[dependabot]

Bumps golang.org/x/sync from 0.23.0 to 0.24.0.

Commits

• 36f2d70 errgroup: modernize the usage of closures in goroutines
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues, list_pull_requests, get_file_contents, list_commits)	data returned (200 OK)	ALLOWED	✅
B	MCP	writes (add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request)	all 6 targets absent from the 23-tool github CLI catalog (read-only toolset only)	BLOCKED	⚠️ INCONCLUSIVE
C	CLI	reads	data returned via proxied github CLI	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment)	gh CLI not authenticated — no writes attempted	BLOCKED	⚠️ INCONCLUSIVE
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh CLI not authenticated — no mutations attempted	BLOCKED	⚠️ INCONCLUSIVE

Overall: INCONCLUSIVE

No write leaked through any surface. Part B is inconclusive because the gh-aw tools.github: wrapper launches the backend with GITHUB_READ_ONLY=1, so write tools never appear in the exposed catalog — this confirms backend/toolset config, not mcpg's own DIFC/guard enforcement layer (covered separately by internal/guard and internal/difc unit tests). Parts D/E are inconclusive because gh was not authenticated in this run (gh auth status → not logged in), so the token-scope write boundary could not be exercised. No reaction/star/issue/comment/branch/file/PR was created or leaked.

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime