VS Code now implements a two-hour automatic update delay for extensions to limit the impact of supply chain attacks. When automatic updates are enabled, new extension versions are installed two hours after publication, except for extensions from trusted publishers which update immediately. This delay provides a buffer period to identify and mitigate potentially malicious or faulty extension releases. Users can manually trigger immediate updates if needed. This approach follows similar measures introduced by other package managers like RubyGems, npm, pnpm, and Yarn to reduce the window of exposure to malicious package versions. The feature is included starting in VS Code 1.123.

The two-hour delay reduces the risk of rapidly propagating malicious or compromised extension updates by providing a short buffer period for detection and response. It limits the window during which a supply chain attack could affect users via automatic extension updates. Trusted publishers are exempt from this delay, ensuring timely updates for widely trusted extensions. There are no known exploits in the wild related to this change, and users can still manually update extensions immediately if necessary.

This feature is an official mitigation introduced by Microsoft in VS Code version 1.123. Users should update to this version or later to benefit from the automatic update delay. No additional user action is required to enable the delay if automatic updates are enabled. Users can manually update extensions at any time if immediate updates are needed. Since this is a proactive protective measure, no urgent remediation is necessary beyond updating VS Code to the supported version.