VSCodium¶

ID: vscodium
Links: Home page · Repository
Upstream stars: ⭐ 33,450
Last commit: 2026-09-08
Version requirement: >= 1.60
Platforms: 🅱️ BSD · 🐧 Linux · 🍎 macOS · ⨂ Unix · 🪟 Windows
Operations: installed · install · remove
purl types: pkg:vscodium/
CLI name: codium
Issues and PRs: 📦 manager: vscode-based
Source: vscodium.toml

VSCodium is the telemetry-free community build of Visual Studio Code; its codium CLI exposes the exact same extension command surface as code, so this definition mirrors vscode.toml.

Homebrew Bundle has no vscodium entry type, so mpm dump --brewfile leaves VSCodium extensions out of the file: https://mpm.run/dump/#brewfile

No version_regexes: codium --version prints the bare version, then the commit hash and the arch on their own lines, and the default regex picks the first token up.

What `mpm` adds to `vscodium`¶

mpm reaches across every manager at once, not vscodium alone: mpm installed and mpm outdated cover vscodium alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your `vscodium` commands, in `mpm`¶

You already know vscodium: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With `vscodium`	With `mpm`
List what’s installed	`codium --list-extensions --show-versions`	`mpm --vscodium installed`
Install a package	`codium --install-extension <package_id>`	`mpm install pkg:vscodium/<package_id>`
Remove a package	`codium --uninstall-extension <package_id>`	`mpm remove pkg:vscodium/<package_id>`

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations¶

Operation	Supported
`installed`	✅
`outdated`
`orphans`
`search`
`install`	✅
`upgrade`
`upgrade_all`
`remove`	✅
`sync`
`cleanup`
`doctor`

Configuration¶

Ignore vscodium on the mpm CLI by passing the --no-vscodium option.
Ignore it for every run in your configuration:
```
[mpm]
vscodium = false
```
Raise the timeout of all vscodium calls:
```
[mpm.overrides.vscodium]
timeout = 900
```

Run mpm config-template vscodium to print all overridable settings for your configuration file:

[mpm.overrides.vscodium]
cli_names = [
    "codium",
]
cli_search_path = []
dry_run = false
ignore_auto_updates = true
plan = false
post_args = []
pre_args = []
pre_cmds = []
requirement = ">=1.60.0"
stop_on_error = false
unmaintained = false
version_cli_options = [
    "--version",
]
version_regexes = [
    "(?P<version>\\S+)",
]

Recipes¶

A few jobs you would otherwise script around vscodium, one mpm command each:

Snapshot and clone a machine: mpm --vscodium dump vscodium.toml, then mpm restore vscodium.toml on the next one.
Export a compliance SBOM: mpm --vscodium sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation¶

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

None of its operations is privileged.

See privilege escalation for the full policy.

Cooldown¶

State of VSCodium’s release-age gating, from the cooldown support table:

Status: 🚧 Proposed for installs (an auto-update delay shipped in 1.125.0)
Mechanism: extensions.autoUpdateDelay, auto-updates only
Reference: microsoft/vscode#321136

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

Registry: VS Code Marketplace
Retraction: Unpublish, uniquely with client-side remediation: “the extension is removed from the Marketplace and added to a block list. If the extension has been installed, it’s automatically uninstalled by VS Code” (runtime security), against a public ledger of removals (RemovedPackages.md)

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --cooldown best-effort opts back in.

Reference traces¶

A collection of raw native outputs captured from the manager’s own CLI and recorded in the bundled definition. If you know VSCodium well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ codium --list-extensions --show-versions
[email protected]

Version check¶

The version is probed by running:

$ codium --version
1.60.2
7f6ab5485bbc008386c4386d08766667e155244e
x64

and extracted with:

r"(?P<version>\S+)"

Upstream project¶

Metrics	`VSCodium/vscodium`
Activity
Popularity
Metadata

Changelog¶

8.0.0 (2026-09-20)
- Point the cooldown status at the open request covering extension installs: the delay VS Code shipped holds back automatic updates only.
5.19.0 (2024-11-14)
- Add support for VSCodium plugins.