Tweak docs for allowed outbound destinations

docs/guides/administration/configuring-http-proxy.md

@@ -81,6 +81,17 @@ For example, given `dt.http.proxy.exclusions=example.com,localhost:5432`:
 - `https://localhost:5432/` bypasses the proxy (host and port match).
 - `https://localhost:5433/` goes through the proxy (port mismatch).
 
+## Restricting destinations
+
+With a proxy, [`dt.outbound.allowed-destinations`](../../reference/configuration/properties.md#dtoutboundallowed-destinations)
+doesn't stop requests to hostnames. The proxy resolves them, not the API server, so the API server lets them all through.
+Configure the proxy to block destinations the API server must not reach.
+
+The property still applies to:
+
+- URLs that use an IP address instead of a hostname.
+- Hosts in the [bypass list](#bypass-list), which the API server connects to directly.
+
 ## Authenticated proxies
 
 Set `dt.http.proxy.auth.username` and `dt.http.proxy.auth.password`. Keep the password out of plain text via

docs/guides/administration/debugging-notifications.md

@@ -16,7 +16,7 @@ through how to narrow it down.
   proxy misconfiguration, or expired webhook URL.
 - **Destination denied.**
   [`dt.outbound.allowed-destinations`](../../reference/configuration/properties.md#dtoutboundallowed-destinations)
-  does not allow the destination. Before v5.2.0, the email and Kafka publishers used their own
+  does not allow the destination. Before 5.2.0, the email and Kafka publishers used their own
   `allow-local-connections` properties instead.
 - **Custom template fails to render.** A syntax error or missing
   variable causes the publisher to stop before sending.

docs/guides/upgrading/v5.2.0.md

@@ -36,7 +36,8 @@
     Repositories with a username still use basic authentication.
 
 * **The API server restricts outbound connections**. See [`dt.outbound.allowed-destinations`][allowed-destinations].
-  If an integration connects to `localhost`, for example a Trivy sidecar, add `loopback`. The restrictions apply
+  If an integration connects to `localhost`, for example a Trivy sidecar, add `localhost`.
+  Prefer exact hostnames over `loopback`, which allows every loopback address. The restrictions apply
   to notifications, data sources, package repositories, vulnerability analyzers, and integrations like DefectDojo.
 
 * **The `allow-local-connections` properties no longer exist**. This affects the email and Kafka notification publishers,

docs/reference/analyzers.md

@@ -129,6 +129,11 @@ Uses PURL matching.
 
 ![Trivy analyzer configuration](../assets/images/reference/analyzers/analyzer-config_trivy.png)
 
+!!! note
+    [`dt.outbound.allowed-destinations`](configuration/properties.md#dtoutboundallowed-destinations)
+    must allow the Trivy server. Add the exact hostname from the API URL, for example `trivy`,
+    or `localhost` for a sidecar. Prefer it over `loopback` or `private`, which allow every address in their range.
+
 ## VulnDB
 
 Integrates with [Flashpoint VulnDB][vulndb], a commercial vulnerability intelligence service.

docs/reference/notifications/publishers.md

@@ -6,7 +6,7 @@ Dependency-Track only connects to publisher destinations that
 [`dt.outbound.allowed-destinations`](../configuration/properties.md#dtoutboundallowed-destinations) allows.
 
 !!! note "Changed in 5.2.0"
-    Before v5.2.0, the email and Kafka publishers used their own properties.
+    Before 5.2.0, the email and Kafka publishers used their own properties.
     To allow local connections, set:
 
     * `dt.notification-publisher.email.allow-local-connections=true`