fix: pin @csstools/postcss-cascade-layers to 5.0.2

v6.0.0 dropped the CJS export and raised engines.node to >=20.19.0,
which broke `panda codegen` on Node 18 and 20.0-20.18 with
ERR_REQUIRE_ESM (issue #3518). @pandacss/core ships a CJS build that
requires the package, so we stay on the last dual-published v5 release.
The two versions are functionally equivalent.

Adds a Renovate rule restricting this dep to <6 so the bump doesn't
get reapplied automatically.

Author: segunadebayo

.changeset/revert-cascade-layers-v6.md

@@ -0,0 +1,10 @@
+---
+'@pandacss/core': patch
+---
+
+Pin `@csstools/postcss-cascade-layers` back to `5.0.2`.
+
+Version `6.0.0` dropped the CommonJS export and raised the engine requirement to Node `>=20.19.0`,
+which broke `panda codegen` on Node 20.0–20.18 and Node 18 with `ERR_REQUIRE_ESM` (issue #3518).
+Since `@pandacss/core` ships a CJS build that requires the package, we stay on the last
+dual-published version. The two releases are functionally equivalent — v6 only removed CJS support.

packages/core/package.json

@@ -38,7 +38,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@csstools/postcss-cascade-layers": "6.0.0",
+    "@csstools/postcss-cascade-layers": "5.0.2",
     "@pandacss/is-valid-prop": "workspace:^",
     "@pandacss/logger": "workspace:*",
     "@pandacss/shared": "workspace:*",

pnpm-lock.yaml

@@ -16,6 +16,11 @@
       "automerge": true,
       "groupName": "all non-major dependencies",
       "groupSlug": "all-minor-patch"
+    },
+    {
+      "matchPackageNames": ["@csstools/postcss-cascade-layers"],
+      "allowedVersions": "<6",
+      "description": "v6 drops CommonJS and requires Node >=20.19.0; pin to v5 until we drop CJS or raise engines."
     }
   ]
 }