VS Code adds two‑hour extension auto‑update delay to curb supply‑chain attacks
Microsoft’s VS Code 1.123 release introduces a built‑in two‑hour delay before extensions are auto‑updated when automatic updates are enabled. The pause gives developers time to detect malicious or broken releases, reducing the risk of software supply‑chain attacks.