How does WordPress get the upgrade URL?

It comes from the wordpress.org API version checker endpoint (limited documentation here) and is retrieved in the wp_version_check() function.