"require_dist is not a function" / mermaid production build crash from @braintree/sanitize-url

Problem

Production build (not dev) throws a TypeError like `require_dist is not a function` or `require_defineProperty is not a function` at runtime when a dependency chain pulls in `@braintree/sanitize-url@7.1.1` (e.g. via mermaid). Root cause: that package version assigns `exports.sanitizeUrl = sanitizeUrl` before the `function sanitizeUrl(url) {...}` declaration, relying on plain JS function hoisting - valid in Node's CJS loader but mishandled by Rolldown's CJS-to-ESM conversion order.

Solution

Confirmed fixed in Vite 8.0.11 (reporters confirmed the original repro works again on that version) - upgrade to 8.0.11+. Independently, the immediate dependency-level fix is to upgrade `@braintree/sanitize-url` to 7.1.2 or later, which reorders the assignment after the function declaration. Either upgrade alone resolves it; Vite/Rolldown maintainers decided not to add a vite-side CJS pre-transform workaround for this hoisting pattern, since the dependency upgrade is the correct fix.