fix(core): clamp uuidv7 RNG output to a valid uint32 so a nonconformant Math.random cannot crash event capture

.changeset/fix-uuidv7-clamp-nextuint32.md

@@ -0,0 +1,5 @@
+---
+'@posthog/core': patch
+---
+
+Stop crashing when the environment's `Math.random()` misbehaves. The vendored UUIDv7 generator builds its random fields from a `Math.random()`-based `nextUint32()`, and a nonconformant implementation that returns a value of 1 or greater, or NaN, pushed those fields out of range, so `fromFieldsV7` threw `RangeError: invalid field value` on every event captured. On React Native this is not hypothetical: Hermes implements `Math.random` with C++ `std::uniform_real_distribution`, which is documented to occasionally return its upper bound, and affected Android devices crash-looped on startup during the SDK's internal event-queue flush — a path applications cannot wrap in a try/catch. `nextUint32()` now clamps its result to a valid unsigned 32-bit integer (`>>> 0`), so a bad random value degrades UUID entropy for that id instead of taking the app down; the timestamp bits are untouched and generated ids remain spec-valid UUIDv7.

packages/core/src/vendor/uuidv7.spec.ts

@@ -0,0 +1,26 @@
+import { V7Generator } from './uuidv7'
+
+describe('uuidv7 default RNG', () => {
+  const realRandom = Math.random
+
+  afterEach(() => {
+    Math.random = realRandom
+  })
+
+  it.each([
+    ['exactly 1.0', 1.0],
+    ['greater than 1', 1.5],
+    ['NaN', NaN],
+  ])('does not throw when Math.random() returns %s', (_label, value) => {
+    Math.random = () => value
+    const generator = new V7Generator()
+    const uuid = generator.generate().toString()
+    expect(uuid).toMatch(/^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/)
+  })
+
+  it('still generates well-formed v7 UUIDs with the real Math.random', () => {
+    const generator = new V7Generator()
+    const uuid = generator.generate().toString()
+    expect(uuid).toMatch(/^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/)
+  })
+})

packages/core/src/vendor/uuidv7.ts

@@ -429,9 +429,15 @@ const getDefaultRandom = (): { nextUint32(): number } => {
 //     };
 //   }
   return {
+    // Clamp to a valid uint32: a nonconformant Math.random() that returns >= 1 or NaN
+    // (e.g. Hermes on Android implements Math.random with C++ std::uniform_real_distribution,
+    // which is documented to occasionally return its upper bound) would otherwise overflow the
+    // field ranges and make fromFieldsV7 throw `RangeError: invalid field value` on every
+    // generate call, crashing React Native apps during the internal event-queue flush.
     nextUint32: (): number =>
-      Math.trunc(Math.random() * 0x1_0000) * 0x1_0000 +
-      Math.trunc(Math.random() * 0x1_0000),
+      (Math.trunc(Math.random() * 0x1_0000) * 0x1_0000 +
+        Math.trunc(Math.random() * 0x1_0000)) >>>
+      0,
   };
 };