If you ever wrote a code node that fetched an external API and watched it hang until timeout, this one is for you. The isolated environments that run your code block outbound network traffic by default — a security feature, but a confusing one, because the failure looked like a bug in your code rather than a firewall doing its job.
Code nodes now have an Allowed domains field. List the hosts your code needs to reach — comma-separated, up to 20 — and those domains are opened for that node while everything else stays blocked. Input is forgiving: paste a full URL and we'll trim it down to the host, casing and duplicates are handled for you, and plain IP addresses work too. Invalid entries fail upfront with a clear message instead of surfacing as a mysterious timeout mid-run.
Two things to know: any code that makes a network call needs its target host listed, and if an API redirects you to a different host, that host needs to be on the list as well. The workflow editor now warns you when your code references a URL but the domain list is empty.
Live for all workspaces — just fill in the field on any code node that talks to the outside world.