VS Code delays automatic extension updates by two hours

Microsoft will make Visual Studio Code wait two hours before automatically installing newly published extension versions when automatic updates are enabled. The feature is available in VS Code 1.123.

When a publisher releases a new version, the editor will install it automatically two hours after publication. Users who want an update immediately can click the Update button in the extensions view to install the new version at once.

If an extension has a pending update, the extension details page shows the reason the update has not yet been applied and the scheduled time for the automatic update.

The two-hour delay does not apply to extensions from trusted publishers such as Microsoft, GitHub and OpenAI; those extensions continue to update immediately.

“When automatic updates are enabled, new versions are auto-updated two hours after they are published, adding an extra layer of protection against problematic or potentially compromised releases,” Microsoft wrote.

The company said the setting gives a short interval during which issues can be detected and addressed before a release reaches many users, while preserving the option for manual updates at any time.

Similar timing controls have been added in other developer ecosystems. RubyGems introduced an opt-in cooldown in Bundler 4.0.13 to delay installation of newly published gems. Bun added minimumReleaseAge in 1.3 and later. npm introduced min-release-age in v11.10.0, pnpm added minimumReleaseAge in 10.16, and Yarn Berry provides npmMinimalAgeGate in 4.10.0 and later.

Registry maintainers and tool authors have said these controls reduce the window in which a newly published malicious package can spread before it is discovered and removed. Over the past year, maintainers reported increased incidents that used package distribution to deliver malware and breach developer systems; those reports prompted registries and tool authors to add timing safeguards.

Developers who depend on immediate patches from the named trusted publishers will not see a delay. Other extension users can either wait the short interval or install updates manually at any time.