Adding VS Code extensions.autoUpdateDelay (minimumReleaseAge)

Ideas Feature Requests
,
1

Feature request for product/service

Cursor IDE

Describe the request

VS Code has finally after years of begging added a extensions.autoUpdateDelay setting for auto updating VS Code extensions with a delay after they are live, so malicious extension versions can get removed from the marketplace before the auto update installs them. This is similar to settings like minimumReleaseAge from PNPM and other package managers.

This addresses the ever increasing rate of supply chain attacks, though those mainly appear in the NPM and PyPI ecosystems, they are also very present in extension ecosystems in VS Code based IDEs, which includes Cursor.

Can we please also get this setting into Cursor? It was added to VS Code in version 1.125 on June 17th 2026.

Official release notes: Visual Studio Code 1.125
PR merging changes: extensions: migrate auto update setting to on/off values by sandy081 · Pull Request #321039 · microsoft/vscode · GitHub

There is also an open issue for a similar setting for extension installs and not only extension auto updates, but that will take time and it would be great to add the extensions.autoUpdateDelay to Cursor in the meantime to minimize the likelihood of users getting hacked.

5

Hey @jsimecek

This is already possible, both at a team and individual level.

Team admins can defer extension installs and updates until a marketplace version has been published for a minimum number of hours. This gives a buffer against short-lived malicious uploads.

  • Where to configure: Team settings → Security & automation → Marketplace Install Cooldown (hours)

…

Individual users can also set extensions.installCooldownHours in their own settings when the team has not enforced a cooldown.

7

Oh cool, I was not aware of that. Thank you :heart_hands:.