[Bug] 'Recommended target' column shows "npm install" instead of the resolved version (npm within-range parent updates) #989

Note: in-house item already being handled by the maintainer - not open for contribution. Filed for tracking only.

Summary

In the "parent updates within range" table, the Recommended target column renders the literal npm install where the resolved version belongs. Example:

│ path-to-regexp │ 1.7.0 │ npm install │ ... │ react-router@5.2.0 already allows path-to-regexp@1.9.0 within the current dependency range │

The correct value (1.9.0) is present, but only in the Context column.

Root cause

src/remediation/fix-commands.ts:252 hardcodes displayTargetVersion: "npm install" for the npm update-parent-within-range case, while the real resolved child version is correctly stored in targetVersion (line 251). The printer renders displayTargetVersion ?? targetVersion (src/output/printers.ts:884), so the hardcoded string wins over 1.9.0. Same pattern in the HTML report (src/output/html-reporter.ts:822).

This is npm-specific: the pnpm within-range path sets no displayTargetVersion, so it correctly shows the version (asserted in tests/output.test.ts:555-560). The npm case is locked in by tests/output.test.ts:544 asserting displayTargetVersion: "npm install".

Fix direction

Drop the displayTargetVersion: "npm install" override (or set it to the resolved child version) so the column shows 1.9.0, matching the pnpm path and the direct-fix table. The remediation command (npm update <pkg>) is already carried separately in the target's command field, so nothing is lost. Update the output.test.ts:544 assertion accordingly.

Reported via external review of a NestJS scan example.