VS Code Adds 2-Hour Extension Auto-Update Delay to Limit Supply Chain Attacks

Microsoft introduces a two-hour automatic update delay for VS Code extensions to mitigate supply chain attack risks.

• •Starting with VS Code 1.123, new extension versions are automatically updated two hours after publication
• •Users can still immediately update extensions using the Update button at any time
• •Extensions from trusted publishers like Microsoft, GitHub, and OpenAI bypass the delay and update immediately
• •Similar installation delay controls have been added to Bun, pnpm, npm, and Yarn package managers
• •The delay minimizes the window for malicious versions to spread before being flagged and removed by registry maintainers

This summary was automatically generated by AI based on the original article and may not be fully accurate.