Safeguard
Developer Tools•

How do JetBrains IDE and plugin updates work, and who owns them?

JetBrains IDEs check for updates by default and usually patch in place. See update channels, Toolbox App policy and how to handle plugin updates in a team.

Safeguard Security Team
3 min read

JetBrains IDEs check for updates automatically and usually apply them as patches that need only a restart. If you install through the Toolbox App, you can update every managed tool automatically or set a policy per IDE. Plugins update separately, so a patched IDE can still carry old plugins.

How the IDE updates itself

The IntelliJ IDEA documentation says the IDE is configured by default to check for updates automatically and notify you. Updates are usually patch-based: they apply to the existing installation and need a restart. Sometimes a patch is not available, and a new version must be installed.

One practical limit: if the IDE has no HTTP access outside your local network, it cannot check or apply patches. In that case you download new versions and install them by hand. Developers behind strict proxies are the usual group stuck here.

The Toolbox App option

When the IDE is installed with the Toolbox App, it suggests updates when a new version appears. In Toolbox settings, under Tools, there is an option called Update all tools automatically. If it is off, someone must click Update next to each instance.

You can also set a channel for each IDE instance:

ChannelWhat you get
ReleaseStable releases recommended for production
Early Access ProgramRelease candidates, betas and EAP builds

For work machines, release is the sensible default. Early access builds belong on a test machine.

Plugins are a separate stream

The plugin documentation describes two ways to update: click Update in plugin settings when a new version shows, or have the IDE download plugin updates automatically and apply them on the next restart. Bundled plugins ship with the IDE and cannot be uninstalled, only disabled. Other plugins come from JetBrains Marketplace or a local archive.

If the newest version of a plugin is broken, you can install a specific version from disk using a local ZIP or JAR. Note that a plugin installed from disk will not be vetted by anyone but you.

A small team routine

  1. Pick the release channel for everyone.
  2. Turn on automatic plugin updates, or review plugin updates weekly.
  3. Keep a list of third-party plugins per team and remove ones nobody uses.
  4. Check that proxied machines can still reach the update endpoints.
  5. Record IDE versions in your device inventory.

Disabling unused plugins also trims the surface you need to track. Pair this with a patch policy for developer tooling.

Safeguard ships a JetBrains plugin, and its dependency scanning covers the projects you open in any IDE. A free scan is available at gold.safeguard.sh/scan.

Common mistakes

The common ones are running the early access channel on a work machine, leaving plugin updates untouched for a year and assuming a restart is not needed. Patch updates still need one. Another is a machine behind a proxy that silently cannot reach the update service, so the IDE never learns a new version exists.

When you hear that an IDE is behind, ask whether it is a policy decision or a network block. The fixes differ.

Quick check

Do JetBrains IDEs update automatically?

By default they check for updates automatically and notify you. Updates are usually patches that need only a restart.

Does updating the IDE also update plugins?

Plugins have their own update setting, so check both. You can enable automatic plugin downloads that apply on the next restart.

Sources

Last reviewed: 19 October 2026.

Never miss an update

Weekly insights on software supply chain security, delivered to your inbox.

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.