Skip to main content

RFC — Remove satori/go.uuid (EOL) — standardize on google/uuid

Bucket item: A4 · Class: 🟡 Standard · Jira Story: TF-3504 · Epic: TF-3500

Context / Problem​

The service pulls two UUID libraries:

LocusPackage
go.mod:29github.com/satori/go.uuid v1.2.0 — deprecated / unmaintained
go.mod:17github.com/google/uuid v1.6.0 — maintained, already vendored

satori/go.uuid is abandoned and had randomness/security advisories in older tags. Two UUID libraries create inconsistency. Remove satori/go.uuid and standardize on google/uuid (already present).

Proposed change​

Replace all satori/go.uuid call sites with google/uuid, then drop the dependency.

Execution plan (call to action)​

  1. grep -rn "satori/go.uuid" — enumerate every import + call site.
  2. Port each: uuid.NewV4() → google/uuid uuid.NewRandom() / uuid.New(); uuid.FromString → uuid.Parse. Watch byte-order/format parity where UUIDs are persisted or compared.
  3. Remove satori/go.uuid from go.mod; go mod tidy; build + test.
  4. Confirm no wire/DB-format change for any persisted UUID (guard-rail: existing rows still parse).

Risks & rollback​

  • Risk: low-medium — API differences (NewV4 error-return, FromString→Parse) and any place relying on satori's exact string/byte formatting.
  • Rollback: revert the call-site diff + go.mod change; both libraries coexist as before.

Open questions​

  1. Any persisted or externally-exchanged UUID whose format must remain byte-identical?
  2. Any transitive dependency that itself pulls satori/go.uuid (so it can't be fully dropped yet)?