how does the project use github.com/satori/go.uuid ?
if it never generates an uuid, it's not vulnerable

how does the project use github.com/satori/go.uuid ? if it never generates an uuid, it's not vulnerable

I have used the github.com/satori/go.uuid package in my project and can confirm that it is being used to generate UUIDs. Additionally, I had previously received a warning from Govulncheck about a vulnerability in this package a few months ago.

However, in my recent run of Govulncheck, I did not receive any warnings about this package on the same project. The vulnerability is still present according to the Golang vulnerability database.

Any update about this issue?

without a real example it's difficult to say what's happening

Here is a simple Go application that generates a UUID using the github.com/satori/go.uuid package:

package main

import (
	"fmt"

	"github.com/satori/go.uuid"
)

func main() {
	id := uuid.NewV4()
	fmt.Printf("Generated UUID: %v\n", id)
}

Assuming you have the github.com/satori/go.uuid package installed in your go.mod, you can run this application by navigating to the directory containing this file and executing go run main.go. This should generate a UUID and print it to the console.

If you run Govulncheck on this application, it should detect the vulnerability in github.com/satori/go.uuid version 1.2.0 and produce a warning, but it doesn’t

1.2.0 is not a vulnerable version