
VS Code 1.123, shipped June 3, delays auto-updates for new extension versions by two hours to limit supply chain attacks. Users can manually update anytime. The delay does not apply to trusted publishers like Microsoft, GitHub, and OpenAI. The two-hour window is shorter than cooldowns in other package ecosystems.
Tap to vote and see what everyone thinks.
Summary by ByteBrief
Splunk, Palo Alto Networks Patch Severe Vulnerabilities