop Chrome'],
      screen: undefined,
    },
  });

• JSX in your test files now follows your tsconfig.json. Playwright compiles JSX in test files according to the jsx, jsxFactory, jsxFragmentFactory and jsxImportSource tsconfig options, and defaults to the automatic runtime from react/jsx-runtime.

• --update-snapshots=missing now passes the test run. Tests that only create missing snapshots now pass in the 'missing' mode of testConfig.updateSnapshots, so that CI can generate new snapshots and verify the existing ones in a single run. The mode used when the option is not specified is now called 'default' and behaves as before: missing snapshots are written and the test fails.

• Elements inside hidden iframes are considered hidden. Elements inside an iframe that is not visible, for example with visibility: hidden, are now considered hidden by actions, locator.isVisible() and expect(locator).toBeVisible().

Browser Versions

• Chromium 156.0.8078.4
• Mozilla Firefox 157.0
• WebKit 27.2

This version was also tested against the following stable channels:

• Google Chrome 155
• Microsoft Edge 155

pnpm/pnpm (pnpm)

v12.11.2: pnpm 12.11.2

Compare Source

This release fixes --workspace-concurrency=Infinity, filters set by an updateConfig hook, and store fetches with enable-modules-dir=false.

Patch Changes

• --workspace-concurrency=Infinity now runs workspace projects with no concurrency limit. It used to fail with invalid digit found in string #​16793.

• pnpm install and other recursive commands now apply the filter and filterProd that an updateConfig hook sets. They used to run on every workspace project #​16792.

• enable-modules-dir=false now also fetches the packages an install reuses from an existing lockfile, so the store holds every package the lockfile lists.

Platinum Sponsors

Gold Sponsors

v12.11.1: pnpm 12.11.1

Compare Source

This release fixes two ways pnpm install could fail, runs tools of any Rust release through pnx, and treats registry.npmjs.com as an alias of the npm registry.

Patch Changes

• pnpm install no longer fails when packageManager pins the pnpm version that is already running and the registry does not publish that version. pnpm warns and continues. A registry mirror that has not synced a release no longer blocks the commands of a project pinned to it.

• pnpm install no longer fails with ERR_PNPM_CMD_SHIM_CHMOD when node_modules/.bin holds a shim that another user created, if everyone can already execute it and it is not world-writable. This happens when several users share one checkout.

• enable-modules-dir=false (enableModulesDir: false through the Node.js addon) fetches the registry packages the host can install into the store again, as pnpm v10 did, while still writing nothing under node_modules. The setting exists for a node_modules that something else mounts from the store, such as a FUSE daemon, and that consumer no longer has to download each package on first access. A plain --lockfile-only run still fetches nothing.

• pnpm pack and pnpm publish no longer put .npmignore and .gitignore files in the tarball. A files entry that names one still ships it.

• pnpm now treats https://registry.npmjs.com/ as an alias of https://registry.npmjs.org/. Registry requests, credentials, and trusted publishing use the canonical hostname.

• pnx --package=rust@<channel> <tool> runs a tool of that Rust release, for example pnx --package=rust@nightly-2026-01-01 cargo build. pnpm installs the release with the components and targets from rust-toolchain.toml and the target of each --target argument.

• pnpm install now links agent skills for more coding agents. It detects the agent from ANTIGRAVITY_AGENT, COPILOT_AGENT, COPILOT_CLI, CODEX_THREAD_ID, CODEX_SANDBOX, AI_AGENT, and CLAUDE_CODE pnpm/tasks#116.

• When the registry rejects pnpm stage publish, the error message now starts with "Failed to stage package".

Platinum Sponsors

Gold Sponsors

v12.11.0: pnpm 12.11.0

Compare Source

This release adds Rust toolchain management, links the agent skills that dependencies ship, adds the permissions setting, and keeps the colors of streamed script output.

Minor Changes

• pnpm install now links the agent skills that direct dependencies ship under skills/<name>/SKILL.md into the project's agent skill directories, such as .claude/skills. A package's skills are linked only after you approve them with pnpm approve. The skills.dirs setting chooses the directories pnpm/rfcs#35.

  Added the permissions setting, which records what each dependency may do. Its build capability works like allowBuilds and takes precedence over it. pnpm approve-builds writes to permissions when pnpm-workspace.yaml already has it, and to allowBuilds otherwise.

  Added pnpm permissions, which lists the granted and denied permissions and the packages awaiting approval. pnpm approve reviews build scripts and agent skills in one prompt pnpm/rfcs#36.

• pnpm now installs and runs Rust toolchains.

  • With cargo.enabled, pnpm install installs the toolchain named in rust-toolchain.toml. pnpm verifies the release signature, stores the toolchain once per machine, and links it into .pnpm/rust. pnpm run and pnpm exec put its cargo and rustc on the PATH.
  • pnpm add -g rust@<channel> installs a toolchain globally. The cargo and rustc commands run it outside projects that pin their own. pnpm update -g, pnpm ls -g, and pnpm remove -g manage it like any global package.
  • In a project, pnpm add rust@<channel> pins the toolchain in rust-toolchain.toml.
  • pnpm shim add rust adds project-aware shims for cargo, rustc, and the other Rust tools. In a project with a rust-toolchain.toml, they run the toolchain the file names and install it on first use. Elsewhere, the next command of the same name on PATH runs, such as rustup's.

• pnpm run and pnpm exec now keep the colors of script output that they print under the project's name, such as with --stream. pnpm sets FORCE_COLOR=1 for these scripts when its own output is in color, unless FORCE_COLOR is already set.

  Script output is also rendered more cleanly:

  • A line that a progress bar redraws with \r shows only its last state.
  • Escape codes that move the cursor or clear the screen are dropped.
  • Long colored lines are cut at the terminal width.
  • pnpm -r run no longer garbles its live output when a script fails while other scripts are still running.

Patch Changes

Installing packages

• pnpm no longer panics with "unexpected error when polling the I/O driver" when it runs under QEMU user-mode emulation, such as a linux/amd64 container on an Apple Silicon Mac #​16696.

• pnpm view, pnpm update, and other commands that read registry metadata now work behind proxies that end a response by closing the connection without a TLS close_notify alert #​16704.

• pnpm now switches to the version a project pins in packageManager or devEngines.packageManager even when pnpm-workspace.yaml has a setting the running pnpm cannot read, such as a lockfile.includeResolutionSettings section. If pnpm does not switch, it still reports that setting #​16675.

• When the pnpm package has to download its native binary on first run, it now uses the registry and credentials from .npmrc and from the npm_config_registry and pnpm_config_registry environment variables. COREPACK_NPM_REGISTRY still takes precedence. A project .npmrc is not read when COREPACK_INTEGRITY_KEYS turns off the signature check #​16655.

• pnpm install and pnpm add --config now apply minimumReleaseAge when they resolve a config dependency. A config dependency range resolves to the newest version that is old enough, so a later clean pnpm install --frozen-lockfile accepts the lockfile #​16660.

• pnpm remove with catalogPrune no longer removes catalog entries that pnpm-lock.yaml still records for workspace projects missing from disk. Before, a following frozen install failed with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH #​16679.

• With cargo.enabled, pnpm install now writes the source replacement for vendored crates into .pnpm/crates/config.toml and includes it as optional from .cargo/config.toml. A checkout without .pnpm builds with plain Cargo #​16659.

• With nodeLinker.type set to loaded, Node.js now stops with ERR_PNPM_LOADER_UNSUPPORTED_NODE when it preloads the store loader on a version the loader cannot serve. The supported versions are ^24.18.0 || >=26.2.0. On other versions, CommonJS packages imported from ESM failed with Cannot find module on their first relative require().

• On Windows, pnpm install no longer fails with "The filename, directory name, or volume label syntax is incorrect" when a package contains a file whose name is invalid on Windows, such as icon.svg?as=metadata.d.ts. pnpm removes the invalid characters from the name and prints a warning that lists the renamed files.

• On Windows, hoisting no longer fails intermittently with link errors when a junction is created or replaced concurrently pnpm/tasks#53.

Resolving dependencies

• pnpm install --no-optional now installs the peer dependencies a project declares when autoInstallPeers is on. The lockfile marked such a peer optional: true when another dependency had it as an optional peer.

• pnpm install and pnpm dedupe now link an optional peer to the workspace package that the workspace root depends on when the picked version matches it. They installed the registry package with the same name and version #​16706.

• Removal overrides such as "debug>supports-color": "-" now also apply to an optional peer that a package declares only in peerDependenciesMeta #​16681.

• pnpm add and other installs that re-resolve dependencies now keep the locked devEngines.runtime version while it still satisfies the declared range #​16764.

• pnpm audit --fix update now updates only the dependencies whose locked version is vulnerable #​14928.

• pnpm outdated and pnpm update --interactive now apply overrides before they look up the latest version. Before, a dependency overridden to an npm alias was compared with the latest version of the package the override replaces #​16719.

Patched dependencies

• Patches saved with CRLF line endings now apply, including a patch that creates or deletes a file. pnpm rejected the git headers of such a patch with ERR_PNPM_INVALID_PATCH and the message invalid file mode: 100644 #​16641.

• A patch that changes a file's mode, such as adding or removing the executable bit, now applies the new mode on Unix pnpm/tasks#110.

Injected dependencies and deploy

• With sharedWorkspaceLockfile: false, an injected workspace package installed in the same run as its dependent now holds only the files its files field selects. The copy also held other files of the project, such as tsconfig.json #​16683.

• A script

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@nuxtjs/robots@253

commit: 3003c74

[github-actions]

📦 Package Size

✅ No notable size changes

All tracked output (10)

Package output	Gzipped	Raw
@nuxtjs/robots · dependency @fingerprintjs/botd	13 kB	55 kB	✅
@nuxtjs/robots · dependency h3	34 kB	146 kB	✅
@nuxtjs/robots · dependency nuxt-site-config	10 kB	25 kB	✅
@nuxtjs/robots · dependency nuxtseo-shared	23 kB	78 kB	✅
@nuxtjs/robots · export .	6.4 kB	24 kB	✅
@nuxtjs/robots · export ./content	292 B	503 B	✅
@nuxtjs/robots · export ./util	6.6 kB	25 kB	✅
@nuxtjs/robots · published payload	39 kB	130 kB	✅
@nuxtjs/robots · app runtime	2.7 kB	6.5 kB	✅
@nuxtjs/robots · server runtime	8.7 kB	22 kB	✅

Runtime dependencies (10)

Package	Dependency	Requested	Resolved	Cost
@nuxtjs/robots	@fingerprintjs/botd	^2.0.0	2.0.0	📦 13 kB gzip
@nuxtjs/robots	@nuxt/kit	^4.5.2	4.5.2	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	consola	^3.4.2	3.4.2	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	defu	^6.1.7	6.1.7	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	h3	^1.15.11	1.15.11	📦 34 kB gzip
@nuxtjs/robots	nuxt-site-config	^4.2.3	4.2.3	📦 10 kB gzip
@nuxtjs/robots	nuxtseo-shared	^5.3.16	5.3.16	📦 23 kB gzip
@nuxtjs/robots	pathe	^2.0.3	2.0.3	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	pkg-types	^2.3.3	2.3.3	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	ufo	^1.6.4	1.6.4	♻️ free via Nuxt 4.5.2

_{Baseline: main_@_ff8c5d5___2026-10-06 · gzip is the comparison metric · changes below 16 B gzip are ignored}

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

Error:   × installing dependencies
  ├─▶ Failed to resolve dependency tree: Failed to resolve dependency: High-
  │   risk trust downgrade for "cssnano@9.6.0" (possible package takeover)
  │   
  │   Failed to resolve cssnano@9.6.0
  │   This error happened while installing the dependencies of nuxt@4.6.0
  │   This error happened while installing the dependencies of @nuxt/vite-
  │   builder@4.6.0
  ╰─▶ Failed to resolve dependency: High-risk trust downgrade for
      "cssnano@9.6.0" (possible package takeover)