{"version":"2.1.186","anchor":"denieddomains-now-accepts-deny-all-wildcard","canonical_anchor":"denieddomains-now-accepts-deny-all-wildcard","heading":"deniedDomains Now Accepts Deny-All Wildcard","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.186\/e\/denieddomains-now-accepts-deny-all-wildcard","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.186","markdown":"### `deniedDomains` Now Accepts Deny-All Wildcard\n\nThe `network.deniedDomains` setting now accepts the bare string `\"*\"` as a special deny-all value, blocking all outbound connections that are not covered by `allowedDomains`.\n\n**Details**\n\n- Previously, `deniedDomains` only accepted domain patterns. Now `[\"*\"]` means deny everything.\n- Unlike `allowedDomains`, which does not accept a bare `\"*\"`, the deny list specifically supports this to make it easy to implement an allowlist-only policy.\n\n**Evidence**\n\nSchema updated to `z.union([z.literal(\"*\"), domainPattern])` (search for `\"Unlike allowedDomains, a bare \\\"*\\\" is accepted here (deny-all).\"`)"}