You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pouchdb.apache.org by "SourceR85 (via GitHub)" <gi...@apache.org> on 2026/06/04 08:56:40 UTC
[PR] refactor: drop UUID dependency [pouchdb]
SourceR85 opened a new pull request, #9253:
URL: https://github.com/apache/pouchdb/pull/9253
## Overview
This replaces the npm dependency [uuid](https://github.com/uuidjs/uuid) with standard [crypto.randomUUID](https://developer.mozilla.org/en-US/docs/Web/API/Crypto/randomUUID).
randomUUID generates UUID v4: the only version we're using in PouchDB.
## Related Issues or Pull Requests
Since uuid fixed another CVE in version 14 and introduced a breaking change in v13, dependabot's PR no longer succeeds:
https://github.com/apache/pouchdb/pull/9237
The PR by [mohagan9](https://github.com/mohagan9) (update to 11.1.1) will also be obsolete:
https://github.com/apache/pouchdb/pull/9250
## Checklist
- [x] I am not a bot
- [x] This is my own work, I did not use AI, LLM's or similar technology for code or docs generation
- [x] Code is written and works correctly
- [x] Changes are covered by tests
- [ ] I modified the [types](https://github.com/DefinitelyTyped/DefinitelyTyped/blob/master/types/pouchdb) to reflect the changes, if necessary
- [ ] Documentation changes were made in the `docs` folder
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pouchdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] refactor: drop UUID dependency [pouchdb]
Posted by "SourceR85 (via GitHub)" <gi...@apache.org>.
SourceR85 commented on code in PR #9253:
URL: https://github.com/apache/pouchdb/pull/9253#discussion_r3389183131
##########
packages/node_modules/pouchdb-utils/src/uuid-browser.js:
##########
@@ -0,0 +1,3 @@
+export default function uuid() {
+ return crypto.randomUUID();
Review Comment:
Polyfill for `randomUUID` is now applied:
Firefox and Chrome don't provide the function if context is insecure.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pouchdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] refactor: drop UUID dependency [pouchdb]
Posted by "SourceR85 (via GitHub)" <gi...@apache.org>.
SourceR85 commented on code in PR #9253:
URL: https://github.com/apache/pouchdb/pull/9253#discussion_r3557712049
##########
packages/node_modules/pouchdb-utils/src/uuid-browser.js:
##########
@@ -0,0 +1,41 @@
+function uuidPolyfill() {
+ const buffer = crypto.getRandomValues(new Uint8Array(16));
+
+ // https://en.wikipedia.org/wiki/Universally_unique_identifier#Version_4_(random)
+ // set bits for version: 4
+ buffer[6] = (buffer[6] & 0x0f) | 0x40;
+ // and variant: 1
+ buffer[8] = (buffer[8] & 0x3f) | 0x80;
+
+ const str = toHex(buffer);
+
+ return str.slice(0, 8) + "-"
+ + str.slice(8, 12) + "-"
+ + str.slice(12, 16) + "-"
+ + str.slice(12, 16) + "-"
Review Comment:
You're my implementation is 41 chars long... should be 36 🤦
We already have `tests/test.uuids.js` who should call the uuid, but it doesn't run with polyfill.
I think, I have to export a function to evaluate randomUUID availability at runtime, so I can remove the native function for testing.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pouchdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] refactor: drop UUID dependency [pouchdb]
Posted by "SourceR85 (via GitHub)" <gi...@apache.org>.
SourceR85 commented on code in PR #9253:
URL: https://github.com/apache/pouchdb/pull/9253#discussion_r3557712049
##########
packages/node_modules/pouchdb-utils/src/uuid-browser.js:
##########
@@ -0,0 +1,41 @@
+function uuidPolyfill() {
+ const buffer = crypto.getRandomValues(new Uint8Array(16));
+
+ // https://en.wikipedia.org/wiki/Universally_unique_identifier#Version_4_(random)
+ // set bits for version: 4
+ buffer[6] = (buffer[6] & 0x0f) | 0x40;
+ // and variant: 1
+ buffer[8] = (buffer[8] & 0x3f) | 0x80;
+
+ const str = toHex(buffer);
+
+ return str.slice(0, 8) + "-"
+ + str.slice(8, 12) + "-"
+ + str.slice(12, 16) + "-"
+ + str.slice(12, 16) + "-"
Review Comment:
You're right: my implementation is 41 chars long... should be 36 🤦
We already have `tests/test.uuids.js` who should call the uuid, but it doesn't run with polyfill.
I think, I have to export a function to evaluate randomUUID availability at runtime, so I can remove the native function for testing.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pouchdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] refactor: drop UUID dependency [pouchdb]
Posted by "SourceR85 (via GitHub)" <gi...@apache.org>.
SourceR85 commented on code in PR #9253:
URL: https://github.com/apache/pouchdb/pull/9253#discussion_r3557931638
##########
packages/node_modules/pouchdb-utils/src/uuid-browser.js:
##########
@@ -0,0 +1,41 @@
+function uuidPolyfill() {
+ const buffer = crypto.getRandomValues(new Uint8Array(16));
+
+ // https://en.wikipedia.org/wiki/Universally_unique_identifier#Version_4_(random)
+ // set bits for version: 4
+ buffer[6] = (buffer[6] & 0x0f) | 0x40;
+ // and variant: 1
+ buffer[8] = (buffer[8] & 0x3f) | 0x80;
+
+ const str = toHex(buffer);
+
+ return str.slice(0, 8) + "-"
+ + str.slice(8, 12) + "-"
+ + str.slice(12, 16) + "-"
+ + str.slice(12, 16) + "-"
Review Comment:
I've updated my implementation and add a test for polyfill mode.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pouchdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] refactor: drop UUID dependency [pouchdb]
Posted by "SourceR85 (via GitHub)" <gi...@apache.org>.
SourceR85 commented on code in PR #9253:
URL: https://github.com/apache/pouchdb/pull/9253#discussion_r3557506386
##########
packages/node_modules/pouchdb-utils/src/rev.js:
##########
@@ -7,7 +6,7 @@ import { stringMd5 } from 'pouchdb-md5';
*/
function rev(doc, deterministic_revs) {
if (!deterministic_revs) {
- return uuidV4().replace(/-/g, '').toLowerCase();
+ return crypto.randomUUID().replace(/-/g, '').toLowerCase();
Review Comment:
Ah, damn... I implemented the polyfill after the hint from you: seems like I missed to revert that line.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pouchdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] refactor: drop UUID dependency [pouchdb]
Posted by "SourceR85 (via GitHub)" <gi...@apache.org>.
SourceR85 commented on code in PR #9253:
URL: https://github.com/apache/pouchdb/pull/9253#discussion_r3557931638
##########
packages/node_modules/pouchdb-utils/src/uuid-browser.js:
##########
@@ -0,0 +1,41 @@
+function uuidPolyfill() {
+ const buffer = crypto.getRandomValues(new Uint8Array(16));
+
+ // https://en.wikipedia.org/wiki/Universally_unique_identifier#Version_4_(random)
+ // set bits for version: 4
+ buffer[6] = (buffer[6] & 0x0f) | 0x40;
+ // and variant: 1
+ buffer[8] = (buffer[8] & 0x3f) | 0x80;
+
+ const str = toHex(buffer);
+
+ return str.slice(0, 8) + "-"
+ + str.slice(8, 12) + "-"
+ + str.slice(12, 16) + "-"
+ + str.slice(12, 16) + "-"
Review Comment:
I've updated my implementation and add a test for "insecure" mode.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pouchdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] refactor: drop UUID dependency [pouchdb]
Posted by "alxndrsn (via GitHub)" <gi...@apache.org>.
alxndrsn commented on code in PR #9253:
URL: https://github.com/apache/pouchdb/pull/9253#discussion_r3385947453
##########
packages/node_modules/pouchdb-utils/src/uuid-browser.js:
##########
@@ -0,0 +1,3 @@
+export default function uuid() {
+ return crypto.randomUUID();
Review Comment:
Does this break http:// support?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pouchdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] refactor: drop UUID dependency [pouchdb]
Posted by "alxndrsn (via GitHub)" <gi...@apache.org>.
alxndrsn commented on code in PR #9253:
URL: https://github.com/apache/pouchdb/pull/9253#discussion_r3556718409
##########
packages/node_modules/pouchdb-utils/src/uuid-browser.js:
##########
@@ -0,0 +1,41 @@
+function uuidPolyfill() {
+ const buffer = crypto.getRandomValues(new Uint8Array(16));
+
+ // https://en.wikipedia.org/wiki/Universally_unique_identifier#Version_4_(random)
+ // set bits for version: 4
+ buffer[6] = (buffer[6] & 0x0f) | 0x40;
+ // and variant: 1
+ buffer[8] = (buffer[8] & 0x3f) | 0x80;
+
+ const str = toHex(buffer);
+
+ return str.slice(0, 8) + "-"
+ + str.slice(8, 12) + "-"
+ + str.slice(12, 16) + "-"
+ + str.slice(12, 16) + "-"
Review Comment:
I suspect this means the generated UUID will be the wrong length. Maybe worth a small test?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pouchdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] refactor: drop UUID dependency [pouchdb]
Posted by "SourceR85 (via GitHub)" <gi...@apache.org>.
SourceR85 commented on code in PR #9253:
URL: https://github.com/apache/pouchdb/pull/9253#discussion_r3389183131
##########
packages/node_modules/pouchdb-utils/src/uuid-browser.js:
##########
@@ -0,0 +1,3 @@
+export default function uuid() {
+ return crypto.randomUUID();
Review Comment:
[Polyfill](https://github.com/apache/pouchdb/pull/9253/changes/17dbdaec1d97ee0a7c80271ce176e4f77d0271f0) is now applied
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pouchdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] refactor: drop UUID dependency [pouchdb]
Posted by "SourceR85 (via GitHub)" <gi...@apache.org>.
SourceR85 commented on code in PR #9253:
URL: https://github.com/apache/pouchdb/pull/9253#discussion_r3388759368
##########
packages/node_modules/pouchdb-utils/src/uuid-browser.js:
##########
@@ -0,0 +1,3 @@
+export default function uuid() {
+ return crypto.randomUUID();
Review Comment:
You're right: it only works in secure context: https (works despite invalid certificates in FF) or localhost.
That requirement not applied in all browser engines, but strict in specs.
I'll later push a polyfill for that case.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pouchdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] refactor: drop UUID dependency [pouchdb]
Posted by "SourceR85 (via GitHub)" <gi...@apache.org>.
SourceR85 commented on code in PR #9253:
URL: https://github.com/apache/pouchdb/pull/9253#discussion_r3389183131
##########
packages/node_modules/pouchdb-utils/src/uuid-browser.js:
##########
@@ -0,0 +1,3 @@
+export default function uuid() {
+ return crypto.randomUUID();
Review Comment:
[Polyfill](https://github.com/apache/pouchdb/pull/9253/changes/67a95fc3d56980cdac1478f0559de61afa6ecb6f) is now applied
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pouchdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] refactor: drop UUID dependency [pouchdb]
Posted by "alxndrsn (via GitHub)" <gi...@apache.org>.
alxndrsn commented on code in PR #9253:
URL: https://github.com/apache/pouchdb/pull/9253#discussion_r3556658527
##########
packages/node_modules/pouchdb-utils/src/rev.js:
##########
@@ -7,7 +6,7 @@ import { stringMd5 } from 'pouchdb-md5';
*/
function rev(doc, deterministic_revs) {
if (!deterministic_revs) {
- return uuidV4().replace(/-/g, '').toLowerCase();
+ return crypto.randomUUID().replace(/-/g, '').toLowerCase();
Review Comment:
I think you can drop `toLowerCase()` here - the spec says:
> For the steps described in the algorithm to [generate a random UUID](https://w3c.github.io/webcrypto/#dfn-generate-a-random-uuid), the _**hexadecimal representation**_ of a byte _value_ is the two-character string created by expressing _value_ in hexadecimal using [ASCII lower hex digits](https://infra.spec.whatwg.org/#ascii-lower-hex-digit)
> - https://w3c.github.io/webcrypto/#Crypto-method-randomUUID
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pouchdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] refactor: drop UUID dependency [pouchdb]
Posted by "alxndrsn (via GitHub)" <gi...@apache.org>.
alxndrsn commented on code in PR #9253:
URL: https://github.com/apache/pouchdb/pull/9253#discussion_r3556664171
##########
packages/node_modules/pouchdb-utils/src/rev.js:
##########
@@ -7,7 +6,7 @@ import { stringMd5 } from 'pouchdb-md5';
*/
function rev(doc, deterministic_revs) {
if (!deterministic_revs) {
- return uuidV4().replace(/-/g, '').toLowerCase();
+ return crypto.randomUUID().replace(/-/g, '').toLowerCase();
Review Comment:
Also is there a reason to use `crypto.randomUUID()` directly in preference to the new `uuid` package?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pouchdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org