VS Code Adds 2-Hour Extension Auto-Update Delay to Limit Supply Chain Attacks
Microsoft is adding a two-hour auto-update delay for VS Code extensions to reduce the risk of compromised releases spreading.
Intelligence analysis by GPT-5.4 Mini
VS Code 1.123 will wait two hours before auto-updating extensions, giving Microsoft a buffer against bad releases. Users can still update manually, and trusted publishers like Microsoft, GitHub, and OpenAI are exempt.
VS Code will wait two hours before installing most add-on updates by itself. It is like leaving a package on the porch for a little while so someone can check it before bringing it inside.
Analysis
What changed
Microsoft says Visual Studio Code will now wait two hours before automatically updating extensions when automatic updates are enabled. The feature starts with VS Code 1.123. Users can still click the Update button to install any extension immediately, and the details view will show why an update has not happened yet and when it will run.
Who is exempt
The delay does not apply to extensions from trusted publishers such as Microsoft, GitHub, and OpenAI. Those extensions will continue to update immediately. That exception shows the feature is meant to slow suspicious or potentially risky releases without interfering with publishers the platform already treats as trusted.
Why the article links this to supply-chain defense
The piece frames the change as part of a wider response to software supply-chain attacks. It notes that RubyGems recently added an opt-in cooldown in Bundler 4.0.13, and that similar controls have also appeared in Bun, npm, pnpm, and Yarn. The common idea is to create a minimum age before a new version reaches users, giving maintainers time to spot and remove malicious releases.
The security value is in reducing the time window between publication and widespread installation. If a bad package or extension is discovered quickly, a delay can prevent immediate automatic spread to developer machines and downstream users.
This is a practical control, but it is not a complete defense. The article makes clear that manual updates can bypass the wait, and the delay only slows propagation rather than blocking it outright. Still, it adds friction at exactly the point where fast-moving supply-chain attacks try to take advantage of automatic installation paths.
Key points
- VS Code 1.123 adds a two-hour delay before automatic extension updates.
- Users can still install updates immediately through the Update button.
- Extensions from trusted publishers such as Microsoft, GitHub, and OpenAI are not delayed.
- The change is part of a broader trend toward time-based supply-chain defenses in package managers.
- The goal is to reduce the window in which a malicious release can spread.
If the delay catches a bad release early, it can slow how fast that release reaches developers' machines. The article also suggests this fits a broader pattern of safer update controls across developer tools.
The delay does not stop harmful releases on its own, and users can still update immediately if they choose. Trusted publishers are exempt, so the protection is not universal.
