Hacker News Reader

Application level code validates UUIDs based on a specific format not to mention what the specific database might expect depending on the data type

This sounds like a mistake? When/why should the application validate the format of a UUID?

Why shouldn't they?

When our services get Strings in requests that are UUIDs we convert them to typed java.util.Uuid objects, if they're not valid they get rejected.