[FEATURE] Minimum release age for plugin updates (renewal of #55665)

Preflight Checklist

• [x] I have searched existing requests. This renews #55665, which was closed due to inactivity; I did not find an open request for the same feature. The closing and locking bot comments explicitly ask users to file a new issue and reference the original if it is still relevant.
• [x] This is a single feature request (not multiple features).

Problem Statement

I want to keep marketplace plugin updates enabled while avoiding releases published less than a configurable number of days ago, similar to npm's min-release-age.

Plugins can include hooks, MCP servers, and shell scripts. A compromised plugin update can therefore introduce executable code into the next session. A waiting period gives maintainers and the community time to detect and remove malicious releases before they reach users who opted into the delay. It reduces exposure; it does not guarantee that a release is safe.

Claude Code already supports marketplace auto-update controls, but I could not find a documented minimum-release-age setting. Disabling updates or pinning revisions requires manual maintenance instead of allowing automatic updates with a cooldown.

The original request, #55665, describes this need well. It was closed for inactivity on June 1, 2026, rather than with a substantive decision on the proposal. This request carries that proposal forward now that plugin auto-update is available.

Proposed Solution

Add an optional minReleaseAge policy for marketplace plugins, configurable globally and overrideable per marketplace. For example, minReleaseAge: "7d" would skip releases younger than seven days. This is a proposed setting, not an existing configuration field.

Expected behavior:

• Apply the age policy before installing or updating plugin contents, including through background auto-update.
• Keep the installed version when no eligible update exists.
• Show when an update is deferred and when it becomes eligible.
• Allow an explicit user override for an urgent update.
• Preserve current behavior when the policy is unset or zero.

Please define age using a trustworthy publication timestamp where available. For Git-backed sources, commit/tag dates alone can be backdated; a recorded first-seen timestamp for an immutable revision would avoid treating a newly published, backdated commit as mature. Pinning should cover the actual plugin source revision, not just a catalog that points to a moving branch.

Alternative Solutions

• Disable auto-update and review updates manually. This works, but loses automatic maintenance and relies on remembering to check each release's age.
• Pin immutable plugin revisions and advance them manually. This freezes downloaded contents but does not provide an automatic waiting period.
• Use a private marketplace mirror that promotes revisions after a delay. This adds infrastructure for a policy that would be useful directly in the client.

Priority

High - Significant impact on productivity

I consider this a security-critical control, rather than a convenience feature. As people use coding agents for more work and connect them to more repositories, credentials, and services, a compromised plugin can affect a much larger part of their environment, within the permissions granted to the process.

Targeted spear phishing against a plugin maintainer could turn a trusted marketplace update into a supply-chain attack. Automatic updates can distribute that revision before users have time to assess it. Users should be able to keep updates enabled without immediately accepting newly published executable content.

Please prioritize this proactively, before a serious incident forces the issue. A minimum release age is one layer of defense, alongside permission boundaries, source pinning, and revocation of known-malicious releases. It cannot guarantee detection, and urgent security fixes should remain available through an explicit override.

Feature Category

Configuration and settings

Use Case Example

1. I enable automatic updates for a third-party marketplace and set a seven-day minimum release age.
2. A maintainer account is compromised and publishes a malicious plugin revision.
3. Claude Code detects the update but retains my installed version because the new revision is too young.
4. If the malicious revision is withdrawn or blocked during that window, it never gets installed on my machine.
5. Legitimate updates remain automatic once they satisfy the age policy.

This policy covers downloaded plugin artifacts. It cannot freeze the implementation of a remotely hosted MCP service.

Additional Context

• Original request: #55665.
• Bot closing comment asking for a new issue if still relevant.
• Bot locking comment asking users to reference the original in a new issue.
• Current plugin auto-update documentation.
• npm minimum-release-age configuration.
• Comparable open Codex request: https://github.com/openai/codex/issues/23478.