Update golang.org/x/sync to v0.18.0 and add Go/Node/Python to default allowed domains

[Copilot]

Updates the golang.org/x/sync dependency from v0.17.0 to v0.18.0 (minor version bump, backward compatible). Adds key Go, Node, and Python ecosystem domains to the default network allowlist for better out-of-the-box support.

Changes

Dependency Update

• go.mod/go.sum: Bumped golang.org/x/sync from v0.17.0 → v0.18.0

Default Allowed Domains

• pkg/workflow/data/ecosystem_domains.json: Added 7 domains to defaults ecosystem:
  • Go: golang.org, proxy.golang.org, sum.golang.org
  • Node: npmjs.org, registry.npmjs.org
  • Python: pypi.org, files.pythonhosted.org

Test & Documentation

• pkg/workflow/ecosystem_domains_test.go: Updated test expectations to include new domains in defaults
• pkg/workflow/domains.go: Updated inline documentation

Impact

Workflows using network: defaults (or no network config) now include common package manager domains without requiring explicit ecosystem enablement. Users previously needed network: { allowed: [defaults, go, node, python] } — now just network: defaults suffices.

# Before: Required explicit ecosystem inclusion
network:
  allowed: [defaults, go, node, python]

# After: Implicit in defaults
network: defaults

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• go.googlesource.com
  • Triggering command: /update-job-proxy (dns block)
• go.uber.org
  • Triggering command: /update-job-proxy (dns block)
• gopkg.in
  • Triggering command: /update-job-proxy (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[Dependabot] Update golang.org/x/sync from v0.17.0 to v0.18.0</issue_title>
<issue_description>## Summary
Update golang.org/x/sync dependency from v0.17.0 to v0.18.0

Current State

• Package: golang.org/x/sync
• Current Version: v0.17.0
• Proposed Version: v0.18.0
• Update Type: Minor

Safety Assessment

✅ Safe to update

• Minor version update (0.17.0 → 0.18.0)
• Provides additional concurrency primitives for Go
• Maintained by the Go team with strong backward compatibility
• No breaking changes expected in minor releases
• This package typically adds new utilities without modifying existing ones

Changes

Based on the golang.org/x/sync release pattern, v0.18.0 (released Oct 21, 2025) likely includes:

• New synchronization primitives or utilities
• Performance improvements to existing utilities (errgroup, semaphore, singleflight)
• Bug fixes in concurrent data structures
• Documentation improvements
• Possible enhancements to context-aware synchronization

Links

• Source Repository
• Commit History
• Go Package

Note: This package is hosted on Google's Git (go.googlesource.com), not GitHub. There are no GitHub release pages.

Recommended Action

go get -u golang.org/x/sync@v0.18.0
go mod tidy

Testing Notes

• Run all tests: make test
• Verify concurrent operations work correctly
• Test error group handling if used in the codebase
• Check for any race conditions with go test -race
• Pay special attention to code using errgroup, semaphore, or singleflight packages

AI generated by Dependabot Go Module Dependency Checker</issue_description>

Comments on the Issue (you are @copilot in this section)

@pelikhan /q add node, python, go domains to allowed domains

• Fixes [Dependabot] Update golang.org/x/sync from v0.17.0 to v0.18.0 #3558

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.