Summary

Remove the vulnerable satori/go.uuid transitive dependency by migrating Azure SDK packages from Track 1 (old) to Track 2 (new).

Why this change?

The satori/go.uuid library has CVE-2021-3538, a vulnerability where the generated UUIDs are predictable due to insufficient randomness seeding. The library is also unmaintained - the author has abandoned it and the repository is archived.

The old Azure SDK for Go (Track 1, using github.com/Azure/azure-sdk-for-go/services/...) depends on satori/go.uuid. Microsoft has been deprecating Track 1 in favor of Track 2 (github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/...), which uses github.com/google/uuid instead.

The root cause was the datafactory package - it was the one pulling in satori/go.uuid as a transitive dependency.

Migrated Packages

Breaking Changes

This affects users who call Azure helper functions (e.g., azure.GetSQLServer(), azure.GetMYSQLServer(), azure.GetDataFactory()) and access fields on the returned structs.

Users who only use boolean helpers like azure.AppExists() or azure.DatabaseExists() are NOT affected.

1. Import changes (if importing SDK types directly)

// Before
import "github.com/Azure/azure-sdk-for-go/profiles/latest/sql/mgmt/sql"

// After
import "github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/sql/armsql"

2. Property access paths changed

// Before
server.ServerProperties.State
server.ServerProperties.FullyQualifiedDomainName
factory.FactoryProperties.ProvisioningState

// After
server.Properties.State
server.Properties.FullyQualifiedDomainName
factory.Properties.ProvisioningState

3. Enum/constant types changed

// Before
sql.ServerStateReady
mysql.ServerStateReady

// After
armsql.ServerStateReady
armmysql.ServerStateReady

4. Struct field name changes

// Before (MySQL)
server.Sku.Name
database.DatabaseProperties.Charset

// After
server.SKU.Name
database.Properties.Charset

Test plan

• go build ./... passes
• go mod why -m github.com/satori/go.uuid confirms module is no longer needed
• satori/go.uuid removed from go.mod and go.sum
• CI tests pass

Fixes #1624