Pin AI Coding Assistant Versions and Disable Auto-Update: A Complete Guide

1. Why Pin to a Stable Version

AI coding assistants — both IDE extensions and command-line clients — are typically in a fast release cycle, often shipping weekly or even daily. Feature changes, prompt strategy adjustments, and model routing changes usually go out with the version itself. Three risks follow from this pace:

1. Regressions: a new release may misbehave in a specific completion or chat scenario, and such problems often surface only in real usage.
2. Behavior drift: the same code and the same instruction can produce different output across versions, leading to “it worked yesterday, it fails today” inside a team.
3. Non-reproducibility: CI/CD pipelines and automation scripts depend on predictable tool behavior, so a silent upgrade can change build results.

Pinning to a version that has already been validated (semantic version format MAJOR.MINOR.PATCH) is a key step toward reproducibility. Be clear about the cost, though: pinning means you no longer automatically receive new features from later releases — and you also no longer automatically receive their bug fixes or security patches. Pinning is therefore not the finish line; it needs to be paired with periodic evaluation and a staged upgrade process.

Note: the package names, version numbers, and environment variable names in the commands below are examples. Always check the official documentation and release notes of the tool you actually use.

2. Prerequisites: Endpoint, Token, and Least-Privilege Configuration

Before any installation method, the tool must be able to reach the backend model service. Three preparatory steps:

Step 1: Obtain the endpoint and token. Request a service endpoint URL and an authentication token from the console or the operations channel of the model service you use. This article uses AI_SERVICE_BASE_URL and AI_SERVICE_API_KEY as example variable names — do not copy them blindly; follow the official documentation.

Step 2: Scope the token to least privilege. Prefer a dedicated read-only or restricted-permission token that grants only the model call scope this tool needs; avoid high-privilege keys that also carry account management, billing, or data export rights. Also define the rotation method: set an expiry and rotation period for the token, and keep a short overlap window with the old token so the replacement can be staged.

Step 3: Inject through environment variables.

Windows (GUI): right-click “This PC” → Properties → Advanced system settings → Environment Variables, create two variables under User variables, then reopen the terminal for them to take effect.

AI_SERVICE_BASE_URL = https://<your-model-service-endpoint>
AI_SERVICE_API_KEY  = <your-auth-token>

macOS / Linux: add the exports to your shell configuration file and reload it.

export AI_SERVICE_BASE_URL="https://<your-model-service-endpoint>"
export AI_SERVICE_API_KEY="<your-auth-token>"
source ~/.zshrc

Key points for secret handling:

• Keep tokens only in a secret management service, CI encrypted variables, or secure local configuration. Never commit them to a repository, a document, or a log.
• Logs and crash reports may include command-line arguments or environment snapshots, so redact on the collection side to prevent tokens from leaking out with error reports.
• Enterprises can point the endpoint at a self-hosted deployment or a model service from a compliant cloud platform, keeping the data boundary and access control in their own hands.

3. Method 1: Install a Specific IDE Plugin Version and Disable Auto-Update

Step 1 (optional): Uninstall the old version. Most editors can roll back by directly “installing another version,” so uninstalling is usually unnecessary. If you do need to uninstall, note that it may wipe the plugin’s local configuration, cache, or login state — back up your settings files first.

Step 2: Disable auto-update. This step is critical, otherwise the editor may silently upgrade the freshly installed version back to the latest one.

• VS Code family: search for extensions.autoUpdate in Settings and turn it off, or set it to manual updates only. This setting belongs to VS Code-based editors and does not apply to others.
• JetBrains family: disable auto-update for the specific plugin under Settings → Plugins (or disable plugin auto-update globally), and install a specific version manually from the plugin management UI.
• Other editors: look for an “auto-update” toggle on the plugin management page, or distribute an offline installation package instead.

Step 3: Install another version. Search for the tool in the extension marketplace, confirm the publisher is the official account, click the dropdown arrow next to the Install button, choose Install Another Version, and pick a validated stable release (for example 2.1.90).

Step 4: Verify the version actually in effect. After installation, confirm the effective version using the version number on the extension detail page, or <command> --version on the CLI side, to make sure it was not upgraded again. The auto-update toggle alone is not sufficient proof — add this check to your routine verification checklist.

4. Method 2: Lock the CLI Client Version (Four Steps)

The core idea for the command-line case: let the package manager and lock files declare the version, rather than relying on human memory.

Step 1: Install the specified version. Use the syntax that matches the distribution channel:

# npm-distributed CLI: install a specific version globally
npm install -g <package-name>@<version>
# Python ecosystem: install in an isolated environment with a pinned version (recommended)
pipx install <package-name>==<version>
# Install as a project dependency (recommended for teams and CI)
npm install --save-dev <package-name>@<version>

Step 2: Verify with --version. After installation, run <command> --version in the terminal, confirm the output matches the expected version, and only then continue.

Step 3: Commit the version to the project. The recommended approach is to include the CLI in the project’s devDependencies and let the lock file (for example package-lock.json) pin the installed version. On the Python side, use pinned version declarations in requirements.txt / pyproject.toml together with hash verification. For containerized setups, pin an image tag instead of using latest:

npx <package-name>@<version> <subcommand>   # one-off invocation without install; version determined by the argument
docker run --rm <registry>/<image>:<version> <subcommand>

This keeps installed versions consistent across the team and CI, which improves reproducibility. Note that a globally installed (-g) version is not governed by the project lock file, so it is not suitable as a team-wide baseline and should only be used for local evaluation.

Step 4: Assert in CI. Add a version assertion as the first pipeline step and fail the build if the version does not match:

<command> --version | grep -q '<expected-version>' || { echo "Tool version mismatch"; exit 1; }

IDE Plugin vs. CLI Client

Dimension	IDE plugin	CLI client
Typical users	Interactive coding, day-to-day completion and chat	Scripts, batch jobs, CI automation
How to pin	“Install Another Version” in the extension panel	Package manager version specifier, image tag
Team enforcement	Shared settings.json plus a baseline version policy	devDependencies + lock file / pinned image
Version verification	Version number on the extension detail page	<command> --version
Offline / intranet feasibility	Download offline packages (such as .vsix) in advance and distribute on the intranet	Private registry, internal npm/PyPI mirror

5. Disabling Telemetry

By default, the tool may report telemetry such as usage statistics. If your organization has data compliance requirements, or you need to run in an isolated or offline environment, consider turning it off. Example variable (the name is an example only — check the tool’s official documentation, or copying it will have no effect):

export AI_SERVICE_DISABLE_TELEMETRY=true

On Windows, persist it with setx, or add a variable of the same name in the system environment variables and reopen the terminal for it to take effect:

setx AI_SERVICE_DISABLE_TELEMETRY true

Be aware of the side effects: disabling telemetry may also stop error reporting, crash diagnostics, and the usage statistics the vendor needs to improve the service, which can slow down local troubleshooting and vendor-side support responses. Confirm the approach with your compliance and IT teams and keep a record before turning it off. In enterprise environments, control this at the network egress layer as well (egress proxy, domain allowlist) to reduce unintended outbound traffic.

6. Team-Level Version Management Best Practices

• Version baseline: record the “validated stable version number” in the team’s standards as a shared baseline, with its scope of effect and owner noted.
• Gradual upgrades: validate thoroughly in a test environment first, then roll out in stages instead of replacing everything at once.
• Dependency pinning: keep CLI versions in lock files or container images so the versions in a build input are traceable.
• Monitoring and alerting: use logging and monitoring to watch call success rate, latency, and error rate, so regressions are caught early.
• The cost of pinning and security patches: after pinning, you no longer automatically receive fixes from later releases, security fixes included. Subscribe to the tool’s release notes and security advisories, set a fixed review window (for example, once a month) with a staged upgrade process, and give security fixes an expedited path.
• Periodic evaluation: keep a separate “early access” track alongside the stable version to keep testing new releases, balancing stability against the benefits of iteration.

7. FAQ

Q: How do I disable auto-update for the plugin?
In the VS Code family, turn off extensions.autoUpdate or set it to manual updates; in the JetBrains family, disable auto-update under Settings → Plugins. After installing, double-check the effective version on the extension detail page or with <command> --version.

Q: How do I upgrade or roll back after pinning a version?
Validate in a test environment before upgrading. To roll back, simply choose the older version number via “Install Another Version” in the extension panel; for the CLI, reinstall the specified version and update the lock file. No uninstall step is needed first.

Q: How do I troubleshoot problems that appear after an upgrade?
First confirm the version actually in effect (--version) matches expectations; then check whether a silent upgrade happened. Next, run the same task in parallel with npx <package-name>@<old-version> or the old image to compare and determine whether the regression was introduced by the version, then roll back and report it.

Q: How do I install and distribute a specific version in an offline or intranet environment?
For IDE plugins, download the offline package (such as .vsix) in advance and distribute it on the intranet. For the CLI, serve a fixed version from a private registry or an internal npm/PyPI mirror, and ship it as a container image.

Q: How do I verify the version currently in effect?
On the IDE side, check the version number on the extension detail page; on the CLI side, run <command> --version; in CI, add a version assertion step that blocks builds with a mismatched version.

8. Summary

For an AI coding assistant, “latest” does not mean “best suited.” Secure API access with environment variables and least-privilege token management, roll the IDE plugin back to a specified version with auto-update disabled, pin the CLI version with a package manager and lock file, disable telemetry where appropriate, and back it all up with a version baseline, gradual upgrades, and security advisory tracking — together these significantly reduce the uncertainty introduced by silent upgrades. At the same time, acknowledge the cost of pinning: the other side of stability is delayed access to fixes in newer releases, which is why a fixed review window is needed to keep “stability” and “iteration” in a controllable balance.