Use minReleaseAge with auto-update

[daiyam]

Hi,

Since this year attacks, it has been recommended to delay auto-updates so people can evaluate if the new update is safe or not.
Recently, Visual Studio Marketplace and OpenVSX have been used to facilitate some attacks.

So, in 1.116:

• I've added the update.minReleaseAge setting (a number in days). By default, it will delay the update by 7 days.

In 1.121:

• update.minReleaseAge has been updated to use hours and its default value is set to 120 hours (5 days)
• extensions.minReleaseAge has been added to delay the auto-update of extensions. Also in hours and its default set to 48 hours.

[JoeC-Dev]

Awesome news! I was worried about security and debating turning off auto updates but this helps me feel better about leaving these settings on.

[IGLOU-EU]

Hi, this is an interesting feature, consider to add a log to say explain why the update aren't considered yet to avoid turning around manual 😜

And thanks for codium :)

[daiyam]

Yep!