Fix UUID issue

.changeset/remove-uuid-dep.md

@@ -0,0 +1,5 @@
+---
+'@statelyai/inspect': patch
+---
+
+Remove the `uuid` dependency in favor of the platform-native `crypto.randomUUID()`, clearing CVE-2026-41907 flagged by downstream security scanners. A `#uuid` subpath import resolves to `node:crypto` in Node and the global `crypto` in browser/worker environments.

package.json

@@ -36,17 +36,22 @@
     "partysocket": "^0.0.25",
     "safe-stable-stringify": "^2.5.0",
     "superjson": "^1.13.3",
-    "uuid": "^9.0.1",
     "ws": "^8.20.0"
   },
+  "imports": {
+    "#uuid": {
+      "worker": "./dist/uuid-browser.mjs",
+      "browser": "./dist/uuid-browser.mjs",
+      "default": "./dist/uuid-node.mjs"
+    }
+  },
   "peerDependencies": {
     "xstate": "^5.5.1"
   },
   "devDependencies": {
     "@changesets/changelog-github": "^0.5.2",
     "@changesets/cli": "^2.29.8",
     "@types/jsdom": "^21.1.7",
-    "@types/uuid": "^9.0.8",
     "@types/ws": "^8.18.1",
     "jsdom": "^23.2.0",
     "publint": "^0.3.15",

src/createSkyInspector.ts

@@ -1,7 +1,7 @@
 import IsomorphicWebSocket from 'isomorphic-ws';
 import PartySocket from 'partysocket';
 import { stringify } from 'superjson';
-import { v4 as uuidv4 } from 'uuid';
+import { uuid } from '#uuid';
 import { createBrowserInspector } from './browser';
 import {
   InspectorOptions,
@@ -28,7 +28,7 @@ export function createSkyInspector(
   };
   const server = apiBaseURL.replace('/api/sky', '');
   const { apiKey, onerror, ...inspectorOptions } = options;
-  const sessionId = uuidv4(); // Generate a unique session ID
+  const sessionId = uuid(); // Generate a unique session ID
   const room = `inspect-${sessionId}`;
   const socket = new PartySocket({
     host,

src/uuid-browser.ts

@@ -0,0 +1,3 @@
+export function uuid(): string {
+  return crypto.randomUUID();
+}

src/uuid-node.ts

@@ -0,0 +1 @@
+export { randomUUID as uuid } from 'node:crypto';

tsconfig.json

@@ -5,6 +5,9 @@
     "moduleDetection": "force",
     "module": "preserve",
     "moduleResolution": "bundler",
+    "paths": {
+      "#uuid": ["./src/uuid-node.ts"]
+    },
     "resolveJsonModule": true,
     "strict": true,
     "esModuleInterop": true,

tsdown.config.ts

@@ -1,5 +1,14 @@
 import { defineConfig } from 'tsdown';
 
 export default defineConfig({
-  entry: ['src/index.ts', 'src/server.ts'],
+  entry: [
+    'src/index.ts',
+    'src/server.ts',
+    'src/uuid-node.ts',
+    'src/uuid-browser.ts',
+  ],
+  // Keep the `#uuid` subpath external so the bare import survives in the
+  // bundle and the consumer's runtime/bundler resolves the right condition
+  // (browser/worker vs. node) instead of inlining one variant at build time.
+  external: ['#uuid'],
 });

vitest.config.ts

@@ -0,0 +1,12 @@
+import { fileURLToPath } from 'node:url';
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  resolve: {
+    alias: {
+      // Tests run against `src` before any build, so resolve the `#uuid`
+      // subpath (which points at `dist` for published consumers) to source.
+      '#uuid': fileURLToPath(new URL('./src/uuid-node.ts', import.meta.url)),
+    },
+  },
+});