[CVE] Bump serialize-javascript

.github/workflows/ci.yml

@@ -16,6 +16,7 @@ jobs:
           # - build-tests-samples/heft-storybook-v9-react-tutorial/build.js
           # - build-tests-samples/heft-storybook-v9-react-tutorial-app/build.js
           # - The "globalOverrides" entry for "@vscode/vsce>cheerio" in common/config/rush/pnpm-config.json
+          # - libraries/module-minifier/src/cryptoPolyfill.ts
           - NodeVersion: 18.20.x
             NodeVersionDisplayName: 18
             OS: ubuntu-latest

build-tests/api-extractor-test-05/dist/tsdoc-metadata.json

@@ -5,7 +5,7 @@
   "toolPackages": [
     {
       "packageName": "@microsoft/api-extractor",
-      "packageVersion": "7.57.5"
+      "packageVersion": "7.57.7"
     }
   ]
 }

common/changes/@rushstack/module-minifier/main_2026-03-06-03-25.json

@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/module-minifier",
+      "comment": "Bump `serialize-javascript` to partially mitigate CVE-2020-7660.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/module-minifier"
+}

common/config/subspaces/default/repo-state.json

@@ -1,5 +1,5 @@
 // DO NOT MODIFY THIS FILE MANUALLY BUT DO COMMIT IT. It is generated and used by Rush.
 {
-  "pnpmShrinkwrapHash": "be66b5ed1c7f3c2a1db832792d98db6bb436ff17",
+  "pnpmShrinkwrapHash": "8cea08431b1a848463c751666dcd35e9533ea73d",
   "preferredVersionsHash": "029c99bd6e65c5e1f25e2848340509811ff9753c"
 }

libraries/module-minifier/package.json

@@ -40,14 +40,14 @@
   },
   "dependencies": {
     "@rushstack/worker-pool": "workspace:*",
-    "serialize-javascript": "6.0.2",
+    "serialize-javascript": "7.0.3",
     "source-map": "~0.7.3",
     "terser": "^5.9.0"
   },
   "devDependencies": {
     "@rushstack/heft": "workspace:*",
     "@types/node": "20.17.19",
-    "@types/serialize-javascript": "5.0.2",
+    "@types/serialize-javascript": "5.0.4",
     "eslint": "~9.37.0",
     "local-node-rig": "workspace:*"
   },

libraries/module-minifier/src/LocalMinifier.ts

@@ -3,6 +3,7 @@
 
 import { createHash } from 'node:crypto';
 
+import './cryptoPolyfill';
 import serialize from 'serialize-javascript';
 import type { MinifyOptions } from 'terser';
 

libraries/module-minifier/src/WorkerPoolMinifier.ts

@@ -5,6 +5,7 @@ import { createHash } from 'node:crypto';
 import os from 'node:os';
 import type { ResourceLimits } from 'node:worker_threads';
 
+import './cryptoPolyfill';
 import serialize from 'serialize-javascript';
 import type { MinifyOptions } from 'terser';
 

libraries/module-minifier/src/cryptoPolyfill.ts

@@ -0,0 +1,13 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+// Polyfill globalThis.crypto for Node 18, which doesn't expose it as a global.
+// serialize-javascript accesses crypto.randomBytes() at module load time,
+// which requires globalThis.crypto to be the Node.js crypto module.
+// Remove this when deprecating nodev18 support.
+import { webcrypto } from 'node:crypto';
+
+if (!globalThis.crypto) {
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  (globalThis as any).crypto = webcrypto;
+}