CommunitySolidServer · joachimvh · Jun 22, 2026 · Jun 22, 2026 · Jun 22, 2026
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -97,7 +97,6 @@
     "@types/rdf-validate-shacl": "^0.4.4",
     "@types/sparqljs": "^3.1.6",
     "@types/url-join": "^4.0.1",
-    "@types/uuid": "^9.0.5",
     "@types/ws": "^8.5.7",
     "@types/yargs": "^17.0.28",
     "arrayify-stream": "^2.0.1",
@@ -136,7 +135,6 @@
     "sparqlalgebrajs": "^4.3.0",
     "sparqljs": "^3.7.1",
     "url-join": "^4.0.1",
-    "uuid": "^9.0.1",
     "winston": "^3.11.0",
     "winston-transport": "^4.5.0",
     "ws": "^8.14.2",

diff --git a/src/identity/interaction/account/util/BaseCookieStore.ts b/src/identity/interaction/account/util/BaseCookieStore.ts
@@ -1,4 +1,4 @@
-import { v4 } from 'uuid';
+import { randomUUID } from 'node:crypto';
 import type { ExpiringStorage } from '../../../../storage/keyvalue/ExpiringStorage';
 import type { CookieStore } from './CookieStore';
 
@@ -17,7 +17,7 @@ export class BaseCookieStore implements CookieStore {
   }
 
   public async generate(accountId: string): Promise<string> {
-    const cookie = v4();
+    const cookie = randomUUID();
     await this.storage.set(cookie, accountId, this.ttl);
     return cookie;
   }

diff --git a/src/identity/interaction/client-credentials/CreateClientCredentialsHandler.ts b/src/identity/interaction/client-credentials/CreateClientCredentialsHandler.ts
@@ -1,4 +1,4 @@
-import { v4 } from 'uuid';
+import { randomUUID } from 'node:crypto';
 import { object, string } from 'yup';
 import { getLoggerFor } from '../../../logging/LogUtil';
 import { BadRequestHttpError } from '../../../util/errors/BadRequestHttpError';
@@ -65,7 +65,7 @@ export class CreateClientCredentialsHandler extends JsonInteractionHandler<OutTy
     }
 
     const cleanedName = name ? sanitizeUrlPart(name.trim()) : '';
-    const label = `${cleanedName}_${v4()}`;
+    const label = `${cleanedName}_${randomUUID()}`;
 
     const { secret, id } = await this.clientCredentialsStore.create(label, webId, accountId);
     const resource = this.clientCredentialsRoute.getPath({ accountId, clientCredentialsId: id });

diff --git a/src/identity/interaction/password/util/BaseForgotPasswordStore.ts b/src/identity/interaction/password/util/BaseForgotPasswordStore.ts
@@ -1,4 +1,4 @@
-import { v4 } from 'uuid';
+import { randomUUID } from 'node:crypto';
 import type { ExpiringStorage } from '../../../../storage/keyvalue/ExpiringStorage';
 import type { ForgotPasswordStore } from './ForgotPasswordStore';
 
@@ -15,7 +15,7 @@ export class BaseForgotPasswordStore implements ForgotPasswordStore {
   }
 
   public async generate(email: string): Promise<string> {
-    const recordId = v4();
+    const recordId = randomUUID();
     await this.storage.set(recordId, email, this.ttl);
     return recordId;
   }

diff --git a/src/identity/ownership/TokenOwnershipValidator.ts b/src/identity/ownership/TokenOwnershipValidator.ts
@@ -1,6 +1,6 @@
+import { randomUUID } from 'node:crypto';
 import type { Quad } from 'n3';
 import { DataFactory } from 'n3';
-import { v4 } from 'uuid';
 import { getLoggerFor } from '../../logging/LogUtil';
 import type { ExpiringStorage } from '../../storage/keyvalue/ExpiringStorage';
 import { BadRequestHttpError } from '../../util/errors/BadRequestHttpError';
@@ -78,7 +78,7 @@ export class TokenOwnershipValidator extends OwnershipValidator {
    * Generates a random verification token;
    */
   private generateToken(): string {
-    return v4();
+    return randomUUID();
   }
 
   /**

diff --git a/src/server/notifications/BaseChannelType.ts b/src/server/notifications/BaseChannelType.ts
@@ -1,3 +1,4 @@
+import { randomUUID } from 'node:crypto';
 import { Readable } from 'node:stream';
 import { KeysRdfParseJsonLd } from '@comunica/context-entries';
 import { parse, toSeconds } from 'iso8601-duration';
@@ -6,7 +7,6 @@ import type { Store } from 'n3';
 import type { NamedNode, Term } from '@rdfjs/types';
 import rdfParser from 'rdf-parse';
 import SHACLValidator from 'rdf-validate-shacl';
-import { v4 } from 'uuid';
 import type { Credentials } from '../../authentication/Credentials';
 import type { AccessMap } from '../../authorization/permissions/Permissions';
 import { AccessMode } from '../../authorization/permissions/Permissions';
@@ -228,7 +228,7 @@ export abstract class BaseChannelType implements NotificationChannelType {
     const type = data.getObjects(subject, RDF.terms.type, null)[0] as NamedNode;
 
     const channel: NotificationChannel = {
-      id: joinUrl(this.path, v4()),
+      id: joinUrl(this.path, randomUUID()),
       type: type.value,
       topic: topic.value,
     };

diff --git a/src/server/notifications/WebhookChannel2023/WebhookEmitter.ts b/src/server/notifications/WebhookChannel2023/WebhookEmitter.ts
@@ -1,6 +1,6 @@
+import { randomUUID } from 'node:crypto';
 import fetch from 'cross-fetch';
 import { calculateJwkThumbprint, importJWK, SignJWT } from 'jose';
-import { v4 } from 'uuid';
 import type { JwkGenerator } from '../../../identity/configuration/JwkGenerator';
 import type { InteractionRoute } from '../../../identity/interaction/routing/InteractionRoute';
 import { getLoggerFor } from '../../../logging/LogUtil';
@@ -74,7 +74,7 @@ export class WebhookEmitter extends NotificationEmitter {
       .setExpirationTime(time + this.expiration)
       .setAudience([ this.webId, 'solid' ])
       .setIssuer(this.issuer)
-      .setJti(v4())
+      .setJti(randomUUID())
       .sign(privateKeyObject);
 
     // https://datatracker.ietf.org/doc/html/draft-ietf-oauth-dpop#section-4.2
@@ -83,7 +83,7 @@ export class WebhookEmitter extends NotificationEmitter {
       htm: 'POST',
     }).setProtectedHeader({ alg: privateKey.alg, jwk: publicKey, typ: 'dpop+jwt' })
       .setIssuedAt(time)
-      .setJti(v4())
+      .setJti(randomUUID())
       .sign(privateKeyObject);
 
     const contentType = representation.metadata.contentType;

diff --git a/src/storage/DataAccessorBasedStore.ts b/src/storage/DataAccessorBasedStore.ts
@@ -1,7 +1,7 @@
+import { randomUUID } from 'node:crypto';
 import type { NamedNode, Quad, Term } from '@rdfjs/types';
 import arrayifyStream from 'arrayify-stream';
 import { DataFactory } from 'n3';
-import { v4 as uuid } from 'uuid';
 import type { AuxiliaryStrategy } from '../http/auxiliary/AuxiliaryStrategy';
 import { BasicRepresentation } from '../http/representation/BasicRepresentation';
 import type { Patch } from '../http/representation/Patch';
@@ -571,7 +571,7 @@ export class DataAccessorBasedStore implements ResourceStore {
   protected createURI(container: ResourceIdentifier, isContainer: boolean, slug?: string): ResourceIdentifier {
     this.validateSlug(isContainer, slug);
     const base = ensureTrailingSlash(container.path);
-    const name = (slug && this.cleanSlug(slug)) ?? uuid();
+    const name = (slug && this.cleanSlug(slug)) ?? randomUUID();
     const suffix = isContainer ? '/' : '';
     return { path: `${base}${name}${suffix}` };
   }

diff --git a/src/storage/accessors/AtomicFileDataAccessor.ts b/src/storage/accessors/AtomicFileDataAccessor.ts
@@ -1,6 +1,6 @@
+import { randomUUID } from 'node:crypto';
 import type { Readable } from 'node:stream';
 import { ensureDirSync, rename, unlink } from 'fs-extra';
-import { v4 } from 'uuid';
 import type { RepresentationMetadata } from '../../http/representation/RepresentationMetadata';
 import type { ResourceIdentifier } from '../../http/representation/ResourceIdentifier';
 import type { Guarded } from '../../util/GuardedStream';
@@ -35,7 +35,7 @@ export class AtomicFileDataAccessor extends FileDataAccessor implements AtomicDa
     const link = await this.resourceMapper.mapUrlToFilePath(identifier, false, metadata.contentType);
 
     // Generate temporary file name
-    const tempFilePath = joinFilePath(this.tempFilePath, `temp-${v4()}.txt`);
+    const tempFilePath = joinFilePath(this.tempFilePath, `temp-${randomUUID()}.txt`);
 
     try {
       await this.writeDataFile(tempFilePath, data);

diff --git a/src/storage/keyvalue/WrappedIndexedStorage.ts b/src/storage/keyvalue/WrappedIndexedStorage.ts
@@ -1,4 +1,4 @@
-import { v4 } from 'uuid';
+import { randomUUID } from 'node:crypto';
 import { getLoggerFor } from '../../logging/LogUtil';
 import { InternalServerError } from '../../util/errors/InternalServerError';
 import { NotFoundHttpError } from '../../util/errors/NotFoundHttpError';
@@ -158,7 +158,7 @@ export class WrappedIndexedStorage<T extends IndexTypeCollection<T>> implements
   public async create<TType extends StringKey<T>>(type: TType, value: CreateTypeObject<T[TType]>):
   Promise<TypeObject<T[TType]>> {
     this.validateDefinition(type);
-    const id = v4();
+    const id = randomUUID();
     const newObj = { ...value, [INDEX_ID_KEY]: id } as unknown as VirtualObject;
     // Add the virtual keys
     for (const relation of this.getChildRelations(type)) {

diff --git a/test/integration/PermissionTable.test.ts b/test/integration/PermissionTable.test.ts
@@ -1,5 +1,5 @@
+import { randomUUID } from 'node:crypto';
 import fetch from 'cross-fetch';
-import { v4 } from 'uuid';
 import type { AclPermissionSet } from '../../src/authorization/permissions/AclPermissionSet';
 import { AccessMode as AM } from '../../src/authorization/permissions/Permissions';
 import { BasicRepresentation } from '../../src/http/representation/BasicRepresentation';
@@ -249,7 +249,7 @@ describe.each(stores)('A request on a server with %s authorization and %s', (
   describe.each(table)('%s %s with permissions C/: %s and C/R: %s', (...entry): void => {
     const [ method, target, cPerm, crPermTemp, body, contentType, existsCode, notExistsCode ] = entry;
     const crPerm = crPermTemp ?? cPerm;
-    const id = v4();
+    const id = randomUUID();
     const root = ensureTrailingSlash(joinUrl(baseUrl, id));
     const container = ensureTrailingSlash(joinUrl(root, 'container/'));
     const resource = joinUrl(container, 'resource');

diff --git a/test/unit/identity/interaction/account/util/BaseCookieStore.test.ts b/test/unit/identity/interaction/account/util/BaseCookieStore.test.ts
@@ -1,8 +1,8 @@
+import crypto from 'node:crypto';
 import { BaseCookieStore } from '../../../../../../src/identity/interaction/account/util/BaseCookieStore';
 import type { ExpiringStorage } from '../../../../../../src/storage/keyvalue/ExpiringStorage';
 
 const cookie = '4c9b88c1-7502-4107-bb79-2a3a590c7aa3';
-jest.mock('uuid', (): any => ({ v4: (): string => cookie }));
 
 const now = new Date();
 jest.useFakeTimers();
@@ -14,6 +14,8 @@ describe('A BaseCookieStore', (): void => {
   let store: BaseCookieStore;
 
   beforeEach(async(): Promise<void> => {
+    jest.spyOn(crypto, 'randomUUID').mockReturnValue(cookie);
+
     storage = {
       get: jest.fn().mockResolvedValue(accountId),
       set: jest.fn(),

diff --git a/test/unit/identity/interaction/account/util/GenericAccountStore.test.ts b/test/unit/identity/interaction/account/util/GenericAccountStore.test.ts
@@ -1,3 +1,4 @@
+import crypto from 'node:crypto';
 import {
   ACCOUNT_SETTINGS_REMEMBER_LOGIN,
   type MinimalAccountSettings,
@@ -11,14 +12,14 @@ import {
 } from '../../../../../../src/identity/interaction/account/util/LoginStorage';
 import { InternalServerError } from '../../../../../../src/util/errors/InternalServerError';
 
-jest.mock('uuid', (): any => ({ v4: (): string => '4c9b88c1-7502-4107-bb79-2a3a590c7aa3' }));
-
 describe('A GenericAccountStore', (): void => {
   const id = 'id';
   let storage: jest.Mocked<AccountLoginStorage<any>>;
   let store: GenericAccountStore<MinimalAccountSettings>;
 
   beforeEach(async(): Promise<void> => {
+    jest.spyOn(crypto, 'randomUUID').mockReturnValue('4c9b88c1-7502-4107-bb79-2a3a590c7aa3');
+
     storage = {
       defineType: jest.fn().mockResolvedValue({}),
       create: jest.fn().mockResolvedValue({ id }),

diff --git a/test/unit/identity/interaction/client-credentials/CreateClientCredentialsHandler.test.ts b/test/unit/identity/interaction/client-credentials/CreateClientCredentialsHandler.test.ts
@@ -1,3 +1,4 @@
+import crypto from 'node:crypto';
 import {
   CreateClientCredentialsHandler,
 } from '../../../../../src/identity/interaction/client-credentials/CreateClientCredentialsHandler';
@@ -12,7 +13,6 @@ import type { WebIdStore } from '../../../../../src/identity/interaction/webid/u
 import { BadRequestHttpError } from '../../../../../src/util/errors/BadRequestHttpError';
 
 const uuid = '4c9b88c1-7502-4107-bb79-2a3a590c7aa3';
-jest.mock('uuid', (): any => ({ v4: (): string => uuid }));
 
 describe('A CreateClientCredentialsHandler', (): void => {
   const webId = 'http://example.com/card#me';
@@ -29,6 +29,7 @@ describe('A CreateClientCredentialsHandler', (): void => {
   let handler: CreateClientCredentialsHandler;
 
   beforeEach(async(): Promise<void> => {
+    jest.spyOn(crypto, 'randomUUID').mockReturnValue(uuid);
     route = {
       getPath: jest.fn().mockReturnValue(resource),
       matchPath: jest.fn().mockReturnValue({ accountId, clientCredentialsId: id }),

diff --git a/test/unit/identity/interaction/password/util/BaseForgotPasswordStore.test.ts b/test/unit/identity/interaction/password/util/BaseForgotPasswordStore.test.ts
@@ -1,17 +1,19 @@
+import crypto from 'node:crypto';
 import {
   BaseForgotPasswordStore,
 } from '../../../../../../src/identity/interaction/password/util/BaseForgotPasswordStore';
 import type { ExpiringStorage } from '../../../../../../src/storage/keyvalue/ExpiringStorage';
 
 const record = '4c9b88c1-7502-4107-bb79-2a3a590c7aa3';
-jest.mock('uuid', (): any => ({ v4: (): string => record }));
 
 describe('A BaseForgotPasswordStore', (): void => {
   const email = 'email@example.com';
   let storage: jest.Mocked<ExpiringStorage<string, string>>;
   let store: BaseForgotPasswordStore;
 
   beforeEach(async(): Promise<void> => {
+    jest.spyOn(crypto, 'randomUUID').mockReturnValue(record);
+
     storage = {
       get: jest.fn().mockResolvedValue(email),
       set: jest.fn(),

diff --git a/test/unit/identity/ownership/TokenOwnershipValidator.test.ts b/test/unit/identity/ownership/TokenOwnershipValidator.test.ts
@@ -1,8 +1,8 @@
+import crypto from 'node:crypto';
 import { Readable } from 'node:stream';
 import { DataFactory } from 'n3';
 import type { Quad } from 'n3';
 import rdfDereferencer from 'rdf-dereference';
-import { v4 } from 'uuid';
 import { TokenOwnershipValidator } from '../../../../src/identity/ownership/TokenOwnershipValidator';
 import type { ExpiringStorage } from '../../../../src/storage/keyvalue/ExpiringStorage';
 import { BadRequestHttpError } from '../../../../src/util/errors/BadRequestHttpError';
@@ -11,7 +11,6 @@ import { SOLID } from '../../../../src/util/Vocabularies';
 
 const { literal, namedNode, quad } = DataFactory;
 
-jest.mock('uuid');
 jest.mock('rdf-dereference', (): any => ({
   dereference: jest.fn(),
 }));
@@ -43,7 +42,7 @@ describe('A TokenOwnershipValidator', (): void => {
   beforeEach(async(): Promise<void> => {
     const now = Date.now();
     jest.spyOn(Date, 'now').mockReturnValue(now);
-    jest.mocked(v4).mockReturnValue(token);
+    jest.spyOn(crypto, 'randomUUID').mockReturnValue(token as any);
 
     const map = new Map<string, any>();
     storage = {

diff --git a/test/unit/server/notifications/BaseChannelType.test.ts b/test/unit/server/notifications/BaseChannelType.test.ts
@@ -1,3 +1,4 @@
+import crypto from 'node:crypto';
 import { DataFactory, Store } from 'n3';
 import type { Credentials } from '../../../../src/authentication/Credentials';
 import { AccessMode } from '../../../../src/authorization/permissions/Permissions';
@@ -14,8 +15,6 @@ import quad = DataFactory.quad;
 import blankNode = DataFactory.blankNode;
 import literal = DataFactory.literal;
 
-jest.mock('uuid', (): any => ({ v4: (): string => '4c9b88c1-7502-4107-bb79-2a3a590c7aa3' }));
-
 const dummyType = namedNode('http://example.com/DummyType');
 class DummyChannelType extends BaseChannelType {
   public constructor(features?: string[], properties?: unknown[]) {
@@ -33,6 +32,10 @@ describe('A BaseChannelType', (): void => {
   const credentials: Credentials = {};
   const channelType = new DummyChannelType();
 
+  beforeEach(async(): Promise<void> => {
+    jest.spyOn(crypto, 'randomUUID').mockReturnValue('4c9b88c1-7502-4107-bb79-2a3a590c7aa3');
+  });
+
   it('can provide a description of the subscription service.', async(): Promise<void> => {
     expect(channelType.getDescription()).toEqual({
       '@context': [ 'https://www.w3.org/ns/solid/notification/v1' ],

diff --git a/test/unit/server/notifications/WebHookChannel2023/WebhookChannel2023Type.test.ts b/test/unit/server/notifications/WebHookChannel2023/WebhookChannel2023Type.test.ts
@@ -1,3 +1,4 @@
+import crypto from 'node:crypto';
 import { DataFactory, Store } from 'n3';
 import {
   AbsolutePathInteractionRoute,
@@ -28,8 +29,6 @@ jest.mock('../../../../../src/logging/LogUtil', (): any => {
   return { getLoggerFor: (): Logger => logger };
 });
 
-jest.mock('uuid', (): any => ({ v4: (): string => '4c9b88c1-7502-4107-bb79-2a3a590c7aa3' }));
-
 describe('A WebhookChannel2023Type', (): void => {
   const sendTo = 'http://example.org/somewhere-else';
   const topic = 'https://storage.example/resource';
@@ -42,6 +41,8 @@ describe('A WebhookChannel2023Type', (): void => {
   let channelType: WebhookChannel2023Type;
 
   beforeEach(async(): Promise<void> => {
+    jest.spyOn(crypto, 'randomUUID').mockReturnValue('4c9b88c1-7502-4107-bb79-2a3a590c7aa3');
+
     data = new Store();
     data.addQuad(quad(subject, RDF.terms.type, NOTIFY.terms.WebhookChannel2023));
     data.addQuad(quad(subject, NOTIFY.terms.topic, namedNode(topic)));