When MODULE.bazel pins the Go toolchain with
go_sdk.download(version = "..."), rules_go's go_sdk extension reads
https://go.dev/dl/?mode=json&include=all during `bazel mod tidy` to
resolve SDK filenames and checksums. Under proxy-egress-enforce the
proxy refuses it ("egress not allowlisted go.dev").

The impact depends on the rules_go version the update resolves. Before
rules_go 0.59.0 the go_sdk extension fails, so the update ends in
dependency_file_not_resolvable. From 0.59.0 the fetch may fail without
breaking the extension, but it is still attempted, and retried, on
every lockfile update.

go.dev is the Go project's own site (certificate CN=go.dev, issued by
Google Trust Services) and serves the index as JSON directly, with no
redirect, so it is added as an exact host with a child probe.
pkg.go.dev is already listed separately.

go.dev also serves the playground's /_/share endpoint, which stores
POSTed snippets publicly. The entry's comment records this as an
accepted residual risk, as is done for storage.googleapis.com.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>