Generate UID without randombytes dependency

[valadaptive]

I confirm that this contribution is made under the terms of the license found in the root directory of this repository's source tree and that I have the authority necessary to make this contribution on behalf of its copyright owner.

Resolves #134. Instead of taking an external dependency on randombytes, which accesses global (doesn't work in the browser) and depends on a Buffer polyfill, we check first for crypto.getRandomValues support and only import Node's crypto module if it's not found.

If you're OK with dropping support for Node <19, the crypto global is available in newer versions of Node (it technically didn't stop being "experimental" until Node 23, but I don't get any annoying ExperimentalWarning messages when trying to access it in older versions).

An alternative option would be to add separate browser and Node entrypoints; this would avoid the dynamic require that might(?) cause trouble for some bundlers. I have that code in a separate branch if you'd prefer it.

[okuryu]

Since I was planning to bump the major version anyway when removing randombytes from the dependencies, I don’t think it’s a problem to take this opportunity to support only Node.js 20 and above. Therefore, I don’t think a fallback for require('crypto') is strictly necessary.

By the way, is my understanding correct that this patch also resolves the browser support issue?

[valadaptive]

I've updated the PR to use the crypto global only, and added "engines": {"node": ">=20.0.0"} to the package.json.

By the way, is my understanding correct that this patch also resolves the browser support issue?

I haven't tested it in the browser, but it should. We're not accessing global like the randombytes package was.

[okuryu]

Got it. Let’s give it a try. Could you remove Node.js v18 from the GitHub Actions config?

[valadaptive]

Could you remove Node.js v18 from the GitHub Actions config?

Whoops; just did that. Node 24 is out, should I add that to the test matrix?

[okuryu]

Yeah, please go ahead and add 24 as well 🙏

[valadaptive]

Added it; still needs approval to run but everything passes locally (as expected)

[okuryu]

Could you try running npm install again? It will likely update the package-lock.json file.

[valadaptive]

Huh, I didn't know the engines field was part of the lockfile.

[okuryu]

Thanks! We’ve released v7.0.0, so please give it a try. Let us know if you run into any issues.