External URLs

In all firewalls, provide access to the following external host URLs needed by Code Insight:

Code Insight Component/ Functionality	Hosts and Other URLs
CodeAware Analyzers	https://api\.nuget\.org/v3\-flatcontainer/ https://builds\.openlogic\.com/downloadJDK/openlogic\-openjdk/8u402\-b06/openlogic\-openjdk\-8u402\-b06\-linux\-x64\.tar\.gz * https://builds\.openlogic\.com/downloadJDK/openlogic\-openjdk/8u402\-b06/openlogic\-openjdk\-8u402\-b06\-windows\-x64\.zip * https://download\.java\.net/java/ga/jdk11/openjdk\-11\_linux\-x64\_bin\.tar\.gz * https://download\.java\.net/java/ga/jdk11/openjdk\-11\_windows\-x64\_bin\.zip * https://download\.java\.net/java/GA/jdk17/0d483333a00540d886896bac774ff48b/35/GPL/openjdk\-17\_linux\-x64\_bin\.tar\.gz * https://download\.java\.net/java/GA/jdk17/0d483333a00540d886896bac774ff48b/35/GPL/openjdk\-17\_windows\-x64\_bin\.zip * https://cdn\.cocoapods\.org/ https://cdn\.jsdelivr\.net/cocoa/Specs https://packagist\.org https://proxy\.golang\.org/ https://pypi\.org/pypi/ https://api\.deps\.dev/ https://registry\.bower\.io/packages/ https://registry\.npmjs\.org/ https://rubygems\.org/api/v1/gems/ https://search\.maven\.org/ https://services\.gradle\.org/versions/current https://spdx\.org/licenses/
Vulnerability database access	https://nvd\.nist\.gov https://web\.nvd\.nist\.gov/ https://nvd\.nist\.gov/vuln\-metrics/cvss/v2\-calculator https://nvd\.nist\.gov/vuln\-metrics/cvss/v3\-calculator
Electronic Update	https://updates\.palamida\.com/
Remote file access	https://palamida\-dp\-nbhood\.s3\.amazonaws\.com/
Notices text	https://login\.flexera\.com/ https://sca\-api\.revenera\.com/

* In addition to the asterisked URLs in the table, Code Insight might use any Gradle download URLs declared in the gradle.wrapper.properties file if this file is available in a Gradle codebase uploaded to a Code Insight project. You must allow access to these URLs as well.

Special Note About Custom Repositories

When Code Insight processes a pom.xml file, it looks for declarations of direct dependencies (that is, OSS or third-party components on which a top-level component detected in your product code is dependent). Code Insight then reports these direct dependencies as inventory items linked to the top-level (parent) inventory item.

If transitive-dependency support is enabled in the scan profile, Code Insight calls into the Maven Central repository for each direct dependency to determine whether the dependency is resolvable. If it is resolvable, Code Insight then searches the Maven Central repository to obtain the list of transitive dependencies (that is, dependencies of the dependency), provided that these dependencies are not available in local maven repository.

In some cases, you might have provided repositories that are in addition to the Maven Central repository. If a direct dependency is not resolvable through the Maven Central repository (or if its transitive-dependency data is found neither in the local maven repository nor in the Maven Central repository), Code Insight might call into these other repositories to determine the dependency’s resolvability or to obtain its transitive-dependency data or both. For this reason, if you have configured custom repositories as part of your package manager manifest files, the URLs for those repositories need to be a part of your list of allowed external URLs.