polyfill crypto directly not just in test, update rush comment

Author: cmalonzo

build-tests/api-extractor-test-05/dist/tsdoc-metadata.json

@@ -5,7 +5,7 @@
   "toolPackages": [
     {
       "packageName": "@microsoft/api-extractor",
-      "packageVersion": "7.57.5"
+      "packageVersion": "7.57.7"
     }
   ]
 }

common/changes/@rushstack/module-minifier/main_2026-03-06-03-25.json

@@ -2,7 +2,7 @@
   "changes": [
     {
       "packageName": "@rushstack/module-minifier",
-      "comment": "Bump serialize-javascript",
+      "comment": "Bump `serialize-javascript` to partially mitigate CVE-2020-7660.",
       "type": "patch"
     }
   ],

libraries/module-minifier/config/jest-setup.js

@@ -1,4 +1,3 @@
 {
-  "extends": "local-node-rig/profiles/default/config/jest.config.json",
-  "setupFiles": ["<rootDir>/config/jest-setup.js"]
+  "extends": "local-node-rig/profiles/default/config/jest.config.json"
 }

libraries/module-minifier/config/jest.config.json

@@ -3,6 +3,7 @@
 
 import { createHash } from 'node:crypto';
 
+import './cryptoPolyfill';
 import serialize from 'serialize-javascript';
 import type { MinifyOptions } from 'terser';
 

libraries/module-minifier/src/LocalMinifier.ts

@@ -5,6 +5,7 @@ import { createHash } from 'node:crypto';
 import os from 'node:os';
 import type { ResourceLimits } from 'node:worker_threads';
 
+import './cryptoPolyfill';
 import serialize from 'serialize-javascript';
 import type { MinifyOptions } from 'terser';
 

libraries/module-minifier/src/WorkerPoolMinifier.ts

@@ -0,0 +1,13 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+// Polyfill globalThis.crypto for Node 18, which doesn't expose it as a global.
+// serialize-javascript accesses crypto.randomBytes() at module load time,
+// which requires globalThis.crypto to be the Node.js crypto module.
+// Remove this when deprecating nodev18 support.
+import { webcrypto } from 'node:crypto';
+
+if (!globalThis.crypto) {
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  (globalThis as any).crypto = webcrypto;
+}