Correct, this is a very specific attack where an attacker can generate UUIDv5 collisions but cannot force a collision of a chosen UUID. If your usage doesn't serve any security functions then its fine to use an insecure hash function.
One thing I find interesting is that we seem to be at the end of the road for secure hash-based UUIDs. SHA-1 was already truncated (I.E. weakened) from 160 bits to 122 bits to fit the UUID width. To fit a SHA-256 hash you'd need to throw away a majority of the bits!
One thing I find interesting is that we seem to be at the end of the road for secure hash-based UUIDs. SHA-1 was already truncated (I.E. weakened) from 160 bits to 122 bits to fit the UUID width. To fit a SHA-256 hash you'd need to throw away a majority of the bits!