{"slug": "vscode-delayed-auto-updates-don-t-apply-to-trusted-publishers-like-microsoft", "title": "VSCode delayed auto-updates don't apply to \"trusted\" publishers like Microsoft", "summary": "Microsoft released Visual Studio Code 1.123 on June 3, 2026, adding 1M-token context window support for Anthropic and OpenAI models, automatic chat session sync to GitHub accounts, a preview Agents window for running multiple agent sessions side by side, and a preview research agent that produces cited Markdown reports. The release also retries network-dependent sandboxed agent commands with unrestricted network access before falling back to unsandboxed execution. Follow-up updates 1.123.1 and 1.123.2 addressed security issues and other bugs, and VS Code said the rollout is gradual, with users able to force the update via Check for Updates.", "body_md": "# Visual Studio Code 1.123\n\nFollow us on [LinkedIn](https://www.linkedin.com/showcase/vs-code), [X](https://go.microsoft.com/fwlink/?LinkID=533687), [Bluesky](https://bsky.app/profile/vscode.dev)\n\n*Release date: June 3, 2026*\n\n**Update 1.123.1**: The update addresses these [security issues](https://github.com/microsoft/vscode/issues?q=is%3Aissue+is%3Aclosed+milestone%3A1.123.1).\n\n**Update 1.123.2**: The update addresses these [issues](https://github.com/microsoft/vscode/issues?q=is%3Aissue+is%3Aclosed+milestone%3A1.123.2).\n\n## ## Downloads for 1.123.2\n\nWelcome to the 1.123 release of Visual Studio Code. This release improves how you work with agents and the integrated browser.\n\n- [Larger context windows](#_1m-context-window-for-anthropic-and-openai-models) : Support for 1M context windows for Anthropic and OpenAI models.\n- [Session sync](#_session-sync-and-chronicle) : Automatically sync your chat sessions across machines and search your coding history.\n- [Agents window](#_agents-window-preview) : Open multiple agent sessions side-by-side to compare or review work in parallel.\n- [Research agent](#_research-agent-preview) : Run deep research on a topic and get a thorough, well-cited Markdown report.\n- [Integrated browser updates](#_integrated-browser) : Favorite pages for quick access and more options to capture browser screenshots.\n\nMake sure to rewatch [VS Code Live at Build 2026](https://aka.ms/VSCode/Livestage)!\n\nHappy Coding!\n\nVS Code is rolling out gradually to all users. Use **Check for Updates** in VS Code to get the latest version immediately.\n\nTo try new features as soon as possible, [**download the nightly Insiders build**](https://code.visualstudio.com/insiders), which includes the latest updates as soon as they are available.\n\n## Agents\n\n### Session sync and chronicle\n\n**Setting**: \n      chat.sessionSync.enabled\n      \n\nYour chat sessions now sync automatically to your GitHub account, giving you a personal, searchable history of your work across machines and workspaces.\n\nEach session captures the conversation, the files you touched, repository context (repo, branch, timestamps), and any pull requests, issues, or commits referenced along the way.\n\nWith the new chronicle commands (`/chronicle`) in chat, you can put that history to work:\n\n- Ask natural-language questions about past sessions\n- Generate standup reports\n- Get personalized productivity tips\n- Search your coding history by topic, file, or PR\n\nTo enable session sync, turn on chat.sessionSync.enabled . You can view the status of session sync in the Copilot status dashboard in the VS Code Status Bar.\n\nFor more details, see the [Session Sync](https://code.visualstudio.com/docs/agents/run/sessions/session-history) and [Chronicle](https://code.visualstudio.com/docs/agents/run/sessions/session-history#_query-session-history-with-chronicle) documentation.\n\n### Retry network-dependent commands in the sandbox\n\n**Setting**: \n      chat.agent.sandbox.retryWithAllowNetworkRequests\n      \n    \n\nWhen a terminal command that is run by a *local* agent requires access to domains that are not configured as allowed domains, the command is automatically retried inside the sandbox with unrestricted network access. After that, if it still fails, it falls back to unsandboxed execution. This allows network-dependent operations such as `git fetch` to finish, while keeping filesystem protections in place.\n\n### Agents window (Preview)\n\nThe [Agents window](https://aka.ms/VSCode/Agents/docs) is a dedicated companion window optimized for exploring, iterating on, and reviewing agent sessions across projects and machines. This release, we focused on letting you work with multiple sessions side by side.\n\n#### Multiple open sessions\n\nYou can now have more than one session open at the same time in the Agents window. In addition to the active session, open another session next to it by:\n\n- Selecting **Open to the Side** in the context menu of a session in the sessions list.\n- Dragging and dropping a session from the sessions list into the sessions view area.\n- Holding Alt and selecting a session in the sessions list.\n\nEven though multiple sessions can be visible at once, only one is the active session at any time. The **Terminal**, **Files**, and **Changes** views all operate on the currently active session, so switching the active session updates these views to reflect its state.\n\nBy default, selecting a session in the sessions list replaces the active session view with the selected one. To keep a session view from being replaced, pin it with the pin action in the top right of the view. Pinned session views are never replaced—selecting another session opens it in an unpinned view instead. If every session view is pinned, the selected session opens to the side.\n\nUse the maximize action in the top right of a session view to expand it across all open session views, giving you a focused view of a single session without closing the others.\n\nFor more details, see the [Agents window documentation](https://aka.ms/VSCode/Agents/docs).\n\n### Research agent (Preview)\n\n**Note**: The research agent is currently in preview and available only in Copilot CLI (local) sessions in Insiders.\n\nWhen you need to understand unfamiliar code, compare approaches, or learn how a library or API works, a quick chat answer isn't always enough. The research agent runs deep research on a topic and produces a thorough, well-cited Markdown report by gathering and synthesizing information from your codebase, relevant GitHub repositories, and the web.\n\nThe research agent is optimized for depth rather than speed and has read-only access, so it investigates and reports instead of changing your code. To run it, type `/research` followed by your topic in the chat input of a Copilot CLI (local) session.\n\nFor more details, see [Run deep research with the research agent](https://code.visualstudio.com/docs/agents/agent-types/copilot-cli#run-deep-research-with-the-research-agent).\n\n## Language Models\n\n### 1M context window for Anthropic and OpenAI models\n\nVS Code now supports 1 million token context windows for compatible Anthropic and OpenAI models. This expanded context window enables you to work with significantly larger codebases and longer conversations without losing important context. The expanded context window is available when using supported models, such as Claude Opus 4.7 and GPT-5.5.\n\n**Note**: Larger context windows may consume more tokens per interaction, which increases AI credits usage under usage-based billing.\n\n## Integrated Browser\n\n### Favorite pages\n\nWe've remodeled the address bar in the integrated browser into a more versatile experience where you can not only enter URLs but also favorite pages and easily access your favorites and open tabs.\n\nTo add a page to your favorites, select the star icon in the browser URL bar.\n\nWhen you select the URL bar, you can see your list of favorite pages and open tabs.\n\n### More ways to capture screenshots\n\n**Setting**: \n      workbench.browser.experimentalUserTools.enabled\n      \n    \n\nThe previous release introduced **Add Screenshot to Chat**, which lets you attach a screenshot of the current browser viewport to chat as context. This is especially useful for UI-related tasks, such as debugging a layout issue.\n\nThis release, we added two related features:\n\n- **Add Area Screenshot to Chat** : Take a screenshot of a rectangular area that you select, and add that screenshot as chat context.\n- **Add Full Page Screenshot to Chat (Experimental)** : Take a screenshot of the entire web page, even beyond what is shown in the current viewport, and add that screenshot as chat context. This experimental feature requires enabling the \n      workbench.browser.experimentalUserTools.enabled\n      \n    \n setting.\n\n## MCP\n\n### Configure OAuth client credentials in mcp.json\n\nSome MCP servers expect you to authenticate with a specific, pre-registered OAuth client instead of relying on Dynamic Client Registration. You can now specify a client ID directly in the `oauth` section of an MCP server entry in `mcp.json`:\n\n```\n\"my-mcp-server\": {\n  \"url\": \"https://mcp.example.com/mcp\",\n  \"type\": \"http\",\n  \"oauth\": {\n    \"clientId\": \"your-client-id\"\n  }\n}\n```\n\nWhen a client ID is set, VS Code uses it during the OAuth flow instead of registering a new client, so you can bring your own pre-registered client configuration.\n\nSome MCP servers also require a client secret alongside the public client ID. You can now store a client secret in VS Code's OS-backed secret storage, where it stays encrypted instead of sitting in plaintext config.\n\nWhen an MCP server entry in `mcp.json` has an `oauth.clientId`, a **Set Client Secret** CodeLens appears above it. Selecting it lets you enter the secret, which is stored securely and scoped to the server URL and client ID (so two servers with the same name in different configs never collide). Once a secret is stored, the CodeLens flips to **Replace Client Secret**, and you can reveal, replace, or delete it at any time.\n\n### Enterprise-managed MCP authentication (Preview)\n\nIf your organization centralizes sign-in at a single identity provider (like Entra, Okta, or Auth0), you probably don't want every MCP server running its own Dynamic Client Registration against its own authorization server. This release adds a cross-app authorization (XAA) flow that lets you authenticate once against your enterprise IdP, and then VS Code mints a per-resource token for each MCP server on your behalf.\n\nUnder the hood, VS Code exchanges your IdP identity for a resource-scoped assertion using [ID-JAG](https://www.ietf.org/archive/id/draft-ietf-oauth-identity-assertion-authz-grant-03.txt) (cross-app access), and then redeems that assertion at the MCP server's authorization server for an access token. The result is that users sign in a single time, and there's no per-server client registration to manage.\n\n**Note**: ID-JAG is still an emerging standard and isn't widely adopted yet, but we believe it's the future of cross-app authorization. To learn more about XAA and try it against a sample IdP, resource authorization server, and MCP server, see [xaa.dev](https://xaa.dev).\n\nThere are two pieces to set this up:\n\n- Admins configure the IdP through the policy-managed `mcp.enterpriseManagedAuth.idp` setting. Because it's policy-backed, it's primarily delivered through Windows Group Policy, macOS managed preferences, or Linux`/etc/vscode/policy.json` , and it never syncs.\n- Individual MCP servers opt in to the flow by setting `\"enterpriseManaged\": true` in their`oauth` block in`mcp.json` . When that flag is present, VS Code routes the server through the XAA provider instead of the standard per-server registration path.\n\n## Editor Experience\n\n### Delayed extension auto-updates\n\nVS Code now applies a two-hour delay before automatically updating extensions to a newly published version. When automatic updates are enabled, new versions are auto-updated two hours after they are published, adding an extra layer of protection against problematic or potentially compromised releases.\n\nThis never gets in your way, as you can still update any extension immediately at any time by using the **Update** button. While an update is waiting, the extension's details view explains why it hasn't updated yet and when the automatic update will happen.\n\n**Note**: This delay does not apply to extensions from trusted publishers such as Microsoft, GitHub, and OpenAI. These extensions continue to update immediately.\n\n## Thank you\n\nContributions to our issue tracking:\n\n- [@gjsjohnmurray (John Murray)](https://github.com/gjsjohnmurray)\n- [@RedCMD (RedCMD)](https://github.com/RedCMD)\n- [@IllusionMH (Andrii Dieiev)](https://github.com/IllusionMH)\n- [@albertosantini (Alberto Santini)](https://github.com/albertosantini)\n\nContributions to `vscode`:\n\n- [@aaronpowell (Aaron Powell)](https://github.com/aaronpowell) : Add marketplace ref support for plugin marketplaces[PR #317901](https://github.com/microsoft/vscode/pull/317901)\n- [@goingforstudying-ctrl](https://github.com/goingforstudying-ctrl) : fix: add white-space: nowrap to browser-emulation-toolbar-label[PR #318935](https://github.com/microsoft/vscode/pull/318935)\n- [@guomaggie](https://github.com/guomaggie) : [Search Subagent] Handle context window limit exceeded error[PR #316529](https://github.com/microsoft/vscode/pull/316529)\n- [@maruthang (Maruthan G)](https://github.com/maruthang) : fix: combine URI flags to prevent Electron argument filtering on Windows[PR #308150](https://github.com/microsoft/vscode/pull/308150)\n- [@oded-ist (Oded S)](https://github.com/oded-ist) : Fix read_cell_output incorrectly reporting all outputs as too large[PR #318148](https://github.com/microsoft/vscode/pull/318148)\n- [@PenguinDOOM (Penguin)](https://github.com/PenguinDOOM) : Fix BYOK invalid stateful marker retries[PR #317292](https://github.com/microsoft/vscode/pull/317292)\n- [@rebornix (Peng Lyu)](https://github.com/rebornix) : Add mobile multi-diff view[PR #318081](https://github.com/microsoft/vscode/pull/318081)\n- [@SimonSiefke (Simon Siefke)](https://github.com/SimonSiefke)  - fix: memory leak extension actions [PR #315054](https://github.com/microsoft/vscode/pull/315054)\n  - fix: memory leak in ipc.electron.ts [PR #317846](https://github.com/microsoft/vscode/pull/317846)\n  - fix: memory leak in search results [PR #282309](https://github.com/microsoft/vscode/pull/282309)\n- fix: memory leak extension actions \n- [@SLdragon (rentu)](https://github.com/SLdragon) : feat: add languageDiagnosticsService option for nes/inline completion provider[PR #317678](https://github.com/microsoft/vscode/pull/317678)\n- [@Tyriar (Daniel Imms)](https://github.com/Tyriar) : fix: remove awaits inside Promise.race in shell integration test[PR #319068](https://github.com/microsoft/vscode/pull/319068)\n\nWe really appreciate people trying our new features as soon as they are ready, so check back here often and learn what's new.\n\nIf you'd like to read release notes for previous VS Code versions, go to [Updates](https://code.visualstudio.com/updates) on [code.visualstudio.com](https://code.visualstudio.com).", "url": "https://wpnews.pro/news/vscode-delayed-auto-updates-don-t-apply-to-trusted-publishers-like-microsoft", "canonical_source": "https://code.visualstudio.com/updates/v1_123#_delayed-extension-auto-updates:~:text=Note%3A%20This%20delay%20does%20not%20apply%20to%20extensions%20from%20trusted%20publishers%20such%20as%20Microsoft%2C%20GitHub%2C%20and%20OpenAI%2E%20These%20extensions%20continue%20to%20update%20immediately", "published_at": "2026-10-30 14:09:59+00:00", "updated_at": "2026-10-30 14:16:58.991330+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "developer-tools", "large-language-models", "ai-products"], "entities": ["Visual Studio Code", "Microsoft", "Anthropic", "OpenAI", "GitHub", "Copilot"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/vscode-delayed-auto-updates-don-t-apply-to-trusted-publishers-like-microsoft", "markdown": "https://wpnews.pro/news/vscode-delayed-auto-updates-don-t-apply-to-trusted-publishers-like-microsoft.md", "text": "https://wpnews.pro/news/vscode-delayed-auto-updates-don-t-apply-to-trusted-publishers-like-microsoft.txt", "jsonld": "https://wpnews.pro/news/vscode-delayed-auto-updates-don-t-apply-to-trusted-publishers-like-microsoft.jsonld"}}