"index out of bounds" panic when using first-class MDX support with an ampersand in an attribute

[shepmaster]

🐛 bug report

Parcel crashes when processing this MDX file:

<img alt="&stuff" />

🎛 Configuration (.babelrc, package.json, cli command)

N/A

🤔 Expected Behavior

A proper error message should be printed.

😯 Current Behavior

⠙ Building repro.mdx...

thread '<unnamed>' panicked at /Users/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/markdown-1.0.0-alpha.21/src/util/character_reference.rs:196:35:
index out of bounds: the len is 6 but the index is 6
stack backtrace:
   0:        0x11bdff240 - _napi_register_module_v1
   1:        0x11be1cfd0 - _napi_register_module_v1
   2:        0x11bdfc19c - _napi_register_module_v1
   3:        0x11bdff0f4 - _napi_register_module_v1
   4:        0x11bdffed0 - _napi_register_module_v1
   5:        0x11bdffcc4 - _napi_register_module_v1
   6:        0x11be0081c - _napi_register_module_v1
   7:        0x11be003c4 - _napi_register_module_v1
   8:        0x11bdff700 - _napi_register_module_v1
   9:        0x11be0007c - _napi_register_module_v1
  10:        0x11be6be7c - _napi_register_module_v1
  11:        0x11be6bffc - _napi_register_module_v1
  12:        0x11b17d6b8 - <unknown>
  13:        0x11b17b484 - <unknown>
  14:        0x11b175bcc - <unknown>
  15:        0x11b1734b0 - <unknown>
  16:        0x11b196528 - <unknown>
  17:        0x11b15be0c - <unknown>
  18:        0x11b0064b8 - <unknown>
  19:        0x11b076090 - <unknown>
  20:        0x11ae68ae4 - <unknown>
  21:        0x11ae5b260 - <unknown>
  22:        0x11be694d8 - _napi_register_module_v1
  23:        0x11bda69d0 - _napi_register_module_v1
  24:        0x11bdac404 - _napi_register_module_v1
  25:        0x11bdaaa14 - _napi_register_module_v1
  26:        0x11be04498 - _napi_register_module_v1
  27:        0x1972c5c0c - __pthread_cond_wait
Rayon: detected unexpected panic; aborting

💻 Code Sample

# Create the project
mkdir repro
cd repro
pnpm init
pnpm add parcel

# Create the MDX file
echo '<img alt="&stuff" />' > repro.mdx

# Build the project
RUST_BACKTRACE=full pnpm parcel build repro.mdx

🌍 Your Environment

Software	Version(s)
Parcel	2.14.4
Node	v23.10.0, v22.14.0
pnpm	10.7.0
Operating System	macOS 15.4 (24E248)