fslaborg / fslaborg/Deedle

[repo-assist] Fix Snappier high-severity vulnerability, update fsdocs-tool

Open Beginner friendly
#735 0 comments 0 reactions 0 assignees View on GitHub
agentic-workflows automation repo-assist security
Dominant language
F#
Stars
1k
Forks
191
Avg merge
5d 15h
Merged PRs (30d)
2

Description

🤖 *This PR was created by Repo Assist, an automated AI assistant. Please review carefully before merging.*

## Summary

Two small, low-risk engineering maintenance updates:

1. **Security fix**: Bumped the transitive `Snappier` dependency (pulled in via `Parquet.Net`) from `1.3.0` to `1.3.1` by pinning it explicitly in `paket.dependencies`. This resolves a **high-severity** advisory: [GHSA-pggp-6c3x-2xmx](https://github.com/advisories/GHSA-pggp-6c3x-2xmx), which was showing up as a `NU1903` warning during every restore/build.
2. **Tooling update**: Updated `fsdocs-tool` from `22.0.0` to the stable `22.2.0` GA release in `.config/dotnet-tools.json`.

## Rationale

- The Snappier vulnerability warning appeared on every build involving `Deedle.Parquet` / `Deedle.Parquet.Tests` / `Deedle.CSharp.Tests`. Pinning to the patched version is the minimal, surgical fix — no source code changes needed.
- `fsdocs-tool` 22.2.0 is a routine patch-level bump within the same major/minor generation already in use; docs build successfully with it.

## Trade-offs

- None identified. Both changes are patch/point releases with no API surface changes affecting Deedle's own code.

## Test Status

- ✅ `dotnet paket install` — resolved cleanly, minimal `paket.lock` diff (only `Snappier` version bump).
- ✅ `./build.sh --no-tests` — full solution + docs build succeeded with `fsdocs-tool` 22.2.0.
- ✅ `dotnet test tests/Deedle.Tests/Deedle.Tests.fsproj -c Release` — 720/720 passed.
- ✅ `dotnet test tests/Deedle.Parquet.Tests/Deedle.Parquet.Tests.fsproj -c Release` — 55/55 passed (exercises the Snappier-dependent Parquet codec path).

Updated `RELEASE_NOTES.md` under the unreleased `8.1.0` section.

---

> [!WARNING]
> **Protected Files — Push Permission Denied**
>
> This was originally intended as a pull request, but the patch modifies protected files. A human must create the pull request manually.
>
>
> Protected files
>
> - [.config/dotnet-tools.json](https://github.com/fslaborg/Deedle/blob/master/.config/dotnet-tools.json)
>
> The push was rejected because GitHub Actions does not have `workflows` permission to push these changes, and is never allowed to make such changes, or other authorization being used does not have this permission.
>
>

Create the pull request manually

```sh
# Download the patch from the workflow run
gh run download 34011380030 -n agent -D /tmp/agent-34011380030

# Create a new branch
git checkout -b repo-assist/eng-paket-update-20260906-fbdc26ef7756a458 master

# Apply the patch (--3way handles cross-repo patches)
git am --3way /tmp/agent-34011380030/aw-repo-assist-eng-paket-update-20260906.patch

# Push the branch and create the pull request
git push origin repo-assist/eng-paket-update-20260906-fbdc26ef7756a458
gh pr create --title '[repo-assist] Fix Snappier high-severity vulnerability, update fsdocs-tool' --base master --head repo-assist/eng-paket-update-20260906-fbdc26ef7756a458 --repo fslaborg/Deedle
```

> Generated by 🌈 Repo Assist, see [workflow run](https://github.com/fslaborg/Deedle/actions/runs/34011380030). [Learn more](https://github.com/githubnext/agentics/blob/main/docs/repo-assist.md).
> Comment /repo-assist to run again
>

Add this agentic workflow to your repo

To install this agentic workflow, run

```
gh aw add githubnext/agentics/workflows/repo-assist.md@ae8d551f07c7ed7619f8c58c7bb4c3ac89395d38
```

Contributor guide

Open the contributing guide

Research direction

Start with paket.dependencies and .config/dotnet-tools.json, then run dotnet paket install to inspect the resolved paket.lock changes. Check RELEASE_NOTES.md under the unreleased 8.1.0 section, run ./build.sh --no-tests and the two named dotnet test commands, and confirm the Snappier and fsdocs-tool updates build cleanly without source changes.

Written by the indexing model from the issue text.

Assessment

Domain
build-system, security, tooling
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
62/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.