VS Code 1.123 Adds Two-Hour Extension Update Delay to Limit Supply Chain Attacks

Steef-Jan Wiggers — Thu, 18 Jun 2026 10:15:00 GMT

VS Code 1.123 adds a two-hour delay before auto-updating extensions to newly published versions, creating a revocation window against supply chain attacks. The delay does not apply to trusted publishers like Microsoft, GitHub, and OpenAI. Similar cooldown mechanisms have now spread across pip, RubyGems, npm, pnpm, Yarn, and Bun.

By Steef-Jan Wiggers

InfoQ - Visual Studio Code - News

VS Code 1.123 Adds Two-Hour Extension Update Delay to Limit Supply Chain Attacks