chore(deps): replace uuid with native crypto

[toufali]

Because

• uuid was a direct dependency in five manifests with open Dependabot alerts.
• Node's built-in crypto covers every use we had.

This pull request

• Replaces 122 uuid call sites with crypto.randomBytes(16) or crypto.randomUUID().
• Drops uuid and @types/uuid from fxa-settings, fxa-shared and fxa-event-broker.
• Bumps uuid to ^11.1.1 in root and auth-server, which still need it for autogenerated Glean code.
• Adds a native uuidv5 for generateNimbusId, verified bit-exact against the old package over 5110 vectors.
• Uses the existing random.hex(16) helper for auth-server uid generation to satisfy fxa/async-crypto-random.
• Adds randomUUID to the fxa-settings test crypto shim, and explicit crypto imports where Jest's node env lacks the global.

Issue that this pull request solves

Closes: FXA-13926

Checklist

Put an x in the boxes that apply

• My commit is GPG signed.
• If applicable, I have modified or added tests which pass locally.
• I have added necessary documentation (if appropriate).
• I have verified that my changes render correctly in RTL (if appropriate).
• I have manually reviewed all AI generated code.

How to review (Optional)

• Most of the diff is one mechanical swap repeated across spec files.
• Worth real attention: account.ts, linked-accounts.ts, passwordless.ts and account.manager.ts (uid generation) plus cart.manager.ts (cart id).
• uuidv5.ts backs Nimbus IDs, which Glean Shredder re-derives to delete telemetry, so its output is a stored-data contract.

Other information (Optional)

• uuid cannot be fully removed yet: glean_parser's template emits import { v4 as uuidv4 } from 'uuid' into generated Glean code, and the payments copy is regenerated on every build.

[Copilot]

Pull request overview

This PR migrates UUID generation across the FxA monorepo from the uuid npm package to Node/browser-native crypto APIs, reducing dependency surface while preserving deterministic UUIDv5 output for Nimbus IDs (a stored-data contract).

Changes:

• Replace most UUIDv4 call sites with crypto.randomUUID() or crypto.randomBytes(16) (hex/buffer as appropriate).
• Remove uuid / @types/uuid from select package manifests, while bumping the remaining required uuid dependency to ^11.1.1.
• Add a local uuidv5 implementation and fixed-vector tests, and update Nimbus ID derivation to use it.

Reviewed changes

Copilot reviewed 58 out of 59 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
yarn.lock	Removes @types/uuid entries and updates uuid resolution to ^11.1.1.
package.json	Bumps root uuid to ^11.1.1 and removes @types/uuid.
packages/fxa-shared/package.json	Drops uuid and @types/uuid from devDependencies.
packages/fxa-shared/test/sentry/pii-filter-actions.ts	Switches token UUID generation in tests to crypto.randomUUID().
packages/fxa-shared/test/experiments/base.js	Replaces uuid.v4() in experiment chooser tests with crypto.randomUUID().
packages/fxa-shared/speed-trap/guid.js	Replaces uuidv4() with crypto.randomUUID() for SpeedTrap UUIDs.
packages/fxa-settings/package.json	Drops uuid and @types/uuid from dependencies/devDependencies.
packages/fxa-settings/src/setupTests.tsx	Extends the Jest crypto shim to include randomUUID.
packages/fxa-settings/src/lib/metrics.ts	Switches device/user UUID generation to crypto.randomUUID().
packages/fxa-settings/src/lib/metrics-flow.ts	Switches deviceId generation to crypto.randomUUID().
packages/fxa-settings/src/lib/cache.ts	Switches uniqueUserId generation to crypto.randomUUID().
packages/fxa-event-broker/package.json	Drops uuid and @types/uuid from dependencies/devDependencies.
packages/fxa-event-broker/src/jwtset/jwtset.service.ts	Switches JWT jti to crypto.randomUUID().
packages/fxa-event-broker/src/firestore/firestore.service.spec.ts	Uses crypto.randomUUID() in test UIDs.
packages/fxa-auth-server/package.json	Bumps uuid to ^11.1.1 and removes @types/uuid.
packages/fxa-auth-server/test/remote/totp.in.spec.ts	Switches JWT jti to crypto.randomUUID().
packages/fxa-auth-server/test/remote/recovery_email_emails.in.spec.ts	Switches JWT jti to crypto.randomUUID().
packages/fxa-auth-server/test/remote/recovery_email_change_email.in.spec.ts	Switches JWT jti to crypto.randomUUID() and reformats long calls.
packages/fxa-auth-server/test/remote/recovery_codes.in.spec.ts	Switches JWT jti to crypto.randomUUID() and reformats long objects/calls.
packages/fxa-auth-server/test/remote/push_db_tests.in.spec.ts	Replaces UUIDv4-buffer-to-hex uid generation with crypto.randomBytes(16).toString('hex').
packages/fxa-auth-server/test/remote/password_change.in.spec.ts	Switches JWT jti to crypto.randomUUID().
packages/fxa-auth-server/test/remote/db.in.spec.ts	Replaces UUIDv4-buffer-to-hex uid generation with crypto.randomBytes(16).toString('hex').
packages/fxa-auth-server/lib/routes/unblock-codes.spec.ts	Replaces UUIDv4-buffer-to-hex uid generation with crypto.randomBytes(16).toString('hex').
packages/fxa-auth-server/lib/routes/subscriptions/support.spec.ts	Replaces UUIDv4-buffer-to-hex UID constant with crypto.randomBytes(16).toString('hex').
packages/fxa-auth-server/lib/routes/subscriptions/stripe.spec.ts	Replaces UUIDv4-buffer-to-hex UID constants with crypto.randomBytes(16).toString('hex').
packages/fxa-auth-server/lib/routes/subscriptions/stripe-webhooks.spec.ts	Replaces UUIDv4-buffer-to-hex UID constant with crypto.randomBytes(16).toString('hex').
packages/fxa-auth-server/lib/routes/subscriptions/play-pubsub.spec.ts	Replaces UUIDv4-buffer-to-hex UID constant with crypto.randomBytes(16).toString('hex').
packages/fxa-auth-server/lib/routes/subscriptions/paypal-notifications.spec.ts	Replaces UUIDv4-buffer-to-hex UID constant with crypto.randomBytes(16).toString('hex').
packages/fxa-auth-server/lib/routes/subscriptions/mozilla.spec.ts	Replaces UUIDv4-buffer-to-hex UID constant with crypto.randomBytes(16).toString('hex').
packages/fxa-auth-server/lib/routes/subscriptions/google.spec.ts	Replaces UUIDv4-buffer-to-hex UID constant with crypto.randomBytes(16).toString('hex').
packages/fxa-auth-server/lib/routes/security-events.spec.ts	Replaces UUIDv4-buffer-to-hex UID constant with crypto.randomBytes(16).toString('hex').
packages/fxa-auth-server/lib/routes/recovery-key.spec.ts	Replaces UUIDv4-buffer-to-hex uid constant with crypto.randomBytes(16).toString('hex').
packages/fxa-auth-server/lib/routes/mfa.ts	Switches JWT jti to crypto.randomUUID().
packages/fxa-auth-server/lib/routes/passwordless.ts	Switches account uid generation to await random.hex(16).
packages/fxa-auth-server/lib/routes/linked-accounts.ts	Switches account uid generation to await random.hex(16).
packages/fxa-auth-server/lib/routes/account.ts	Switches account uid generation to await random.hex(16) (multiple call sites) and reformats import.
packages/fxa-auth-server/lib/routes/auth-schemes/mfa.spec.ts	Switches JWT jti to crypto.randomUUID() and expands inline object formatting.
packages/fxa-auth-server/lib/routes/passwordless.spec.ts	Replaces UUIDv4-buffer-to-hex uid generation with crypto.randomBytes(16).toString('hex').
packages/fxa-auth-server/lib/routes/password.spec.ts	Replaces UUIDv4-buffer-to-hex uid generation with crypto.randomBytes(16).toString('hex') across test cases.
packages/fxa-auth-server/lib/routes/ip-profiling.spec.ts	Replaces uuid-based UID generation with crypto.randomBytes(16).toString('hex').
packages/fxa-auth-server/lib/routes/emails.spec.ts	Replaces uuid-based uid/deviceId generation with crypto.randomBytes(16).toString('hex').
packages/fxa-auth-server/lib/routes/devices-and-sessions.spec.ts	Replaces uuid-based uid generation with crypto.randomBytes(16).toString('hex').
packages/fxa-auth-server/lib/routes/attached-clients.spec.ts	Replaces uuid-based uid generation with crypto.randomBytes(16).toString('hex').
packages/fxa-auth-server/lib/routes/account.spec.ts	Replaces uuid-based uid generation with crypto.randomBytes(16).toString('hex') across test cases.
packages/fxa-auth-server/lib/payments/stripe.spec.ts	Replaces uuid usage in tests with crypto.randomUUID() (string form).
packages/fxa-auth-server/lib/devices.spec.ts	Replaces uuid-based uid generation with crypto.randomBytes(16).toString('hex').
packages/fxa-auth-server/lib/account-delete.spec.ts	Replaces uuid-based uid buffer generation with crypto.randomBytes(16).
libs/shared/sentry/src/lib/pii/filter-actions.spec.ts	Switches token UUID generation in tests to crypto.randomUUID().
libs/shared/sentry-utils/src/lib/pii/filter-actions.spec.ts	Switches token UUID generation in tests to crypto.randomUUID().
libs/shared/experiments/src/lib/utils/uuidv5.ts	Adds local deterministic UUIDv5 implementation using SHA-1.
libs/shared/experiments/src/lib/utils/uuidv5.spec.ts	Adds fixed-vector tests to lock UUIDv5 output for Nimbus IDs.
libs/shared/experiments/src/lib/utils/generateNimbusId.ts	Switches Nimbus ID generation from uuid package v5 to local uuidv5.
libs/shared/db/mysql/core/src/lib/core.ts	Replaces uuidv4-based hex ID generator with crypto.randomBytes(16).toString('hex').
libs/shared/db/mysql/account/src/lib/tests.ts	Switches test DB name generation to crypto.randomUUID().
libs/shared/account/account/src/lib/account.manager.ts	Switches account stub uid generation to randomBytesAsync(16) instead of UUIDv4.
libs/payments/cart/src/lib/cart.manager.ts	Replaces UUIDv4 buffer cart id generation with crypto.randomBytes(16).
libs/payments/cart/src/lib/cart.manager.in.spec.ts	Replaces UUIDv4-buffer-to-hex test ID generation with crypto.randomBytes(16).toString('hex').
apps/payments/next/app/[locale]/subscriptions/payments/stripe/page.tsx	Switches instanceKey UUID generation to crypto.randomUUID() for server component rendering.
apps/payments/next/app/[locale]/subscriptions/payments/stripe/page.test.tsx	Updates UUID mocking to mock crypto instead of uuid, and adjusts test naming.

[Copilot]

Pull request overview

Copilot reviewed 58 out of 59 changed files in this pull request and generated no new comments.

Suppressed comments (1)

packages/fxa-shared/speed-trap/guid.js:10

• guid() assumes the global crypto.getRandomValues exists. In older browsers, non-browser execution, or insecure contexts where crypto is missing/partial, this will throw during speedTrap.init() and break page telemetry (and potentially page load if unhandled). Add a small capability check and fallback so speed-trap remains non-fatal when WebCrypto is unavailable.

[dschom]

Nit, offical docs say to use node:crypto. Do this in all imports.

[dschom]

Do we need this in the root? It sounds like it's only needed by auth-server now.