VS Code adds 2‑hour auto‑update pause to curb extension supply‑chain attacks
VS Code 1.123 inserts a two‑hour pause before auto‑installing newly published extension versions. The window gives developers and administrators time to spot malicious updates, limiting supply‑chain attacks, while trusted publishers like Microsoft and GitHub remain exempt.