fix(deps): remove vulnerable dependency uuid

core/packages/teeny-request/package.json

@@ -52,7 +52,6 @@
     "@types/mocha": "^10.0.10",
     "@types/node-fetch": "^2.6.12",
     "@types/sinon": "^17.0.3",
-    "@types/uuid": "^10.0.0",
     "c8": "^10.1.3",
     "codecov": "^3.8.3",
     "gts": "^6.0.2",

core/paginator/package.json

@@ -37,7 +37,6 @@
     "@types/node": "^22.13.8",
     "@types/proxyquire": "^1.3.31",
     "@types/sinon": "^17.0.4",
-    "@types/uuid": "^10.0.0",
     "c8": "^10.1.3",
     "codecov": "^3.8.3",
     "gts": "^6.0.2",
@@ -49,8 +48,7 @@
     "path-to-regexp": "^8.2.0",
     "proxyquire": "^2.1.3",
     "sinon": "^19.0.2",
-    "typescript": "^5.8.2",
-    "uuid": "^11.1.0"
+    "typescript": "^5.8.2"
   },
   "dependencies": {
     "extend": "^3.0.2"

core/paginator/test/index.ts

@@ -17,7 +17,7 @@ import {describe, it, beforeEach, afterEach} from 'mocha';
 import * as proxyquire from 'proxyquire';
 import * as sinon from 'sinon';
 import {PassThrough, Transform} from 'stream';
-import * as uuid from 'uuid';
+import * as crypto from 'crypto';
 import * as P from '../src';
 import {paginator, ParsedArguments} from '../src';
 
@@ -53,7 +53,7 @@ function createFakeStream<T = any>() {
 }
 
 describe('paginator', () => {
-  const UUID = uuid.v1();
+  const UUID = crypto.randomUUID();
   function FakeClass() {
     // do nothing
   }
@@ -124,7 +124,7 @@ describe('paginator', () => {
 
       /* eslint-disable  @typescript-eslint/no-explicit-any */
       const cls = new (FakeClass as any)();
-      cls.uuid = uuid.v1();
+      cls.uuid = crypto.randomUUID();
 
       sandbox.stub(paginator, 'run_').callsFake((_, originalMethod) => {
         assert.strictEqual(originalMethod(), cls.uuid);

handwritten/bigquery-storage/package.json

@@ -49,7 +49,6 @@
     "@types/mocha": "^10.0.10",
     "@types/node": "^22.13.14",
     "@types/sinon": "^21.0.0",
-    "@types/uuid": "^10.0.0",
     "avsc": "^5.7.9",
     "c8": "^10.1.3",
     "gapic-tools": "^1.0.1",
@@ -66,7 +65,6 @@
     "sinon": "21.0.3",
     "ts-loader": "^9.5.2",
     "typescript": "^5.8.2",
-    "uuid": "^11.1.0",
     "webpack": "^5.98.0",
     "webpack-cli": "^6.0.1"
   },

handwritten/bigquery-storage/system-test/managed_writer_client_test.ts

@@ -16,7 +16,7 @@ import * as assert from 'assert';
 import {readFileSync} from 'fs';
 import * as path from 'path';
 import {describe, it} from 'mocha';
-import * as uuid from 'uuid';
+import * as crypto from 'crypto';
 import * as gax from 'google-gax';
 import * as sinon from 'sinon';
 import {BigQuery, TableSchema} from '@google-cloud/bigquery';
@@ -59,7 +59,7 @@ const FieldDescriptorProtoType =
 const GCLOUD_TESTS_PREFIX = 'nodejs_bqstorage_system_test';
 const bigquery = new BigQuery();
 const generateUuid = () =>
-  `${GCLOUD_TESTS_PREFIX}_${uuid.v4()}`.replace(/-/gi, '_');
+  `${GCLOUD_TESTS_PREFIX}_${crypto.randomUUID()}`.replace(/-/gi, '_');
 const datasetId = generateUuid();
 
 const sleep = (ms: number) =>

handwritten/bigquery-storage/system-test/reader_client_test.ts

@@ -15,7 +15,7 @@
 import * as assert from 'assert';
 import {describe, it} from 'mocha';
 import * as gax from 'google-gax';
-import * as uuid from 'uuid';
+import * as crypto from 'crypto';
 import * as sinon from 'sinon';
 import {BigQuery, TableRow, TableSchema} from '@google-cloud/bigquery';
 import * as protos from '../protos/protos';
@@ -46,7 +46,7 @@ if (process.env.NODE_ENV === 'DEBUG') {
 const GCLOUD_TESTS_PREFIX = 'nodejs_bqstorage_system_test';
 const bigquery = new BigQuery();
 const generateUuid = () =>
-  `${GCLOUD_TESTS_PREFIX}_${uuid.v4()}`.replace(/-/gi, '_');
+  `${GCLOUD_TESTS_PREFIX}_${crypto.randomUUID()}`.replace(/-/gi, '_');
 const datasetId = generateUuid();
 
 const sleep = (ms: number) =>

handwritten/bigtable/package.json

@@ -91,7 +91,6 @@
     "@types/proxyquire": "^1.3.31",
     "@types/pumpify": "^1.4.4",
     "@types/sinon": "^17.0.4",
-    "@types/uuid": "^10.0.0",
     "c8": "^10.1.3",
     "codecov": "^3.8.3",
     "gapic-tools": "^1.0.1",
@@ -109,7 +108,6 @@
     "tcp-port-used": "^1.0.2",
     "ts-loader": "^9.5.2",
     "typescript": "^5.8.2",
-    "uuid": "8.0.0",
     "webpack": "^5.98.0",
     "webpack-cli": "^6.0.1"
   },

handwritten/bigtable/system-test/common.ts

@@ -12,14 +12,14 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-import * as uuid from 'uuid';
+import * as crypto from 'crypto';
 import {Cluster} from '../src/cluster';
 import * as inst from '../src/instance';
 
 export const PREFIX = 'gt-';
 
 export function generateId(resourceType: string) {
-  const newUuid = uuid.v1().substr(4, 4);
+  const newUuid = crypto.randomUUID().substr(4, 4);
   return `${PREFIX}${resourceType}-${newUuid}-${Date.now()}`;
 }
 

handwritten/error-reporting/package.json

@@ -51,7 +51,6 @@
     "@types/once": "^1.4.5",
     "@types/proxyquire": "^1.3.31",
     "@types/restify": "^8.0.0",
-    "@types/uuid": "^8.3.0",
     "boom": "^7.2.0",
     "c8": "^10.1.3",
     "codecov": "^3.6.2",
@@ -67,8 +66,7 @@
     "pack-n-play": "^2.0.0",
     "proxyquire": "^2.1.3",
     "restify": "^11.0.0",
-    "typescript": "^5.9.3",
-    "uuid": "^8.3.2"
+    "typescript": "^5.9.3"
   },
 "overrides": {
     "undici": "5.28.4",

handwritten/error-reporting/system-test/error-reporting.ts

@@ -28,7 +28,7 @@ import {
   ErrorsApiTransport,
 } from '../utils/errors-api-transport';
 
-import * as uuid from 'uuid';
+import * as crypto from 'crypto';
 import * as util from 'util';
 import * as path from 'path';
 
@@ -446,7 +446,7 @@ describe('Expected Behavior', () => {
 
 describe('error-reporting', () => {
   const SRC_ROOT = path.join(__dirname, '..', 'src');
-  const UUID = uuid.v4();
+  const UUID = crypto.randomUUID();
   const BASE_NAME = 'error-reporting-system-test';
   function buildName(suffix: string) {
     return [UUID, BASE_NAME, suffix].join('_');

handwritten/logging-bunyan/package.json

@@ -65,7 +65,6 @@
     "@types/mocha": "^9.0.0",
     "@types/node": "^20.4.9",
     "@types/proxyquire": "^1.3.28",
-    "@types/uuid": "^10.0.0",
     "bunyan": "^1.8.12",
     "c8": "^9.0.0",
     "codecov": "^3.0.2",
@@ -80,8 +79,7 @@
     "mocha": "^9.2.2",
     "post-install-check": "0.0.1",
     "proxyquire": "^2.0.1",
-    "typescript": "^5.1.6",
-    "uuid": "^10.0.0"
+    "typescript": "^5.1.6"
   },
   "peerDependencies": {
     "bunyan": "*"

handwritten/logging-bunyan/system-test/logging-bunyan.ts

@@ -17,7 +17,7 @@
 import * as assert from 'assert';
 import {describe, it} from 'mocha';
 import * as bunyan from 'bunyan';
-import * as uuid from 'uuid';
+import * as crypto from 'crypto';
 import * as types from '../src/types/core';
 import {ErrorsApiTransport} from './errors-transport';
 import {Logging, LogSync} from '@google-cloud/logging';
@@ -30,7 +30,7 @@ import * as instrumentation from '@google-cloud/logging/build/src/utils/instrume
 const WRITE_CONSISTENCY_DELAY_MS = 90000;
 const MESSAGE = 'Diagnostic test';
 
-const UUID = uuid.v4();
+const UUID = crypto.randomUUID();
 function logName(name: string) {
   return `${UUID}_${name}`;
 }

handwritten/logging-bunyan/system-test/test-middleware-express.ts

@@ -19,15 +19,15 @@
 import * as assert from 'assert';
 import {describe, it, before} from 'mocha';
 import delay from 'delay';
-import * as uuid from 'uuid';
+import * as crypto from 'crypto';
 import {express as elb} from '../src/index';
 import {Logging} from '@google-cloud/logging';
 
 const logging = new Logging();
 
 const WRITE_CONSISTENCY_DELAY_MS = 20 * 1000;
 const TEST_TIMEOUT = WRITE_CONSISTENCY_DELAY_MS + 10 * 1000;
-const LOG_NAME = `bunyan-system-test-${uuid.v4()}`;
+const LOG_NAME = `bunyan-system-test-${crypto.randomUUID()}`;
 
 describe('express middleware', () => {
   let logger: elb.MiddlewareReturnType['logger'];
@@ -40,7 +40,7 @@ describe('express middleware', () => {
   describe('global logger', () => {
     it('should properly write log entries', async function () {
       this.timeout(TEST_TIMEOUT);
-      const LOG_MESSAGE = `unique log message ${uuid.v4()}`;
+      const LOG_MESSAGE = `unique log message ${crypto.randomUUID()}`;
       logger.info(LOG_MESSAGE);
 
       await delay(WRITE_CONSISTENCY_DELAY_MS);
@@ -55,7 +55,7 @@ describe('express middleware', () => {
   describe('request logging middleware', () => {
     it('should write request correlated log entries', function (done) {
       this.timeout(TEST_TIMEOUT);
-      const LOG_MESSAGE = `correlated log message ${uuid.v4()}`;
+      const LOG_MESSAGE = `correlated log message ${crypto.randomUUID()}`;
       const fakeRequest = {headers: {fake: 'header'}};
       const fakeResponse = {};
       const next = async () => {

handwritten/logging/package.json

@@ -65,8 +65,7 @@
     "long": "^5.3.2",
     "on-finished": "^2.3.0",
     "pumpify": "^2.0.1",
-    "stream-events": "^1.0.5",
-    "uuid": "^9.0.0"
+    "stream-events": "^1.0.5"
   },
   "devDependencies": {
     "@google-cloud/bigquery": "^7.0.0",
@@ -86,7 +85,6 @@
     "@types/proxyquire": "^1.3.28",
     "@types/pumpify": "^1.4.1",
     "@types/sinon": "^10.0.0",
-    "@types/uuid": "^9.0.0",
     "bignumber.js": "^9.0.0",
     "c8": "^9.0.0",
     "codecov": "^3.6.5",

handwritten/logging/src/utils/context.ts

@@ -28,7 +28,6 @@
  */
 
 import * as http from 'http';
-import * as uuid from 'uuid';
 import * as crypto from 'crypto';
 import {trace, isSpanContextValid} from '@opentelemetry/api';
 
@@ -151,7 +150,7 @@ function toCloudTraceContext(
  * makeCloudTraceHeader generates valid X-Cloud-Trace-Context trace and spanId.
  */
 function makeCloudTraceHeader(): string {
-  const trace = uuid.v4().replace(/-/g, '');
+  const trace = crypto.randomUUID().replace(/-/g, '');
   const spanId = spanRandomBuffer().toString('hex');
   return `${trace}/${spanId}`;
 }

handwritten/logging/system-test/logging.ts

@@ -22,7 +22,7 @@ import {describe, it} from 'mocha';
 import {HOST_ADDRESS} from 'gcp-metadata';
 import * as nock from 'nock';
 import {Duplex} from 'stream';
-import {v4} from 'uuid';
+import * as crypto from 'crypto';
 import {after, before} from 'mocha';
 // eslint-disable-next-line @typescript-eslint/no-var-requires
 const http2spy = require('http2spy');
@@ -1003,7 +1003,7 @@ describe('Logging', () => {
   });
 
   function generateName() {
-    return `${TESTS_PREFIX}-${Date.now()}-${v4().split('-').pop()}`;
+    return `${TESTS_PREFIX}-${Date.now()}-${crypto.randomUUID().split('-').pop()}`;
   }
 
   // Parse the time the resource was created using the resource id

handwritten/pubsub/package.json

@@ -83,7 +83,6 @@
     "@types/proxyquire": "^1.3.31",
     "@types/sinon": "^21.0.0",
     "@types/tmp": "^0.2.6",
-    "@types/uuid": "^11.0.0",
     "c8": "^10.1.3",
     "codecov": "^3.8.3",
     "execa": "~5.1.0",
@@ -105,7 +104,6 @@
     "tmp": "^0.2.3",
     "ts-loader": "^9.5.2",
     "typescript": "^5.8.3",
-    "uuid": "^11.1.0",
     "webpack": "^5.99.5",
     "webpack-cli": "^6.0.1",
     "why-is-node-running": "^2.3.0",

handwritten/pubsub/test/message-queues.ts

@@ -19,7 +19,7 @@ import {describe, it, before, beforeEach, afterEach} from 'mocha';
 import {EventEmitter} from 'events';
 import {CallOptions, GoogleError, loggingUtils, Status} from 'google-gax';
 import * as sinon from 'sinon';
-import * as uuid from 'uuid';
+import * as crypto from 'crypto';
 import defer = require('p-defer');
 
 import * as messageTypes from '../src/message-queues';
@@ -55,7 +55,7 @@ class FakeSubscriber extends EventEmitter {
   constructor() {
     super();
 
-    this.name = `projects/test/subscriptions/${uuid.v4()}`;
+    this.name = `projects/test/subscriptions/${crypto.randomUUID()}`;
     this.client = new FakeClient();
     this.iEOS = false;
   }
@@ -70,7 +70,7 @@ class FakeSubscriber extends EventEmitter {
 class FakeMessage {
   ackId: string;
   constructor() {
-    this.ackId = uuid.v4();
+    this.ackId = crypto.randomUUID();
   }
 }
 

handwritten/pubsub/test/message-stream.ts

@@ -20,7 +20,7 @@ import {grpc} from 'google-gax';
 import * as proxyquire from 'proxyquire';
 import * as sinon from 'sinon';
 import {Duplex, PassThrough} from 'stream';
-import * as uuid from 'uuid';
+import * as crypto from 'crypto';
 import * as defer from 'p-defer';
 import {promisify} from 'util';
 
@@ -134,7 +134,7 @@ class FakeSubscriber {
   maxBytes: number;
   client: FakeGaxClient;
   constructor(client: FakeGaxClient) {
-    this.name = uuid.v4();
+    this.name = crypto.randomUUID();
     this.ackDeadline = Math.floor(Math.random() * 600);
     this.maxMessages = 20;
     this.maxBytes = 4000;