VSCode delayed auto-updates don't apply to "trusted" publishers like Microsoft

Microsoft released Visual Studio Code 1.123 on June 3, 2026, adding 1M-token context window support for Anthropic and OpenAI models, automatic chat session sync to GitHub accounts, a preview Agents window for running multiple agent sessions side by side, and a preview research agent that produces cited Markdown reports. The release also retries network-dependent sandboxed agent commands with unrestricted network access before falling back to unsandboxed execution. Follow-up updates 1.123.1 and 1.123.2 addressed security issues and other bugs, and VS Code said the rollout is gradual, with users able to force the update via Check for Updates.

Visual Studio Code 1.123 Follow us on LinkedIn https://www.linkedin.com/showcase/vs-code , X https://go.microsoft.com/fwlink/?LinkID=533687 , Bluesky https://bsky.app/profile/vscode.dev Release date: June 3, 2026 Update 1.123.1 : The update addresses these security issues https://github.com/microsoft/vscode/issues?q=is%3Aissue+is%3Aclosed+milestone%3A1.123.1 . Update 1.123.2 : The update addresses these issues https://github.com/microsoft/vscode/issues?q=is%3Aissue+is%3Aclosed+milestone%3A1.123.2 . Downloads for 1.123.2 Welcome to the 1.123 release of Visual Studio Code. This release improves how you work with agents and the integrated browser. - Larger context windows 1m-context-window-for-anthropic-and-openai-models : Support for 1M context windows for Anthropic and OpenAI models. - Session sync session-sync-and-chronicle : Automatically sync your chat sessions across machines and search your coding history. - Agents window agents-window-preview : Open multiple agent sessions side-by-side to compare or review work in parallel. - Research agent research-agent-preview : Run deep research on a topic and get a thorough, well-cited Markdown report. - Integrated browser updates integrated-browser : Favorite pages for quick access and more options to capture browser screenshots. Make sure to rewatch VS Code Live at Build 2026 https://aka.ms/VSCode/Livestage Happy Coding VS Code is rolling out gradually to all users. Use Check for Updates in VS Code to get the latest version immediately. To try new features as soon as possible, download the nightly Insiders build https://code.visualstudio.com/insiders , which includes the latest updates as soon as they are available. Agents Session sync and chronicle Setting : chat.sessionSync.enabled Your chat sessions now sync automatically to your GitHub account, giving you a personal, searchable history of your work across machines and workspaces. Each session captures the conversation, the files you touched, repository context repo, branch, timestamps , and any pull requests, issues, or commits referenced along the way. With the new chronicle commands /chronicle in chat, you can put that history to work: - Ask natural-language questions about past sessions - Generate standup reports - Get personalized productivity tips - Search your coding history by topic, file, or PR To enable session sync, turn on chat.sessionSync.enabled . You can view the status of session sync in the Copilot status dashboard in the VS Code Status Bar. For more details, see the Session Sync https://code.visualstudio.com/docs/agents/run/sessions/session-history and Chronicle https://code.visualstudio.com/docs/agents/run/sessions/session-history query-session-history-with-chronicle documentation. Retry network-dependent commands in the sandbox Setting : chat.agent.sandbox.retryWithAllowNetworkRequests When a terminal command that is run by a local agent requires access to domains that are not configured as allowed domains, the command is automatically retried inside the sandbox with unrestricted network access. After that, if it still fails, it falls back to unsandboxed execution. This allows network-dependent operations such as git fetch to finish, while keeping filesystem protections in place. Agents window Preview The Agents window https://aka.ms/VSCode/Agents/docs is a dedicated companion window optimized for exploring, iterating on, and reviewing agent sessions across projects and machines. This release, we focused on letting you work with multiple sessions side by side. Multiple open sessions You can now have more than one session open at the same time in the Agents window. In addition to the active session, open another session next to it by: - Selecting Open to the Side in the context menu of a session in the sessions list. - Dragging and dropping a session from the sessions list into the sessions view area. - Holding Alt and selecting a session in the sessions list. Even though multiple sessions can be visible at once, only one is the active session at any time. The Terminal , Files , and Changes views all operate on the currently active session, so switching the active session updates these views to reflect its state. By default, selecting a session in the sessions list replaces the active session view with the selected one. To keep a session view from being replaced, pin it with the pin action in the top right of the view. Pinned session views are never replaced—selecting another session opens it in an unpinned view instead. If every session view is pinned, the selected session opens to the side. Use the maximize action in the top right of a session view to expand it across all open session views, giving you a focused view of a single session without closing the others. For more details, see the Agents window documentation https://aka.ms/VSCode/Agents/docs . Research agent Preview Note : The research agent is currently in preview and available only in Copilot CLI local sessions in Insiders. When you need to understand unfamiliar code, compare approaches, or learn how a library or API works, a quick chat answer isn't always enough. The research agent runs deep research on a topic and produces a thorough, well-cited Markdown report by gathering and synthesizing information from your codebase, relevant GitHub repositories, and the web. The research agent is optimized for depth rather than speed and has read-only access, so it investigates and reports instead of changing your code. To run it, type /research followed by your topic in the chat input of a Copilot CLI local session. For more details, see Run deep research with the research agent https://code.visualstudio.com/docs/agents/agent-types/copilot-cli run-deep-research-with-the-research-agent . Language Models 1M context window for Anthropic and OpenAI models VS Code now supports 1 million token context windows for compatible Anthropic and OpenAI models. This expanded context window enables you to work with significantly larger codebases and longer conversations without losing important context. The expanded context window is available when using supported models, such as Claude Opus 4.7 and GPT-5.5. Note : Larger context windows may consume more tokens per interaction, which increases AI credits usage under usage-based billing. Integrated Browser Favorite pages We've remodeled the address bar in the integrated browser into a more versatile experience where you can not only enter URLs but also favorite pages and easily access your favorites and open tabs. To add a page to your favorites, select the star icon in the browser URL bar. When you select the URL bar, you can see your list of favorite pages and open tabs. More ways to capture screenshots Setting : workbench.browser.experimentalUserTools.enabled The previous release introduced Add Screenshot to Chat , which lets you attach a screenshot of the current browser viewport to chat as context. This is especially useful for UI-related tasks, such as debugging a layout issue. This release, we added two related features: - Add Area Screenshot to Chat : Take a screenshot of a rectangular area that you select, and add that screenshot as chat context. - Add Full Page Screenshot to Chat Experimental : Take a screenshot of the entire web page, even beyond what is shown in the current viewport, and add that screenshot as chat context. This experimental feature requires enabling the workbench.browser.experimentalUserTools.enabled setting. MCP Configure OAuth client credentials in mcp.json Some MCP servers expect you to authenticate with a specific, pre-registered OAuth client instead of relying on Dynamic Client Registration. You can now specify a client ID directly in the oauth section of an MCP server entry in mcp.json : "my-mcp-server": { "url": "https://mcp.example.com/mcp", "type": "http", "oauth": { "clientId": "your-client-id" } } When a client ID is set, VS Code uses it during the OAuth flow instead of registering a new client, so you can bring your own pre-registered client configuration. Some MCP servers also require a client secret alongside the public client ID. You can now store a client secret in VS Code's OS-backed secret storage, where it stays encrypted instead of sitting in plaintext config. When an MCP server entry in mcp.json has an oauth.clientId , a Set Client Secret CodeLens appears above it. Selecting it lets you enter the secret, which is stored securely and scoped to the server URL and client ID so two servers with the same name in different configs never collide . Once a secret is stored, the CodeLens flips to Replace Client Secret , and you can reveal, replace, or delete it at any time. Enterprise-managed MCP authentication Preview If your organization centralizes sign-in at a single identity provider like Entra, Okta, or Auth0 , you probably don't want every MCP server running its own Dynamic Client Registration against its own authorization server. This release adds a cross-app authorization XAA flow that lets you authenticate once against your enterprise IdP, and then VS Code mints a per-resource token for each MCP server on your behalf. Under the hood, VS Code exchanges your IdP identity for a resource-scoped assertion using ID-JAG https://www.ietf.org/archive/id/draft-ietf-oauth-identity-assertion-authz-grant-03.txt cross-app access , and then redeems that assertion at the MCP server's authorization server for an access token. The result is that users sign in a single time, and there's no per-server client registration to manage. Note : ID-JAG is still an emerging standard and isn't widely adopted yet, but we believe it's the future of cross-app authorization. To learn more about XAA and try it against a sample IdP, resource authorization server, and MCP server, see xaa.dev https://xaa.dev . There are two pieces to set this up: - Admins configure the IdP through the policy-managed mcp.enterpriseManagedAuth.idp setting. Because it's policy-backed, it's primarily delivered through Windows Group Policy, macOS managed preferences, or Linux /etc/vscode/policy.json , and it never syncs. - Individual MCP servers opt in to the flow by setting "enterpriseManaged": true in their oauth block in mcp.json . When that flag is present, VS Code routes the server through the XAA provider instead of the standard per-server registration path. Editor Experience Delayed extension auto-updates VS Code now applies a two-hour delay before automatically updating extensions to a newly published version. When automatic updates are enabled, new versions are auto-updated two hours after they are published, adding an extra layer of protection against problematic or potentially compromised releases. This never gets in your way, as you can still update any extension immediately at any time by using the Update button. While an update is waiting, the extension's details view explains why it hasn't updated yet and when the automatic update will happen. Note : This delay does not apply to extensions from trusted publishers such as Microsoft, GitHub, and OpenAI. These extensions continue to update immediately. Thank you Contributions to our issue tracking: - @gjsjohnmurray John Murray https://github.com/gjsjohnmurray - @RedCMD RedCMD https://github.com/RedCMD - @IllusionMH Andrii Dieiev https://github.com/IllusionMH - @albertosantini Alberto Santini https://github.com/albertosantini Contributions to vscode : - @aaronpowell Aaron Powell https://github.com/aaronpowell : Add marketplace ref support for plugin marketplaces PR 317901 https://github.com/microsoft/vscode/pull/317901 - @goingforstudying-ctrl https://github.com/goingforstudying-ctrl : fix: add white-space: nowrap to browser-emulation-toolbar-label PR 318935 https://github.com/microsoft/vscode/pull/318935 - @guomaggie https://github.com/guomaggie : Search Subagent Handle context window limit exceeded error PR 316529 https://github.com/microsoft/vscode/pull/316529 - @maruthang Maruthan G https://github.com/maruthang : fix: combine URI flags to prevent Electron argument filtering on Windows PR 308150 https://github.com/microsoft/vscode/pull/308150 - @oded-ist Oded S https://github.com/oded-ist : Fix read cell output incorrectly reporting all outputs as too large PR 318148 https://github.com/microsoft/vscode/pull/318148 - @PenguinDOOM Penguin https://github.com/PenguinDOOM : Fix BYOK invalid stateful marker retries PR 317292 https://github.com/microsoft/vscode/pull/317292 - @rebornix Peng Lyu https://github.com/rebornix : Add mobile multi-diff view PR 318081 https://github.com/microsoft/vscode/pull/318081 - @SimonSiefke Simon Siefke https://github.com/SimonSiefke - fix: memory leak extension actions PR 315054 https://github.com/microsoft/vscode/pull/315054 - fix: memory leak in ipc.electron.ts PR 317846 https://github.com/microsoft/vscode/pull/317846 - fix: memory leak in search results PR 282309 https://github.com/microsoft/vscode/pull/282309 - fix: memory leak extension actions - @SLdragon rentu https://github.com/SLdragon : feat: add languageDiagnosticsService option for nes/inline completion provider PR 317678 https://github.com/microsoft/vscode/pull/317678 - @Tyriar Daniel Imms https://github.com/Tyriar : fix: remove awaits inside Promise.race in shell integration test PR 319068 https://github.com/microsoft/vscode/pull/319068 We really appreciate people trying our new features as soon as they are ready, so check back here often and learn what's new. If you'd like to read release notes for previous VS Code versions, go to Updates https://code.visualstudio.com/updates on code.visualstudio.com https://code.visualstudio.com .