UUID Package Introduces Vulnerability

[dana-doherty]

Playground link - N/A

The package github.com/satori/go.uuid@v1.2.0 introduces a vulnerabiltiy to the postgres driver for gorm, meaning we cannot use the default postgres driver and would need to write our own driver to get past this. Wondering if it would be possible to have the dependency github.com/satori/go.uuid@v1.2.0 updated or removed.

Details of vulnerability:
Affected versions of this package are vulnerable to Insecure Randomness producing predictable UUID identifiers due to the limited number of bytes read when using the g.rand.Read function.

[akshaybharambe14]

As this is not a direct dependency, it removed from github.com/jackc/pgx in jackc/pgtype@cf8fe4a#diff-33ef32bf6c23acb95f5902d7097b7a1d5128ca061167ec0716715b0b9eeaa5f6. We just need to update dependencies.

[jinzhu]

done.