VS Code Introduces Two-Hour Hold on Extension Auto-Updates to Reduce Supply-Chain Risk
Microsoft is rolling out a short hold period for Visual Studio Code extensions: when automatic updates are enabled, newly published extension versions will not be applied immediately but instead will be deferred for two hours. The delay is intended to provide an additional safeguard against problematic or potentially hijacked releases and is included beginning with VS Code 1.123.
Developers who prefer not to wait can still force an immediate update at any time by clicking the “Update” button for an extension. For extensions that have pending updates, VS Code’s details pane will explain why the update has not yet been applied and will show the scheduled time when the automatic update will occur.
Microsoft clarified that this two-hour pause will not affect extensions from designated trusted publishers such as Microsoft, GitHub, and OpenAI; packages from those publishers will continue to be updated instantly.
The VS Code change follows recent moves in other language and package ecosystems to introduce time-based defenses.
RubyGems added an opt-in cooldown to Bundler 4.0.13 that delays the installation of newly published gem versions for a configurable period, a measure designed to shrink the window of exposure to malicious uploads.
Over the past year, similar controls have been added elsewhere:
- Bun offers minimumReleaseAge (Bun 1.3+)
- npm supports min-release-age (npm v11.10.0+)
- pnpm implements minimumReleaseAge (pnpm 10.16+)
- Yarn provides npmMinimalAgeGate (Yarn Berry 4.10.0+).
These timing-based controls have emerged in response to a rise in software supply chain attacks that target developer environments and use infected packages to reach downstream users. By enforcing a minimum age before a newly published version can be installed or automatically applied, registries and tools can reduce the span of time a malicious release has to spread before it is detected and removed by maintainers.