From 793cd064b1b0e5b5598ebc0e309d3865d9d7449b Mon Sep 17 00:00:00 2001
From: Steven John Lange <s.lange@hz-deutschland.de>
Date: Thu, 4 Jun 2026 10:13:21 +0200
Subject: [PATCH 1/8] refactor: replace uuid imports with standard
 crypto.randomUUID

---
 package-lock.json                                | 2 +-
 package.json                                     | 1 -
 packages/node_modules/pouchdb-utils/src/index.js | 4 +---
 packages/node_modules/pouchdb-utils/src/rev.js   | 3 +--
 4 files changed, 3 insertions(+), 7 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 88be4f8acd..105ad01bc0 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -24,7 +24,6 @@
         "readable-stream": "1.1.14",
         "spark-md5": "3.0.2",
         "through2": "3.0.2",
-        "uuid": "8.3.2",
         "vuvuzela": "1.0.3"
       },
       "devDependencies": {
@@ -10143,6 +10142,7 @@
       "version": "8.3.2",
       "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
       "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==",
+      "dev": true,
       "bin": {
         "uuid": "dist/bin/uuid"
       }
diff --git a/package.json b/package.json
index 1000179386..e64c290bc2 100644
--- a/package.json
+++ b/package.json
@@ -52,7 +52,6 @@
     "readable-stream": "1.1.14",
     "spark-md5": "3.0.2",
     "through2": "3.0.2",
-    "uuid": "8.3.2",
     "vuvuzela": "1.0.3"
   },
   "devDependencies": {
diff --git a/packages/node_modules/pouchdb-utils/src/index.js b/packages/node_modules/pouchdb-utils/src/index.js
index 19b4fe8a74..0aa584cbd2 100644
--- a/packages/node_modules/pouchdb-utils/src/index.js
+++ b/packages/node_modules/pouchdb-utils/src/index.js
@@ -1,5 +1,3 @@
-import { v4 } from 'uuid';
-
 import adapterFun from './adapterFun';
 import bulkGetShim from './bulkGetShim';
 import changesHandler from './changesHandler';
@@ -24,7 +22,7 @@ import toPromise from './toPromise';
 import upsert from './upsert';
 import rev from './rev';
 
-var uuid = v4; // mimic old import, only v4 is ever used elsewhere
+const uuid = function () { return crypto.randomUUID(); }; // mimic old import, only v4 is ever used elsewhere
 
 export {
   adapterFun,
diff --git a/packages/node_modules/pouchdb-utils/src/rev.js b/packages/node_modules/pouchdb-utils/src/rev.js
index 60988658bd..ba643877e0 100644
--- a/packages/node_modules/pouchdb-utils/src/rev.js
+++ b/packages/node_modules/pouchdb-utils/src/rev.js
@@ -1,4 +1,3 @@
-import { v4 as uuidV4 } from 'uuid';
 import { stringMd5 } from 'pouchdb-md5';
 
 /**
@@ -7,7 +6,7 @@ import { stringMd5 } from 'pouchdb-md5';
  */
 function rev(doc, deterministic_revs) {
   if (!deterministic_revs) {
-    return uuidV4().replace(/-/g, '').toLowerCase();
+    return crypto.randomUUID().replace(/-/g, '').toLowerCase();
   }
 
   var mutateableDoc = Object.assign({}, doc);

From f3fabc384a34e26b372d3d331819036cb82ae41c Mon Sep 17 00:00:00 2001
From: Steven John Lange <s.lange@hz-deutschland.de>
Date: Thu, 4 Jun 2026 10:33:18 +0200
Subject: [PATCH 2/8] fix: import crypto for node.js

---
 packages/node_modules/pouchdb-utils/package.json        | 3 ++-
 packages/node_modules/pouchdb-utils/src/index.js        | 3 +--
 packages/node_modules/pouchdb-utils/src/uuid-browser.js | 3 +++
 packages/node_modules/pouchdb-utils/src/uuid.js         | 5 +++++
 4 files changed, 11 insertions(+), 3 deletions(-)
 create mode 100644 packages/node_modules/pouchdb-utils/src/uuid-browser.js
 create mode 100644 packages/node_modules/pouchdb-utils/src/uuid.js

diff --git a/packages/node_modules/pouchdb-utils/package.json b/packages/node_modules/pouchdb-utils/package.json
index 79d7776d1e..dc4de2580e 100644
--- a/packages/node_modules/pouchdb-utils/package.json
+++ b/packages/node_modules/pouchdb-utils/package.json
@@ -17,6 +17,7 @@
     "./src/cloneBinaryObject.js": "./src/cloneBinaryObject-browser.js",
     "./src/env/hasLocalStorage.js": "./src/env/hasLocalStorage-browser.js",
     "./src/explainError.js": "./src/explainError-browser.js",
-    "./src/isBinaryObject.js": "./src/isBinaryObject-browser.js"
+    "./src/isBinaryObject.js": "./src/isBinaryObject-browser.js",
+    "./src/uuid.js": "./src/uuid-browser.js"
   }
 }
diff --git a/packages/node_modules/pouchdb-utils/src/index.js b/packages/node_modules/pouchdb-utils/src/index.js
index 0aa584cbd2..7ec2d45a52 100644
--- a/packages/node_modules/pouchdb-utils/src/index.js
+++ b/packages/node_modules/pouchdb-utils/src/index.js
@@ -20,10 +20,9 @@ import pick from './pick';
 import scopeEval from './scopeEval';
 import toPromise from './toPromise';
 import upsert from './upsert';
+import uuid from './uuid';
 import rev from './rev';
 
-const uuid = function () { return crypto.randomUUID(); }; // mimic old import, only v4 is ever used elsewhere
-
 export {
   adapterFun,
   bulkGetShim,
diff --git a/packages/node_modules/pouchdb-utils/src/uuid-browser.js b/packages/node_modules/pouchdb-utils/src/uuid-browser.js
new file mode 100644
index 0000000000..97a1451a23
--- /dev/null
+++ b/packages/node_modules/pouchdb-utils/src/uuid-browser.js
@@ -0,0 +1,3 @@
+export default function uuid() {
+  return crypto.randomUUID();
+}
diff --git a/packages/node_modules/pouchdb-utils/src/uuid.js b/packages/node_modules/pouchdb-utils/src/uuid.js
new file mode 100644
index 0000000000..f9baa529c2
--- /dev/null
+++ b/packages/node_modules/pouchdb-utils/src/uuid.js
@@ -0,0 +1,5 @@
+import crypto from 'crypto';
+
+export default function uuid() {
+  return crypto.randomUUID();
+}

From 1125199e97df3c92095d13f410cd392cdb8e29dd Mon Sep 17 00:00:00 2001
From: Steven-John Lange <s.lange@hz-deutschland.de>
Date: Wed, 10 Jun 2026 16:49:28 +0200
Subject: [PATCH 3/8] refactor: add uuidPolyfill

---
 .../pouchdb-utils/src/uuid-browser.js         | 42 ++++++++++++++++++-
 1 file changed, 40 insertions(+), 2 deletions(-)

diff --git a/packages/node_modules/pouchdb-utils/src/uuid-browser.js b/packages/node_modules/pouchdb-utils/src/uuid-browser.js
index 97a1451a23..e3455ec5f3 100644
--- a/packages/node_modules/pouchdb-utils/src/uuid-browser.js
+++ b/packages/node_modules/pouchdb-utils/src/uuid-browser.js
@@ -1,3 +1,41 @@
-export default function uuid() {
-  return crypto.randomUUID();
+function uuidPolyfill() {
+  const buffer = crypto.getRandomValues(new Uint8Array(16));
+
+  // https://en.wikipedia.org/wiki/Universally_unique_identifier#Version_4_(random)
+  // set bits for version: 4
+  buffer[6] = (buffer[6] & 0x0f) | 0x40;
+  // and variant: 1
+  buffer[8] = (buffer[8] & 0x3f) | 0x80;
+
+  const str = toHex(buffer);
+
+  return str.slice(0, 8) + "-"
+    + str.slice(8, 12) + "-"
+    + str.slice(12, 16) + "-"
+    + str.slice(12, 16) + "-"
+    + str.slice(16, 20) + "-"
+    + str.slice(20);
 }
+
+/**
+ * convert Uint8Array to HEX string
+ * @see https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array/toHex
+ *
+ * @param {Uint8Array} buffer
+ * @returns {string}
+ */
+function toHex(buffer) {
+  if (typeof buffer.toHex === "function") {
+    return buffer.toHex();
+  }
+
+  let str = "";
+  for (let i = 0; i < buffer.length; ++i) {
+    str += buffer[i].toString(16).padStart(2, "0");
+  }
+  return str;
+}
+
+const uuid = typeof crypto.randomUUID === "function" ? crypto.randomUUID.bind(crypto) : uuidPolyfill;
+
+export default uuid;

From aaa652e15a3c9a8ecf4099b391e4ce898a787794 Mon Sep 17 00:00:00 2001
From: Steven-John Lange <s.lange@hz-deutschland.de>
Date: Fri, 10 Jul 2026 10:39:31 +0200
Subject: [PATCH 4/8] revert: "refactor: replace uuid imports"

---
 packages/node_modules/pouchdb-utils/src/rev.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/packages/node_modules/pouchdb-utils/src/rev.js b/packages/node_modules/pouchdb-utils/src/rev.js
index ba643877e0..60988658bd 100644
--- a/packages/node_modules/pouchdb-utils/src/rev.js
+++ b/packages/node_modules/pouchdb-utils/src/rev.js
@@ -1,3 +1,4 @@
+import { v4 as uuidV4 } from 'uuid';
 import { stringMd5 } from 'pouchdb-md5';
 
 /**
@@ -6,7 +7,7 @@ import { stringMd5 } from 'pouchdb-md5';
  */
 function rev(doc, deterministic_revs) {
   if (!deterministic_revs) {
-    return crypto.randomUUID().replace(/-/g, '').toLowerCase();
+    return uuidV4().replace(/-/g, '').toLowerCase();
   }
 
   var mutateableDoc = Object.assign({}, doc);

From e0475687120911571351c2c80c5d5d081ca5633d Mon Sep 17 00:00:00 2001
From: Steven-John Lange <s.lange@hz-deutschland.de>
Date: Fri, 10 Jul 2026 11:28:33 +0200
Subject: [PATCH 5/8] refactor: expose uuid as function to manipulate behaviour
 at runtime for testing.

---
 packages/node_modules/pouchdb-utils/src/uuid-browser.js | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/packages/node_modules/pouchdb-utils/src/uuid-browser.js b/packages/node_modules/pouchdb-utils/src/uuid-browser.js
index e3455ec5f3..59d7bbf266 100644
--- a/packages/node_modules/pouchdb-utils/src/uuid-browser.js
+++ b/packages/node_modules/pouchdb-utils/src/uuid-browser.js
@@ -36,6 +36,8 @@ function toHex(buffer) {
   return str;
 }
 
-const uuid = typeof crypto.randomUUID === "function" ? crypto.randomUUID.bind(crypto) : uuidPolyfill;
+const uuid = () => typeof crypto.randomUUID === "function"
+  ? crypto.randomUUID()
+  : uuidPolyfill();
 
 export default uuid;

From b23959eafb0c737aa49bdc9befbb15748e8ed406 Mon Sep 17 00:00:00 2001
From: Steven-John Lange <s.lange@hz-deutschland.de>
Date: Fri, 10 Jul 2026 11:41:35 +0200
Subject: [PATCH 6/8] tests: add UUID polyfill test

---
 tests/integration/test.uuids.js | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/tests/integration/test.uuids.js b/tests/integration/test.uuids.js
index 302568abfb..21c3ff6604 100644
--- a/tests/integration/test.uuids.js
+++ b/tests/integration/test.uuids.js
@@ -41,4 +41,17 @@ describe('test.uuid.js', function () {
 
     _rev.should.match(/^[0-9a-fA-F]{32}$/);
   });
+
+  it('polyfill UUID RFC4122 test', function () {
+    // remove native randomUUID to mimic behaviour of insecure context (non https or localhost)
+    const originalRandomUUID = crypto.randomUUID;
+    crypto.randomUUID = undefined;
+
+    rfcRegexp.test(testUtils.uuid()).should
+      .equal(true,
+        'Single UUID through Pouch.utils.uuid complies with RFC4122.');
+
+    // restore crypto.randomUUID.
+    crypto.randomUUID = originalRandomUUID;
+  });
 });

From 7ad5b10fd33dec3e29951496e552781e322e62c6 Mon Sep 17 00:00:00 2001
From: Steven-John Lange <s.lange@hz-deutschland.de>
Date: Fri, 10 Jul 2026 11:42:20 +0200
Subject: [PATCH 7/8] fix: a slice too many.

---
 packages/node_modules/pouchdb-utils/src/uuid-browser.js | 1 -
 1 file changed, 1 deletion(-)

diff --git a/packages/node_modules/pouchdb-utils/src/uuid-browser.js b/packages/node_modules/pouchdb-utils/src/uuid-browser.js
index 59d7bbf266..5b75b3b501 100644
--- a/packages/node_modules/pouchdb-utils/src/uuid-browser.js
+++ b/packages/node_modules/pouchdb-utils/src/uuid-browser.js
@@ -12,7 +12,6 @@ function uuidPolyfill() {
   return str.slice(0, 8) + "-"
     + str.slice(8, 12) + "-"
     + str.slice(12, 16) + "-"
-    + str.slice(12, 16) + "-"
     + str.slice(16, 20) + "-"
     + str.slice(20);
 }

From 509bcf40cce22e357dc33a4c6a0c391843cc947b Mon Sep 17 00:00:00 2001
From: Steven-John Lange <s.lange@hz-deutschland.de>
Date: Fri, 10 Jul 2026 13:05:18 +0200
Subject: [PATCH 8/8] fix: expect v4 alias

pouchdb-core/active-tasks.js and
pouchdb-utils/rev.js still import `v4` alias.

Refactor imports should be done in another PR
---
 packages/node_modules/pouchdb-utils/src/uuid-browser.js | 2 ++
 packages/node_modules/pouchdb-utils/src/uuid.js         | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/packages/node_modules/pouchdb-utils/src/uuid-browser.js b/packages/node_modules/pouchdb-utils/src/uuid-browser.js
index 5b75b3b501..57931ac3f5 100644
--- a/packages/node_modules/pouchdb-utils/src/uuid-browser.js
+++ b/packages/node_modules/pouchdb-utils/src/uuid-browser.js
@@ -40,3 +40,5 @@ const uuid = () => typeof crypto.randomUUID === "function"
   : uuidPolyfill();
 
 export default uuid;
+
+export const v4 = uuid;
diff --git a/packages/node_modules/pouchdb-utils/src/uuid.js b/packages/node_modules/pouchdb-utils/src/uuid.js
index f9baa529c2..366dad9287 100644
--- a/packages/node_modules/pouchdb-utils/src/uuid.js
+++ b/packages/node_modules/pouchdb-utils/src/uuid.js
@@ -3,3 +3,5 @@ import crypto from 'crypto';
 export default function uuid() {
   return crypto.randomUUID();
 }
+
+export const v4 = uuid;