feat: show fixed version on issues

[claudiacodacy]

What

Surfaces the new fixedVersion field of CommitIssue (API 57.7.9+) on SCA issues, matching what finding/findings already show. Counterpart of codacy/codacy-spa#3145.

• issue, issues and pull-request --issue pass issue.fixedVersion to the existing dependency chain helpers:
  • direct: Direct - Update <pkg> to <version>
  • transitive: Transitive - a → b → c (Fixed in <version>)
• An empty fixedVersion (no fix available) renders as before, with no version text.
• finding's linked-issue block still prefers the SrmItem.fixedVersion it already passes; the issue's own value is the fallback.
• --output json gains fixedVersion on all three commands.

API bump

Pinned 57.6.4 → 57.7.10 (57.7.9 is the first version with the field; it and 57.7.10 bundle identical specs).

Tests

792 pass (+8 new), tsc --noEmit clean.
Docs: command specs, src/commands/AGENTS.md, SPECS/README.md changelog and a changeset are updated.

🤖 Generated with Claude Code

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 4 complexity · 27 duplication

Metric	Results
Complexity	4
Duplication	27

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

The API-derived fixedVersion value is interpolated into terminal output without demonstrated sanitization, creating a potential control-sequence injection risk. This should be addressed before merging.

Required finding-precedence behavior and API-version validation lack dedicated tests. Codacy reports the changes as up to standards; no uncovered complex files were identified.

About this PR

• Add regression coverage for both SrmItem.fixedVersion precedence and fallback to the linked issue's fixedVersion.
• Add an automated check that the API fetch script uses API version 57.7.10.

1 comment outside of the diff

src/commands/issue.test.ts

_{line 1 🟡 MEDIUM RISK}
Suggestion: This test file has grown beyond 500 lines and the new dependency-chain cases repeat substantial mock/setup code. Consider extracting shared fixtures and helpers or moving the dependency-chain scenarios into a focused test file.

Test suggestions

• issue detail renders a fixed version for a direct dependency
• issue detail renders a fixed version for a transitive dependency
• issue detail omits version text when fixedVersion is empty or absent
• issues list renders a fixed version in the dependency-chain card
• issue, issues, and pull-request --issue JSON output includes fixedVersion
• pull-request --issue renders a fixed version in the dependency-chain block
• finding linked-issue rendering prefers SrmItem.fixedVersion and falls back to issue.fixedVersion
• API fetch script uses version 57.7.10
• fixedVersion containing ANSI/control characters is safely rendered without emitting control sequences

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. finding linked-issue rendering prefers SrmItem.fixedVersion and falls back to issue.fixedVersion
2. API fetch script uses version 57.7.10
3. fixedVersion containing ANSI/control characters is safely rendered without emitting control sequences

_{TIP How was this review? Give us feedback}