Background
src/server.js uses import { v4 as uuid } from "uuid" to generate client IDs. Node.js 14.17+ ships crypto.randomUUID() as a built-in that is cryptographically equivalent and requires no third-party dependency. The uuid package is listed as a production dependency in package.json, adding unnecessary bundle weight and a supply-chain risk surface.
Category: Refactor / Technical Debt
Difficulty: Good First Issue
Priority: Low
Labels: refactor, backend, good first issue
Problem Statement
The uuid package adds ~50 KB to the production install and introduces an external dependency where a zero-cost built-in suffices. Removing it reduces attack surface and simplifies the dependency tree.
Requirements
- Replace
uuid with crypto.randomUUID() in src/server.js.
- Remove the
uuid package from dependencies in package.json.
- Run
npm install to update package-lock.json.
- Verify generated IDs are still RFC 4122 v4 UUID strings.
Acceptance Criteria
Implementation Notes
// Before
import { v4 as uuid } from 'uuid';
const clientId = uuid();
// After
import { randomUUID } from 'crypto';
const clientId = randomUUID();Use the explicit import { randomUUID } from 'crypto' for Node 18 compatibility rather than the crypto.randomUUID() global form.
Files Likely to Change
src/server.jspackage.jsonpackage-lock.json
Definition of Done
uuid removed from dependency tree. npm ci installs one fewer package. All tests pass.
Estimated Complexity
Good First Issue — mechanical substitution, no logic change.
Background
src/server.jsusesimport { v4 as uuid } from "uuid"to generate client IDs. Node.js 14.17+ shipscrypto.randomUUID()as a built-in that is cryptographically equivalent and requires no third-party dependency. Theuuidpackage is listed as a production dependency inpackage.json, adding unnecessary bundle weight and a supply-chain risk surface.Category: Refactor / Technical Debt
Difficulty: Good First Issue
Priority: Low
Labels: refactor, backend, good first issue
Problem Statement
The
uuidpackage adds ~50 KB to the production install and introduces an external dependency where a zero-cost built-in suffices. Removing it reduces attack surface and simplifies the dependency tree.Requirements
uuidwithcrypto.randomUUID()insrc/server.js.uuidpackage fromdependenciesinpackage.json.npm installto updatepackage-lock.json.Acceptance Criteria
importorrequireofuuidexists anywhere insrc/.uuiddoes not appear inpackage.jsondependencies.Implementation Notes
Use the explicit
import { randomUUID } from 'crypto'for Node 18 compatibility rather than thecrypto.randomUUID()global form.Files Likely to Change
src/server.jspackage.jsonpackage-lock.jsonDefinition of Done
uuidremoved from dependency tree.npm ciinstalls one fewer package. All tests pass.Estimated Complexity
Good First Issue — mechanical substitution, no logic change.