fix: correctly assign targetVersion for parent-update targets

body.md

@@ -0,0 +1,5 @@
+Fixes #1007.
+
+The `targetVersion` for `parent-update` was being incorrectly populated with the child dependency's safe version (`targetChildVersion`). During map insertion, if the parent was also flagged as a direct finding, its correct `targetVersion` could be overwritten by this incorrect child version due to version comparison sorting, resulting in cross-wired suggested commands.
+
+This assigns `currentVersion` to `targetVersion` for `parent-update` targets, preventing incorrect version merging while correctly indicating no direct version change is needed in the UI.

src/remediation/fix-commands.ts

@@ -247,7 +247,7 @@ export function buildSuggestedFixCommandPlan(
       upsertTarget(targetsByPackage, {
         package: finding.recommendedNpmTransitiveRemediation.package,
         currentVersion: finding.recommendedNpmTransitiveRemediation.currentVersion,
-        targetVersion: finding.recommendedNpmTransitiveRemediation.targetChildVersion,
+        targetVersion: finding.recommendedNpmTransitiveRemediation.currentVersion,
         scannedVersions: null,
         knownVulnerableVersions: null,
         kind: "parent-update",
@@ -561,7 +561,7 @@ export function findFixTargetForFinding(
     if (finding.recommendedNpmTransitiveRemediation?.kind === "update-parent-within-range") {
       return (
         item.kind === "parent-update" &&
-        item.targetVersion === finding.recommendedNpmTransitiveRemediation.targetChildVersion &&
+        (item.targetVersion === finding.recommendedNpmTransitiveRemediation.currentVersion || item.targetVersion === finding.recommendedNpmTransitiveRemediation.targetChildVersion) &&
         (item.package === finding.recommendedNpmTransitiveRemediation.package || item.package === finding.pkg.name)
       );
     }

tests/output.test.ts

@@ -596,7 +596,7 @@ describe("output formatters", () => {
           expect.objectContaining({
             package: "mocha",
             currentVersion: "10.0.0",
-            targetVersion: "5.1.0",
+            targetVersion: "10.0.0",
             kind: "parent-update",
           }),
         ],

website/docs/html-report.md

@@ -42,10 +42,13 @@ In multi-folder mode (no root lockfile, two or more nested lockfiles), the repor
 
 **Findings table** with interactive controls:
 - Filter by severity or direct-only
+- EPSS threat percentile column displaying exploitation likelihood relative to all published CVEs (highlighted in purple for top 10%)
+- EPSS Priority Signal column classifying each finding into actionable tiers (`Fix Now`, `Fix Soon`, `Monitor`, `Low Priority`)
 - Expandable rows showing vulnerability description, contextual risk summary,
-  next action, dependency path, and recommended action
+  next action, dependency path, recommended action, and detailed EPSS Priority Signal breakdown
 - CVE / GHSA advisory IDs linked to osv.dev and GitHub Security Advisories
 - Fix version shown inline when one is available
+- Priority Signal legend below the findings table detailing the severity × exploitation likelihood matrix
 
 ## Options
 

website/docs/reading-output.md

@@ -14,7 +14,7 @@ Running `cve-lite .` without flags gives you a focused view: the top urgent find
 
 **What to read first:**
 
-- The **Vulnerabilities found** block — top critical/high packages with one-line fix guidance each
+- The **Vulnerabilities found** block — top critical/high packages with one-line fix guidance each. Findings with high EPSS exploitation likelihood (top 10%) are flagged inline with a `` `⚡ Fix Now` `` priority signal badge.
 - The **Copy And Run These Fix Commands** block — grouped, package-manager-native commands ready to execute
 - The **Summary** — total count broken down by severity and direct vs transitive
 
@@ -74,14 +74,19 @@ Why this helps:
 
 ### 3) Use the findings table for risk inventory
 
-The main findings table is your full inventory of affected packages, severity, relationship type, fixed-version hints, and advisory IDs.
+The main findings table is your full inventory of affected packages, severity, relationship type, fixed-version hints, EPSS threat percentiles, EPSS priority classification, and advisory IDs.
 
 ![Juice Shop findings table](https://raw.githubusercontent.com/sonukapoor/cve-lite-cli/main/assets/owasp-juice-shop-4.png)
 
 How to use this section:
 
 - read `Package` and `Version` to understand what you control
 - use `Usage` to quickly identify if the dependency is actually imported or just noise (requires `--usage` flag)
+- review `EPSS` (raw percentile) and `EPSS Priority` to triage findings by real-world exploitation likelihood:
+  - `Fix Now`: Critical or high severity + top 10% EPSS exploitation likelihood — address immediately
+  - `Fix Soon`: Critical or high severity, but EPSS not in top 10% — schedule remediation
+  - `Monitor`: Medium or lower severity + top 10% EPSS exploitation likelihood — watch closely
+  - `Low Priority`: Medium or lower severity, but EPSS not in top 10% — handle in routine maintenance cycles
 - use `Fixed` to see what the safe target version is
 
 ### 4) Review coverage notes
@@ -93,7 +98,7 @@ Coverage notes appear below the findings table. They describe what the scan cove
 ## 10-minute workflow
 
 1. Run `cve-lite . --verbose --all`.
-2. Apply critical/high command groups.
+2. Address `Fix Now` findings and critical/high command groups first.
 3. Apply direct fix groups with validated targets.
 4. Apply parent-upgrade command groups for transitive paths.
 5. Rescan and repeat until urgent findings are reduced.