chore(vscode): refresh NOTICES for the fast-uri bump

[yiliang114]

What this PR does

Updates the VS Code companion's NOTICES.txt header line for fast-uri from 3.1.5 to 3.1.7, matching the lockfile bump that #10862 landed on main.

Why it's needed

The companion's notices carry a version on each dependency's header line, and CI regenerates the file and diffs it ("Check VS Code companion notices are up-to-date"). After the lockfile bump landed without this file, that check is red on main and fails every PR merge-ref run until fixed.

Reviewer Test Plan

How to verify

The change is one line produced by the same derivation #10842 used, which came out byte-identical to a full regeneration of the file. CI's notices check going green on this PR is the end-to-end confirmation.

Evidence (Before & After)

N/A — generated metadata file, no user-visible output.

Tested on

OS	Status
🍏 macOS	⚠️
🪟 Windows	⚠️
🐧 Linux	✅

Verified by the CI notices check on this PR (Linux lane).

Environment (optional)

N/A (metadata file).

Risk & Scope

• Main risk or tradeoff: none — one generated header line.
• Not validated / out of scope: nothing beyond the single version string.
• Breaking changes / migration notes: none.

Linked Issues

Follow-up to #10862 (the lockfile bump landed without the companion notices).

中文说明

本 PR 把 VS Code companion 的 NOTICES.txt 中 fast-uri 的头部版本行从 3.1.5 更新为 3.1.7，与 #10862 合入 main 的 lockfile 升级保持一致。

原因：companion 的 notices 在每个依赖的头部行携带版本号，CI 会重新生成该文件并 diff。lockfile 升级合入时未带上此文件，导致 main 上该检查变红，并在修复前拖红所有 PR 的 merge-ref 检查。

验证：单行改动采用与 #10842 相同的推导方式（该推导与完整重新生成的结果逐字节一致），以本 PR 的 CI notices 检查变绿作为端到端确认。无用户可见变化。风险与范围：无——仅一行生成的头部文本；无破坏性变更。关联：#10862 的后续修复。

[qwen-code-ci-bot]

⏳ Approval still deferred — 2 PR CI workflow run(s) still in progress for 0a54b87; the finalize job approves automatically once every run lands green. finalize run

⏳ 审批仍在延迟中 —— 0a54b87 还有 2 个 PR CI workflow 在运行，全部通过后 finalize 任务会自动提交审批。查看 finalize 运行

[qwen-code-ci-bot]

Thanks for the quick follow-up!

Template looks good ✓

Problem: real and deterministic. #10862 landed the lockfile bump (fast-uri 3.1.5 → 3.1.7) without regenerating the companion notices, and the "Check VS Code companion notices are up-to-date" step regenerates the file and fails on any diff. On main, package-lock.json now resolves node_modules/fast-uri to 3.1.7 while the committed NOTICES.txt still says fast-uri@3.1.5 — so every full-profile CI run fails that step until this lands. Main's own push run and other open PRs' merge-ref runs are sitting in the Test (ubuntu-latest, Node 22.x) job right now where that step lives.

Direction: aligned — this restores a required green gate on main and unblocks every other PR's merge-ref CI. No CHANGELOG surface (generated metadata), which is expected.

Size: not a core path. One generated metadata file, +1/−1.

Approach: exactly right — one header line, which is precisely what npm run generate:notices --workspace=qwen-code-vscode-ide-companion emits. Verified statically that the one line is byte-complete: upstream fast-uri v3.1.5...v3.1.7 touched no license or notice files (only code and tests), and #10862's lockfile diff changed exactly one resolved URL (fast-uri), so no other section can drift. Nothing to cut.

Risk: no elevated risk signals.

Moving on to code review. 🔍

中文说明

感谢快速跟进！

模板完整 ✓

问题：真实存在且是确定性的。#10862 合入了 lockfile 升级（fast-uri 3.1.5 → 3.1.7）但没有重新生成 companion notices，而 "Check VS Code companion notices are up-to-date" 步骤会重新生成该文件并在有 diff 时失败。main 上 package-lock.json 已将 node_modules/fast-uri 解析为 3.1.7，而已提交的 NOTICES.txt 仍是 fast-uri@3.1.5——所以在修复合入前，所有 full profile 的 CI 运行都会在该步骤失败。main 自身的 push 运行和其他 open PR 的 merge-ref 运行此刻正在执行包含该步骤的 Test (ubuntu-latest, Node 22.x) job。

方向：对齐——这恢复了 main 上必须为绿的门禁，并解锁其他所有 PR 的 merge-ref CI。CHANGELOG 无体现（生成的元数据），这是预期内的。

规模：非核心路径。一个生成的元数据文件，+1/−1。

方案：恰好——一行头部文本，正是 npm run generate:notices --workspace=qwen-code-vscode-ide-companion 会产出的内容。已静态验证这一行是字节级完整的：fast-uri 上游 v3.1.5...v3.1.7 未改动任何 license/notice 文件（只有代码和测试），且 #10862 的 lockfile diff 恰好只改了一个 resolved URL（fast-uri），所以其他段落不可能漂移。无可裁剪。

风险：无升级风险信号。

进入代码审查 🔍

— Qwen Code · qwen3.8-max

_{Reviewed at 0a54b87699fa35829bd891d2e567756a1e01aa5f · re-run with @qwen-code /triage}

[qwen-code-ci-bot]

Code review

Independent pass first: the right fix here is to regenerate the companion notices (npm run generate:notices --workspace=qwen-code-vscode-ide-companion) and commit whatever comes out. The diff is exactly that output for this bump — one header line, fast-uri@3.1.5 → fast-uri@3.1.7 at line 4359, nothing else.

The one line is byte-complete: upstream fast-uri changed no license or notice files between v3.1.5 and v3.1.7 (only index.js, lib/, tests, and package.json), and #10862's lockfile diff changed exactly one resolved URL, so no other section's version, copyright line, or license text can drift. No findings.

Testing evidence

Unattended CI run — no PR code was executed; the evidence below is the PR's own CI on the reviewed commit, read through the API, plus the observed failure that motivated this PR.

Observed failure (the problem this fixes): #10862's own CI already showed the breakage — its Test (ubuntu-latest, Node 22.x) job failed at this exact step with Error: NOTICES.txt is out of date. and a diff stat of exactly 1 file changed, 1 insertion(+), 1 deletion(-). That confirms both the failure and that the regeneration delta is a single line. (The other red on that run, Post Coverage Comment, was downstream noise: no coverage artifact was uploaded because the test job failed.) #10862 was merged by a maintainer despite the red check — it was clearing a high-severity dependency audit — which is how the failure landed on main.

This PR's CI: the decisive signal is the same step inside Test (ubuntu-latest, Node 22.x) on this commit — it regenerates the file and fails on any diff, so that job going green here is the end-to-end confirmation. It is still running at the time of writing; the table below is updated automatically once CI settles.

CI results for 0a54b87 — this table auto-updates as CI workflows complete:

Check	Conclusion
Integration Tests (no-AK, No Sandbox)	⏳ running
Secret scan (TruffleHog)	⏳ running
Test (ubuntu-latest, Node 22.x)	⏳ running
Classify PR	✅ success
Dependency CVE audit	✅ success
Desktop Shell (ubuntu-22.04)	✅ success
Desktop Shell (windows-2022)	✅ success

_{One row per check name (latest run); skipped checks omitted; failures sort first. / 每个检查名一行（取最新一次运行），省略 skipped，失败项排在最前。}

The macOS/Windows lane skips are expected for a notices-only change; those jobs don't carry the notices check anyway. Not verified: nothing beyond the pending CI above — this is a generated metadata file with no runtime behavior, so there is no behavioral claim for a sandboxed /verify or /tmux lane to settle.

中文说明

代码审查：先做独立方案——正确的修复就是重新生成 companion notices（npm run generate:notices --workspace=qwen-code-vscode-ide-companion）并提交产物。diff 正是该命令对这次升级的输出——仅第 4359 行头部 fast-uri@3.1.5 → fast-uri@3.1.7，别无其他。这一行是字节级完整的：fast-uri 上游 v3.1.5 到 v3.1.7 未改动任何 license/notice 文件（只有 index.js、lib/、测试和 package.json），且 #10862 的 lockfile diff 恰好只改了一个 resolved URL，因此其他段落的版本、版权行或许可证文本都不可能漂移。无发现。

测试证据：无人值守 CI 运行——未执行任何 PR 代码；证据来自对被审提交自身 CI 的 API 读取，外加触发本修复的已观测失败。已观测失败：#10862 自身的 CI 已展示了这一损坏——其 Test (ubuntu-latest, Node 22.x) job 恰在此步骤失败，报 Error: NOTICES.txt is out of date.，diff stat 恰好为 1 file changed, 1 insertion(+), 1 deletion(-)——既证实了失败，也证实重新生成的差异就是单行。（该运行另一个红色 Post Coverage Comment 是下游噪音：测试 job 失败导致没有上传覆盖率产物。）#10862 为清除高危依赖审计被维护者带着红色检查合入，失败由此落到 main。本 PR 的 CI：决定性信号是本提交上同一步骤——它重新生成文件并在有 diff 时失败，该 job 变绿即为端到端确认。撰写时仍在运行；表格会在 CI 结束后自动更新。macOS/Windows lane 跳过属预期平台分类行为；这些 job 本就不含 notices 检查。除上述待完成的 CI 外无未验证项——这是没有运行时行为的生成元数据文件，没有需要 /verify 或 /tmux 沙箱验证的行为声明。

— Qwen Code · qwen3.8-max

_{Reviewed at 0a54b87699fa35829bd891d2e567756a1e01aa5f · re-run with @qwen-code /triage}

[qwen-code-ci-bot]

Confidence: 5/5 — one generated line that restores a broken gate, verified byte-complete from three independent directions.

Stepping back: my independent proposal was "run the generator, commit what comes out" — and this PR is exactly that output. The only way it could be wrong is if regeneration produced more than one line, and that is excluded three ways: upstream fast-uri changed no license or notice files between the two versions, #10862's lockfile diff moved exactly one resolved URL, and #10862's own failing CI run recorded the regeneration delta as 1 file changed, 1 insertion(+), 1 deletion(-). No scope creep, no drive-bys, nothing to maintain — the file is regenerated wholesale whenever the script runs next.

This is the minimal payment on a debt #10862's merge left behind, and every other PR's merge-ref CI stays red at the notices step until it lands.

Approval is deferred until CI lands green on 0a54b87699fa35829bd891d2e567756a1e01aa5f — the decisive Test (ubuntu-latest, Node 22.x) job (the one carrying the notices check) is still running.

中文说明

回顾：我的独立方案是"跑生成器、提交产物"——本 PR 正是该产物。唯一可能的错误是重新生成产生多于一行，而这被三个方向排除：fast-uri 上游两个版本间未改动任何 license/notice 文件；#10862 的 lockfile diff 只动了一个 resolved URL；#10862 自身失败的 CI 运行记录的重生成差异恰为 1 file changed, 1 insertion(+), 1 deletion(-)。无范围蔓延、无顺手改动、无维护负担——下次运行脚本时该文件会整体重新生成。这是对 #10862 合入所留债务的最小偿还；在它合入前，其他所有 PR 的 merge-ref CI 都会红在 notices 步骤。批准推迟到 0a54b87699fa35829bd891d2e567756a1e01aa5f 上 CI 变绿——承载 notices 检查的 Test (ubuntu-latest, Node 22.x) job 仍在运行。

— Qwen Code · qwen3.8-max

_{Reviewed at 0a54b87699fa35829bd891d2e567756a1e01aa5f · re-run with @qwen-code /triage}

[yiliang114]

Closing — the same one-line NOTICES refresh already lives in #10805 (commit 2516e84), so that PR will fix main's notices check when it merges. No need for a separate PR.

[qwen-code-dev-bot]

Reviewed at head 0a54b876. A single notices line: fast-uri@3.1.5 → 3.1.7, matching the version the root lockfile actually resolves for node_modules/fast-uri at this head — the copyright/license block itself is unchanged between those releases, so the notice body stays valid. Pure metadata re-alignment, nothing to review beyond the version claim, which checks out. CI has no failures on this head (lanes still running); per the channel convention the call is on the review itself.

[chiga0]

Post-merge review (PR merged 2026-09-03T02:09:59Z)

No blocking findings.
Approval blockers: none.

Tier: Scan — single-line update to a generated NOTICES file.

Checked

• Claim vs. diff: PR says fast-uri@3.1.5 → 3.1.7; the diff confirms exactly that in packages/vscode-ide-companion/NOTICES.txt ✓
• Lockfile consistency: root package-lock.json at head resolves node_modules/fast-uri → 3.1.7 — matches the new NOTICES header ✓
• Occurrence count: fast-uri appears exactly once as a versioned header in NOTICES.txt at this head; no stale 3.1.5 reference remains ✓

Not covered: No executable code changed — runtime rungs not applicable.

Cross-check: qwen-code-dev-bot reviewed the same head (0a54b876) and reached the same clean verdict — confirmed, no discrepancy.

Reviewed with AI assistance.

[github-actions]

Code Coverage Summary

Package	Lines	Statements	Functions	Branches
CLI	N/A%	N/A%	N/A%	N/A%
Core	N/A%	N/A%	N/A%	N/A%

CLI Package - Full Text Report

CLI full-text-summary.txt not found at: coverage_artifact/cli/coverage/full-text-summary.txt

Core Package - Full Text Report

Core full-text-summary.txt not found at: coverage_artifact/core/coverage/full-text-summary.txt

For detailed HTML reports, please see the 'coverage-reports-22.x-ubuntu-latest' artifact from the main CI run.

[qwen-code-ci-bot]

Released in v0.23.0.