Collision with v4 uuid

Describe the bug

I’m guessing I’m setting up something incorrectly. I’m using browser-side generated uuids and logging them to the server. I have a collision and I have only have logged about 100k uuids. I shouldn’t have a collision with 100k uuids so I’m guessing I have a bug in my code. I’m assuming that I need to polyfill or something.

How to reproduce

I don’t have a small repo. This is integrated into a larger app. I noticed a collision pretty quickly.

import { v4 as uuidv4 } from 'uuid';
...
log(uuidv4())

Expected behavior

I would not expect a collision with 100k uuids.

Runtime

• OS: Unknown.
• Runtime: I don’t know for sure. Almost all of the users use either Chrome or Safari (50-50).
• Runtime Version: 14.x

Additional information

[Any other information or comments that you think will help]

[broofa]

Ah, someone at Snowplow said they haven’t updated partially because of uuid dropping support for IE 9 and 10.

FWIW, I just tested crypto.getRandomValues() behavior on googlebot and it is also deterministic(!) (<-- @ctavan @bcoe, take note!), so upgrading to uuid@latest probably won’t fix this issue for Snowplow.

I suppose one workaround would be to detect when we’re running in a googelbot client and “be smart”, but the options there are limited. Google clearly wants googlebots to be deterministic. Working around that won’t be easy.

We could throw an error when run in googlebot clients, similar to when we don’t find getRandomValues(). But I’m not convinced that’s the right thing to do. A lot of our users will find it surprising and obnoxious.

Both of the above solutions start us down the slippery slope of detecting clients with known RNG issues. I’m not thrilled about that idea.

Googlebot and it’s ilk are a special case, where ID collisions are arguably by design. I’m not sure it’s our responsibility to deal with that. I’d be okay with just adding a cautionary note to the README about this, and telling project owners it’s up to them to figure it out.

[ctavan]

I think this is working as intended and updating the docs is the best thing we can do!

(and thanks for verifying crypto behavior, @broofa!)