fix(deps): clear GHSA-mw96-cpmx-2vgc by upgrading rollup

[andreszorro]

pnpm audit: 1 high → no known vulnerabilities.

The pin was protecting against something narrower than we thought

rollup was held at 4.52.5 because ≥4.53.0 panics — called Option::unwrap() on a None value — on input scripts/escapes.test.js feeds the parser, and the fix for this advisory lands in 4.59.0.

Rather than take that on faith, I mapped the panic on 4.59.0. It needs all three of:

1. a directive prologue (a string-literal statement at the start of a body),
2. holding an escape sequence rather than a raw code unit,
3. that is a lone surrogate.

Input	4.59.0
"\uD800"; as the first statement	panics
the same, as a raw surrogate character	ok
let x; "\uD800"; (not a directive)	ok
variable initializer, object value, property key, import specifier, template literal	ok

A directive prologue holding a lone-surrogate escape is not a shape a bundler emits — real ones are "use strict". So the pin was buying nothing that mattered and costing a High advisory.

What changed

• rollup 4.52.5 → 4.62.4. pnpm why rollup shows a single version, used by vite@7.3.6.
• parseAst is now called through a wrapper that turns a parser failure into the same refusal as anything else this module cannot handle. That is the module's existing contract — refuse rather than emit an artifact the upload would reject — so an unreadable bundle fails closed with a legible message instead of an unexplained Rust panic.
• The directive-prologue test asserts the guarantee, not the wording. That input was always destined for a refusal, because a directive is not a value position; only which check reaches it first has changed. A new test covers the fail-closed path directly.
• The renovate rule disabling rollup updates is removed, since it would otherwise have held rollup at a vulnerable version indefinitely.

Verified

pnpm audit → no known vulnerabilities · 381/381 tests · biome ci clean · tsc --noEmit clean · renovate config validates.

And the thing escapes.js exists for, checked on the new parser rather than assumed — a real single-file render, read back through findUnspellable:

index.html      1,020,478 bytes  |  unspellable units: 0
artifact.html   1,019,541 bytes  |  unspellable units: 0

🤖 Generated with Claude Code

[upwind-code-us]

Upwind Code Scan - ✅ Proceed with Deployment

0 newly introduced vulnerabilities · 1 resolved · 0 total in this PR vs main

---

✅ Resolved · 1 finding

CVE	Package	Version
CVE-2026-27606	rollup	4.52.5

View full analysis in Upwind Console

Scan completed in 40s

Scan history (1 scan)

Commit	Scanned at	New	Resolved	Net
38ed5d8 <	2026-08-17 01:15 UTC	0	-1	-1

Last scanned: 38ed5d8 · 2026-08-17 01:15 UTC