Feature request for product/service
3rd Party Extensions
Describe the request
Problem
With the rise of AI, fresh software updates have become a frequent source of vulnerabilities. This makes auto-updating extensions too early potentially dangerous for the mass of users.
Turning auto-update off entirely via extensions.autoUpdate is too drastic: that option does not meet the need for safe extension updates.
The trigger for this topic was the recent attack on the Claude Code extension (2.1.313), but it is only one instance of a global trend. New software needs time to stabilize and for vulnerabilities to surface, and it is better if it is rolled out first to the machines of experienced users who knowingly accept the risk.
Proposal
Introduce a setting that defers the automatic installation of a version until a given amount of time has passed since its publication:
"extensions.autoUpdateMinReleaseAge": "3d"
- Auto-update installs only versions older than the threshold; newer ones wait and are installed automatically once they cross it.
- Manual update and install from the Extensions view are not affected.
It may also be worth setting the default to at least one day. Experienced users can override it manually, accepting the risk knowingly.
A per-extension override may also be worth adding, so that critical tools can stay on the fast path.
Prior art
Package managers introduced exactly this mechanism after the same kind of attacks: minimumReleaseAge in pnpm and Bun, min-release-age in npm. The reason was a surge of similar attacks through software updates across different registries.
Operating System (if it applies)
MacOS