Clean up and upgrade gremlin-js dependencies CTR

- Replace uuid with globalThis.crypto.randomUUID() (Node 22+/browsers);
  remove uuid and @types/uuid from package.json
- Upgrade chai ~4.5.0 → ^6.2.2 and chai-string ~1.5.0 → ^2.0.0;
  add deep-eql as explicit devDependency; fix default import in
  element-comparison-test.js to use named exports
- Upgrade globals 15 → 17, prettier 3.8.1 → 3.8.3,
  typedoc 0.28.18 → 0.28.19
- Upgrade @smithy/hash-node 4.2.12 → 4.2.14,
  @smithy/signature-v4 5.3.12 → 5.3.14
- Remove unused js-yaml devDependency
- Resolve brace-expansion CVE-2024-4068 via lockfile refresh
- Switch gremlin-mcp moduleResolution from "node" to "bundler" to fix
  type-check failure with @modelcontextprotocol/sdk 1.23+ zod/v3
  subpath exports

Author: Cole-Greer

CHANGELOG.asciidoc

@@ -26,6 +26,7 @@ image::https://raw.githubusercontent.com/apache/tinkerpop/master/docs/static/ima
 === TinkerPop 4.0.0 (Release Date: NOT OFFICIALLY RELEASED YET)
 
 * Added Gremlator, a single page web application, that translates Gremlin into various programming languages like Javascript and Python.
+* Removed `uuid` dependency from `gremlin-javascript` in favor of the built-in `globalThis.crypto.randomUUID()`.
 
 [[release-4-0-0-beta-2]]
 === TinkerPop 4.0.0-beta.2 (April 1, 2026)

docs/src/upgrade/release-4.x.x.asciidoc

@@ -41,6 +41,16 @@ anonymized form. The original gremlator.com was a prototype built by TinkerPop c
 previous implementation required Java and a running Gremlin Server, whereas the new version runs entirely in the
 browser with no server infrastructure needed.
 
+==== Removed `uuid` Dependency in gremlin-javascript
+
+The `uuid` npm package has been removed from `gremlin-javascript`. UUID generation now uses the built-in
+`globalThis.crypto.randomUUID()` API, which is available in Node.js 19+ and all modern browsers.
+
+This change has no impact on how UUID values are sent to or received from the server — UUID serialization and
+deserialization in GraphBinary is unchanged. Applications that depend on the `uuid` package solely because
+`gremlin-javascript` brought it in as a transitive dependency should add it directly to their own `package.json`
+if they still need it.
+
 == TinkerPop 4.0.0-beta.2
 
 *Release Date: April 1, 2026*

gremlin-js/gremlin-javascript/lib/utils.ts

@@ -22,8 +22,6 @@
  * @author Jorge Bay Gondra
  */
 
-import * as uuid from 'uuid';
-
 const gremlinVersion = '4.0.0-SNAPSHOT'; // DO NOT MODIFY - Configured automatically by Maven Replacer Plugin
 
 export function toLong(value: number | string) {
@@ -39,8 +37,7 @@ export class Long {
 }
 
 export function getUuid() {
-  // TODO: replace with `globalThis.crypto.randomUUID` once supported Node version is bump to >=19
-  return uuid.v4();
+  return globalThis.crypto.randomUUID();
 }
 
 export const emptyArray = Object.freeze([]) as any as any[];

gremlin-js/gremlin-javascript/package.json

@@ -33,7 +33,9 @@
   },
   "typesVersions": {
     "*": {
-      "language": ["./build/esm/language/index.d.ts"]
+      "language": [
+        "./build/esm/language/index.d.ts"
+      ]
     }
   },
   "files": [
@@ -43,8 +45,7 @@
     "antlr4ng": "3.0.16",
     "buffer": "^6.0.3",
     "eventemitter3": "^5.0.1",
-    "readable-stream": "^4.5.2",
-    "uuid": "^9.0.1"
+    "readable-stream": "^4.5.2"
   },
   "optionalDependencies": {
     "@aws-sdk/credential-providers": "^3.967.0",
@@ -57,17 +58,16 @@
     "@knighted/duel": "^4.0.2",
     "@tsconfig/node18": "^18.2.2",
     "@types/readable-stream": "^4.0.10",
-    "@types/uuid": "^9.0.8",
     "antlr-ng": "^1.0.10",
-    "chai": "~4.5.0",
-    "chai-string": "~1.5.0",
+    "chai": "^6.2.2",
+    "chai-string": "^2.0.0",
     "colors": "1.4.0",
     "cross-env": "^10.1.0",
+    "deep-eql": "^5.0.2",
     "eslint": "^9.36.0",
     "eslint-config-prettier": "^10.0.1",
     "eslint-plugin-prettier": "^5.0.0",
-    "globals": "^15.14.0",
-    "js-yaml": "^3.14.2",
+    "globals": "^17.5.0",
     "mocha": "^11.7.5",
     "prettier": "^3.0.0",
     "ts-node": "^10.9.2",

gremlin-js/gremlin-javascript/scripts/groovy/generate.groovy

@@ -56,7 +56,6 @@ radishGremlinFile.withWriter('UTF-8') { Writer writer ->
     writer.writeLine(
                     'import * as graphTraversalModule from \'../../lib/process/graph-traversal.js\';\n' +
                     'import * as traversalModule from \'../../lib/process/traversal.js\';\n' +
-                    'import * as uuid from \'uuid\';\n' +
                     'import { TraversalStrategies, VertexProgramStrategy, OptionsStrategy, PartitionStrategy, \n' +
                     '        ReadOnlyStrategy, GraphFilterStrategy, SeedStrategy, SubgraphStrategy, ProductiveByStrategy, \n' +
                     '        LambdaRestrictionStrategy, StandardVerificationStrategy, VertexProgramRestrictionStrategy, \n' +

gremlin-js/gremlin-javascript/test/cucumber/gremlin.js

@@ -17,14 +17,13 @@
  *  under the License.
  */
 
-import chai from 'chai';
-import { expect } from 'chai';
+import { expect, use, Assertion } from 'chai';
 import { VertexProperty, Property, Vertex, Edge, Path } from '../../lib/structure/graph.js';
 import { deepMembersById, opt } from '../cucumber/element-comparison.js';
 import deepEqual from 'deep-eql';
 
-chai.use(function (chai, chaiUtils) {
-  chai.Assertion.overwriteMethod('members', function (_super) {
+use(function (_chai, chaiUtils) {
+  Assertion.overwriteMethod('members', function (_super) {
     return deepMembersById;
   });
 });

gremlin-js/gremlin-javascript/test/unit/element-comparison-test.js

@@ -2,7 +2,7 @@
   "compilerOptions": {
     "target": "ES2022",
     "module": "ESNext",
-    "moduleResolution": "node",
+    "moduleResolution": "bundler",
     "baseUrl": ".",
     "paths": {
       "gremlin": [