src/providers/code-actions/vulnerability.ts (1)

47-51: Minor: Redundant parseVersion call on fixedInVersion.

The fixedInVersion extracted from the diagnostic code is already a raw semver string (e.g., "16.1.5"), so parseVersion(fixedInVersion)?.semver will return the same value. While this works correctly, it's slightly redundant.

♻️ Optional simplification

       const currentVersion = document.getText(diagnostic.range)
       const currentSemver = parseVersion(currentVersion)?.semver
-      const fixedSemver = parseVersion(fixedInVersion)?.semver ?? fixedInVersion
-      if (currentSemver && currentSemver === fixedSemver)
+      if (currentSemver && currentSemver === fixedInVersion)
         return []

src/providers/diagnostics/rules/vulnerability.ts (2)

15-20: Clarify function intent: this finds the maximum (not earliest) fixedIn version.

The reduce logic returns the maximum version from the list (since lt(best, current) keeps the larger value). This is correct when you need to fix all vulnerabilities simultaneously—the user must upgrade to at least the highest fixedIn version. However, the PR objective references "earliest safe version," which could cause confusion.

Consider renaming to getMinimumRequiredFixVersion or adding a brief comment explaining why the maximum is chosen.

📝 Suggested clarification

+/**
+ * Returns the highest fixedIn version, ensuring all vulnerabilities are addressed.
+ */
 function getBestFixedInVersion(fixedInVersions: string[]): string | undefined {
   if (!fixedInVersions.length)
     return

-  return fixedInVersions.reduce((best, current) => lt(best, current) ? current : best)
+  return fixedInVersions.reduce((best, current) => lt(best, current) ? current : best)
 }

---

62-64: Reconsider preserving the version prefix in the upgrade message.

Using parsed.prefix (e.g., ^ or ~) in the message produces output like "Upgrade to ^16.1.5 to fix." This could be confusing because:

1. The prefix implies a range, not a specific version.
2. If the user's current range (e.g., ^16.0.0) already technically includes 16.1.5, the message may seem contradictory.

Consider showing the exact version without a prefix in the message, or clarifying that the version number is the minimum required.

💡 Suggested fix

   const fixedInVersion = getBestFixedInVersion(rootVulnerabilitiesFixedIn)
   const messageSuffix = fixedInVersion
-    ? ` Upgrade to ${parsed.prefix}${fixedInVersion} to fix.`
+    ? ` Upgrade to ${fixedInVersion} to fix.`
     : ''

tests/code-actions/vulnerability.test.ts (1)

45-50: Consider also asserting the WorkspaceEdit replacement and CodeActionKind.

The test only checks title and isPreferred via objectContaining. Verifying that edit contains the correct replacement text (e.g. ^1.2.3) and that kind === CodeActionKind.QuickFix would catch regressions in the actual fix logic, not just the label.

src/providers/diagnostics/rules/vulnerability.ts (1)

55-61: Guard against duplicate fixedIn values before selecting the best.

If multiple root-level vulnerabilities report the same fixedIn version, rootVulnerabilitiesFixedIn will contain duplicates. This is harmless for correctness (the reduce still picks the minimum), but deduplicating avoids redundant comparisons and makes intent clearer.

Proposed change

  const rootVulnerabilitiesFixedIn = vulnerablePackages
    .flatMap(({ depth, vulnerabilities }) => {
      if (depth !== 'root')
        return []

      return vulnerabilities.flatMap(({ fixedIn }) => fixedIn ? [fixedIn] : [])
    })

- const fixedInVersion = getBestFixedInVersion(rootVulnerabilitiesFixedIn)
+ const fixedInVersion = getBestFixedInVersion([...new Set(rootVulnerabilitiesFixedIn)])