Replace github.com/satori/go.uuid ASAP, as it can generate duplicate UUIDs. The problem appeared in January, 2018, a fix was merged on April 4, 2018 in commit satori/go.uuid@75cca53.

However, the author did not tag a new version release after incorporating the fix, so anyone pulling the code using the standard go.mod would get the unpatched version 1.2.0, which contains the bug. The bug itself is documented in satori/go.uuid#73.

There was no changelog or public advisory describing the existence of the bug or its fix, so Dependabot was not able to pick it up (which is a problem, because this library is widely used, and many people are still discovering the issue).

A search through our production repo on March 1, 2021 showed we do not have any duplicate UUIDs, but this library needs to be replaced ASAP. The preferred library seems to be https://github.com/google/uuid.