[repo-assist] Fix Snappier high-severity vulnerability, update fsdocs-tool
- Dominant language
- F#
- Stars
- 1k
- Forks
- 191
- Avg merge
- 5d 15h
- Merged PRs (30d)
- 2
Description
🤖 *This PR was created by Repo Assist, an automated AI assistant. Please review carefully before merging.*
## Summary
Two small, low-risk engineering maintenance updates:
1. **Security fix**: Bumped the transitive `Snappier` dependency (pulled in via `Parquet.Net`) from `1.3.0` to `1.3.1` by pinning it explicitly in `paket.dependencies`. This resolves a **high-severity** advisory: [GHSA-pggp-6c3x-2xmx](https://github.com/advisories/GHSA-pggp-6c3x-2xmx), which was showing up as a `NU1903` warning during every restore/build.
2. **Tooling update**: Updated `fsdocs-tool` from `22.0.0` to the stable `22.2.0` GA release in `.config/dotnet-tools.json`.
## Rationale
- The Snappier vulnerability warning appeared on every build involving `Deedle.Parquet` / `Deedle.Parquet.Tests` / `Deedle.CSharp.Tests`. Pinning to the patched version is the minimal, surgical fix — no source code changes needed.
- `fsdocs-tool` 22.2.0 is a routine patch-level bump within the same major/minor generation already in use; docs build successfully with it.
## Trade-offs
- None identified. Both changes are patch/point releases with no API surface changes affecting Deedle's own code.
## Test Status
- ✅ `dotnet paket install` — resolved cleanly, minimal `paket.lock` diff (only `Snappier` version bump).
- ✅ `./build.sh --no-tests` — full solution + docs build succeeded with `fsdocs-tool` 22.2.0.
- ✅ `dotnet test tests/Deedle.Tests/Deedle.Tests.fsproj -c Release` — 720/720 passed.
- ✅ `dotnet test tests/Deedle.Parquet.Tests/Deedle.Parquet.Tests.fsproj -c Release` — 55/55 passed (exercises the Snappier-dependent Parquet codec path).
Updated `RELEASE_NOTES.md` under the unreleased `8.1.0` section.
---
> [!WARNING]
> **Protected Files — Push Permission Denied**
>
> This was originally intended as a pull request, but the patch modifies protected files. A human must create the pull request manually.
>
>
> Protected files
>
> - [.config/dotnet-tools.json](https://github.com/fslaborg/Deedle/blob/master/.config/dotnet-tools.json)
>
> The push was rejected because GitHub Actions does not have `workflows` permission to push these changes, and is never allowed to make such changes, or other authorization being used does not have this permission.
>
>
Create the pull request manually
```sh
# Download the patch from the workflow run
gh run download 34011380030 -n agent -D /tmp/agent-34011380030
# Create a new branch
git checkout -b repo-assist/eng-paket-update-20260906-fbdc26ef7756a458 master
# Apply the patch (--3way handles cross-repo patches)
git am --3way /tmp/agent-34011380030/aw-repo-assist-eng-paket-update-20260906.patch
# Push the branch and create the pull request
git push origin repo-assist/eng-paket-update-20260906-fbdc26ef7756a458
gh pr create --title '[repo-assist] Fix Snappier high-severity vulnerability, update fsdocs-tool' --base master --head repo-assist/eng-paket-update-20260906-fbdc26ef7756a458 --repo fslaborg/Deedle
```
> Generated by 🌈 Repo Assist, see [workflow run](https://github.com/fslaborg/Deedle/actions/runs/34011380030). [Learn more](https://github.com/githubnext/agentics/blob/main/docs/repo-assist.md).
> Comment /repo-assist to run again
>
Add this agentic workflow to your repo
To install this agentic workflow, run
```
gh aw add githubnext/agentics/workflows/repo-assist.md@ae8d551f07c7ed7619f8c58c7bb4c3ac89395d38
```
Contributor guide
Research direction
Start with paket.dependencies and .config/dotnet-tools.json, then run dotnet paket install to inspect the resolved paket.lock changes. Check RELEASE_NOTES.md under the unreleased 8.1.0 section, run ./build.sh --no-tests and the two named dotnet test commands, and confirm the Snappier and fsdocs-tool updates build cleanly without source changes.
Written by the indexing model from the issue text.
Assessment
- Domain
- build-system, security, tooling
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 62/100