From 5424564291d7df14e1f367ee3171ab59663fd42f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marek=20Noco=C5=84?= Date: Mon, 24 Aug 2026 11:06:04 +0200 Subject: [PATCH 1/4] X-Powered-By header --- .../clustering/clustering_with_ddev.md | 2 +- docs/infrastructure_and_maintenance/devops.md | 21 +++++++++++ .../security/security_checklist.md | 13 ++----- .../cohesivo_v6.0_deprecations.md | 6 ++++ .../from_5.0/update_to_6.0.md | 36 +++++++++++++++++++ mkdocs.yml | 1 + 6 files changed, 67 insertions(+), 12 deletions(-) create mode 100644 docs/update_and_migration/from_5.0/update_to_6.0.md diff --git a/docs/infrastructure_and_maintenance/clustering/clustering_with_ddev.md b/docs/infrastructure_and_maintenance/clustering/clustering_with_ddev.md index c7fe91fb5a..f0c036b279 100644 --- a/docs/infrastructure_and_maintenance/clustering/clustering_with_ddev.md +++ b/docs/infrastructure_and_maintenance/clustering/clustering_with_ddev.md @@ -110,7 +110,7 @@ x-cache-hits: 5 x-cache-ttl: 87654.321 x-debug-token: 012345 x-debug-token-link: https://.ddev.site://_profiler/012345 -x-powered-by: Ibexa Commerce v5 +x-powered-by: Cohesivo CMS x-robots-tag: noindex x-varnish: 12345 67890 xkey: ez-all c52 ct42 l2 pl1 p1 p2 diff --git a/docs/infrastructure_and_maintenance/devops.md b/docs/infrastructure_and_maintenance/devops.md index b1d830f3a7..dc2219ce69 100644 --- a/docs/infrastructure_and_maintenance/devops.md +++ b/docs/infrastructure_and_maintenance/devops.md @@ -98,6 +98,27 @@ You can see details of these calls in the [Symfony Profiler]([[= symfony_doc =]] Here you can see the name of the current SiteAccess and how it was matched. For reference see the [list of possible SiteAccess matchers](siteaccess_matching.md#available-siteaccess-matchers). +## X-Powered-By header + +The system sets an `X-Powered-By` header on every response, identifying the platform running the site: + +``` http +X-Powered-By: Cohesivo CMS +``` + +The header is enabled by default. +To remove it, disable it under the `ibexa_system_info` configuration: + +```yaml +ibexa_system_info: + system_info: + powered_by: + enabled: false +``` + +The header doesn't expose anything that couldn't be detected through other means. +Still, as part of [minimizing exposure](security/security_checklist.md#minimize-exposure), you may want to disable it, for example to avoid revealing what software powers your site to automated scanners. + ## Logging and debug configuration Logging in [[= product_name =]] consists of two parts. diff --git a/docs/infrastructure_and_maintenance/security/security_checklist.md b/docs/infrastructure_and_maintenance/security/security_checklist.md index bba7e1c09d..91bdaf0c5c 100644 --- a/docs/infrastructure_and_maintenance/security/security_checklist.md +++ b/docs/infrastructure_and_maintenance/security/security_checklist.md @@ -117,17 +117,8 @@ Reduce your attack surface by exposing only what you must. - If possible, make the back office unavailable on the open internet. - [Symfony FOSJsRoutingBundle](https://github.com/FriendsOfSymfony/FOSJsRoutingBundle) is required in those releases where it's included, to expose routes to JavaScript. It exposes only the required routes, nothing more. It's only required in the back office SiteAccess though, so you can consider blocking it in other SiteAccesses. You should also go through your own custom routes, and decide for each if you need to expose them or not. See the documentation on [YAML route definitions for exposure](https://github.com/FriendsOfSymfony/FOSJsRoutingBundle/blob/master/Resources/doc/usage.rst#generating-uris). -- By default, a [Powered-By header](update_db_to_2.5.md#powered-by-header) is set. It specifies what version of [[= product_name =]] is running. For example, `x-powered-by: [[= product_name_exp =]] v4`. This doesn't expose anything that couldn't be detected through other means. But if you wish to obscure this, you can either omit the version number, or disable the header entirely by setting `enabled: false`. - - ```yaml - ibexa_system_info: - system_info: - powered_by: - # major => v4 || minor => v4.6 || none - release: major - # true || false - enabled: false - ``` +- By default, an `X-Powered-By header` is set. +This doesn't expose anything that couldn't be detected through other means, but to obscure this information you can [disable the header entirely](devops.md#x-powered-by-header). - Consider whether certain interfaces must be left available on the open internet. For example: - The `/search` and `/graphql` endpoints diff --git a/docs/release_notes/cohesivo_v6.0_deprecations.md b/docs/release_notes/cohesivo_v6.0_deprecations.md index d2a538c01b..72c9676fe0 100644 --- a/docs/release_notes/cohesivo_v6.0_deprecations.md +++ b/docs/release_notes/cohesivo_v6.0_deprecations.md @@ -46,3 +46,9 @@ This page lists backwards compatibility breaks introduced in Cohesivo v6.0. | v5.0.9 | [`\Ibexa\Contracts\Messenger\Stamp\SudoStamp`](background_tasks.md#sudostamp) | No longer attached automatically to every dispatched message. For messages that should be processed without taking permissions into account, always attach the SudoStamp manually. | | v5.0.9 | `\Ibexa\Bundle\Messenger\Stamp\DeduplicateStamp` | Moved to [`\Ibexa\Contracts\Messenger\Stamp\DeduplicateStamp`](/api/php_api/php_api_reference/classes/Ibexa-Contracts-Messenger-Stamp-DeduplicateStamp.html). Covered by [[[= product_name_base =]] Rector](../resources/rector.md) refactoring rules. | | v5.0.10 | [`\Ibexa\Contracts\Messenger\Stamp\DeduplicateStamp`](/api/php_api/php_api_reference/classes/Ibexa-Contracts-Messenger-Stamp-DeduplicateStamp.html) | Replaced in v6.0 with [`\Symfony\Component\Messenger\Stamp\DeduplicateStamp`]([[= symfony_doc =]]/messenger.html#message-deduplication). A Rector rule will be available for the Cohesivo 6.0 upgrade. Until then, keep using the deprecated `\Ibexa\Contracts\Messenger\Stamp\DeduplicateStamp`, as Ibexa DXP 5.0 doesn't handle the native Symfony stamp. | + +## Configuration keys + +| Old name | New name / Comment | +| --- | --- | +| `ibexa_system_info.system_info.powered_by.release` | Removed. See [X-Powered-By header](devops.md#x-powered-by-header) for how the header works in Cohesivo v6.0. | diff --git a/docs/update_and_migration/from_5.0/update_to_6.0.md b/docs/update_and_migration/from_5.0/update_to_6.0.md new file mode 100644 index 0000000000..51462398fa --- /dev/null +++ b/docs/update_and_migration/from_5.0/update_to_6.0.md @@ -0,0 +1,36 @@ +--- +description: Update your installation to v6.0 from the latest v5.0 version. +month_change: false +--- + +# Update from v5.0 to Cohesivo v6.0 + +!!! note "Cohesivo v6.0 isn't released yet" + + This page is published ahead of the Cohesivo v6.0 release to give you time to prepare your code for the upcoming changes. + + As the work on Cohesivo 6.0 is in progress, this page **isn't exhaustive and will evolve with time**. + +## Update from v5.0.x to v5.0.latest + +Before you update to v6.0, you need to [update to the latest maintenance release of v5.0 (v[[= latest_tag_5_0 =]])](update_from_5.0.md). + +## Update from v5.0.latest to v6.0.0 + +### Update custom code for Cohesivo v6.0 + +See [Cohesivo v6.0 renames, deprecations and removals](/release_notes/cohesivo_v6.0_deprecations.md) for the full list of changes. + +#### X-Powered-By header + +The `ibexa_system_info.system_info.powered_by.release` configuration option is removed. +Remove it from your configuration, if present. +See [X-Powered-By header](/infrastructure_and_maintenance/devops.md#x-powered-by-header) for how the header works in Cohesivo v6.0. + +```diff + ibexa_system_info: + system_info: + powered_by: +- release: major + enabled: true +``` diff --git a/mkdocs.yml b/mkdocs.yml index c4646bdfbd..989d7a1d4e 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -934,6 +934,7 @@ nav: - Update to v5.0: update_and_migration/from_4.6/update_to_5.0.md - Update from v5.0: - Update to v5.0: update_and_migration/from_5.0/update_from_5.0.md + - Update to v6.0: update_and_migration/from_5.0/update_to_6.0.md - Migrate to Ibexa DXP or Cohesivo: - Migrate from eZ Publish Platform: update_and_migration/migrate_to_ibexa_dxp/migrating_from_ez_publish_platform.md - Migrate from eZ Publish: update_and_migration/migrate_to_ibexa_dxp/migrating_from_ez_publish.md From f544f276c5b32256a80d8e100f99d24614e96cf4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marek=20Noco=C5=84?= Date: Mon, 24 Aug 2026 11:50:39 +0200 Subject: [PATCH 2/4] Added deprecations for IbexaAppSwitcherBundle and messenger deduplication messages --- .../cohesivo_v6.0_deprecations.md | 10 +++++++ .../from_5.0/update_to_6.0.md | 26 ++++++++----------- 2 files changed, 21 insertions(+), 15 deletions(-) diff --git a/docs/release_notes/cohesivo_v6.0_deprecations.md b/docs/release_notes/cohesivo_v6.0_deprecations.md index 72c9676fe0..4b57f1ee46 100644 --- a/docs/release_notes/cohesivo_v6.0_deprecations.md +++ b/docs/release_notes/cohesivo_v6.0_deprecations.md @@ -24,6 +24,10 @@ To make the update process between v5 and v6 easier, there are no plans for a la This page lists backwards compatibility breaks introduced in Cohesivo v6.0. +## Dropped packages + +The `ibexa/app-switcher` package, and its `IbexaAppSwitcherBundle`, is no longer part of the 6.0. + ## PHP API changes ### ibexa/http-cache @@ -47,6 +51,12 @@ This page lists backwards compatibility breaks introduced in Cohesivo v6.0. | v5.0.9 | `\Ibexa\Bundle\Messenger\Stamp\DeduplicateStamp` | Moved to [`\Ibexa\Contracts\Messenger\Stamp\DeduplicateStamp`](/api/php_api/php_api_reference/classes/Ibexa-Contracts-Messenger-Stamp-DeduplicateStamp.html). Covered by [[[= product_name_base =]] Rector](../resources/rector.md) refactoring rules. | | v5.0.10 | [`\Ibexa\Contracts\Messenger\Stamp\DeduplicateStamp`](/api/php_api/php_api_reference/classes/Ibexa-Contracts-Messenger-Stamp-DeduplicateStamp.html) | Replaced in v6.0 with [`\Symfony\Component\Messenger\Stamp\DeduplicateStamp`]([[= symfony_doc =]]/messenger.html#message-deduplication). A Rector rule will be available for the Cohesivo 6.0 upgrade. Until then, keep using the deprecated `\Ibexa\Contracts\Messenger\Stamp\DeduplicateStamp`, as Ibexa DXP 5.0 doesn't handle the native Symfony stamp. | +### ibexa/user + +| Deprecated since | Entity | Change | +| --- |----------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------| +| N/A | `\Ibexa\User\UserSetting\Group\LocationGroup` | Renamed to `\Ibexa\User\UserSetting\Group\LocaleGroup`. The [user setting](add_user_setting.md) group identifier `location` is renamed to `locale`. Custom settings registered under the `location` identifier must be updated to use `locale` instead. | + ## Configuration keys | Old name | New name / Comment | diff --git a/docs/update_and_migration/from_5.0/update_to_6.0.md b/docs/update_and_migration/from_5.0/update_to_6.0.md index 51462398fa..ecb0441eb8 100644 --- a/docs/update_and_migration/from_5.0/update_to_6.0.md +++ b/docs/update_and_migration/from_5.0/update_to_6.0.md @@ -5,11 +5,6 @@ month_change: false # Update from v5.0 to Cohesivo v6.0 -!!! note "Cohesivo v6.0 isn't released yet" - - This page is published ahead of the Cohesivo v6.0 release to give you time to prepare your code for the upcoming changes. - - As the work on Cohesivo 6.0 is in progress, this page **isn't exhaustive and will evolve with time**. ## Update from v5.0.x to v5.0.latest @@ -21,16 +16,17 @@ Before you update to v6.0, you need to [update to the latest maintenance release See [Cohesivo v6.0 renames, deprecations and removals](/release_notes/cohesivo_v6.0_deprecations.md) for the full list of changes. -#### X-Powered-By header +#### Remove IbexaAppSwitcher bundle + +The `IbexaAppSwitcherBundle` bundle, part of the `ibexa/app-switcher` package, is removed in 6.0. -The `ibexa_system_info.system_info.powered_by.release` configuration option is removed. -Remove it from your configuration, if present. -See [X-Powered-By header](/infrastructure_and_maintenance/devops.md#x-powered-by-header) for how the header works in Cohesivo v6.0. +Remove the entry from `config/bundles.php`: -```diff - ibexa_system_info: - system_info: - powered_by: -- release: major - enabled: true +``` diff +- Ibexa\Bundle\AppSwitcher\IbexaAppSwitcherBundle::class => ['all' => true], ``` + +### Drain the background task queue + +The message format used for [background task deduplication](cohesivo_v6.0_deprecations.md#ibexamessenger) changed between v5.0 and v6.0. +Before you update, process or manually remove pending messages stored in the `ibexa_messenger_messages` table, so no message in the old format remains. From 7b40de7c8c0f7aeaf7f7526f248ccd8ed412afb5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marek=20Noco=C5=84?= Date: Mon, 24 Aug 2026 12:26:23 +0200 Subject: [PATCH 3/4] Selfreview --- .../security/security_checklist.md | 2 +- docs/update_and_migration/from_5.0/update_to_6.0.md | 1 - 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/docs/infrastructure_and_maintenance/security/security_checklist.md b/docs/infrastructure_and_maintenance/security/security_checklist.md index 91bdaf0c5c..1cfeb52435 100644 --- a/docs/infrastructure_and_maintenance/security/security_checklist.md +++ b/docs/infrastructure_and_maintenance/security/security_checklist.md @@ -117,7 +117,7 @@ Reduce your attack surface by exposing only what you must. - If possible, make the back office unavailable on the open internet. - [Symfony FOSJsRoutingBundle](https://github.com/FriendsOfSymfony/FOSJsRoutingBundle) is required in those releases where it's included, to expose routes to JavaScript. It exposes only the required routes, nothing more. It's only required in the back office SiteAccess though, so you can consider blocking it in other SiteAccesses. You should also go through your own custom routes, and decide for each if you need to expose them or not. See the documentation on [YAML route definitions for exposure](https://github.com/FriendsOfSymfony/FOSJsRoutingBundle/blob/master/Resources/doc/usage.rst#generating-uris). -- By default, an `X-Powered-By header` is set. +- By default, an `X-Powered-By` header is set. This doesn't expose anything that couldn't be detected through other means, but to obscure this information you can [disable the header entirely](devops.md#x-powered-by-header). - Consider whether certain interfaces must be left available on the open internet. For example: diff --git a/docs/update_and_migration/from_5.0/update_to_6.0.md b/docs/update_and_migration/from_5.0/update_to_6.0.md index ecb0441eb8..08fc1c2c96 100644 --- a/docs/update_and_migration/from_5.0/update_to_6.0.md +++ b/docs/update_and_migration/from_5.0/update_to_6.0.md @@ -5,7 +5,6 @@ month_change: false # Update from v5.0 to Cohesivo v6.0 - ## Update from v5.0.x to v5.0.latest Before you update to v6.0, you need to [update to the latest maintenance release of v5.0 (v[[= latest_tag_5_0 =]])](update_from_5.0.md). From 04cc75d7edc4f495d5e9b598d820cbc48daf502e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marek=20Noco=C5=84?= Date: Tue, 25 Aug 2026 10:25:56 +0200 Subject: [PATCH 4/4] Apply suggestions from code review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Marek NocoĊ„ --- docs/release_notes/cohesivo_v6.0_deprecations.md | 2 +- docs/update_and_migration/from_5.0/update_to_6.0.md | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/release_notes/cohesivo_v6.0_deprecations.md b/docs/release_notes/cohesivo_v6.0_deprecations.md index 4b57f1ee46..20d9d62bcd 100644 --- a/docs/release_notes/cohesivo_v6.0_deprecations.md +++ b/docs/release_notes/cohesivo_v6.0_deprecations.md @@ -24,7 +24,7 @@ To make the update process between v5 and v6 easier, there are no plans for a la This page lists backwards compatibility breaks introduced in Cohesivo v6.0. -## Dropped packages +## Removed packages The `ibexa/app-switcher` package, and its `IbexaAppSwitcherBundle`, is no longer part of the 6.0. diff --git a/docs/update_and_migration/from_5.0/update_to_6.0.md b/docs/update_and_migration/from_5.0/update_to_6.0.md index 08fc1c2c96..73088954de 100644 --- a/docs/update_and_migration/from_5.0/update_to_6.0.md +++ b/docs/update_and_migration/from_5.0/update_to_6.0.md @@ -13,7 +13,7 @@ Before you update to v6.0, you need to [update to the latest maintenance release ### Update custom code for Cohesivo v6.0 -See [Cohesivo v6.0 renames, deprecations and removals](/release_notes/cohesivo_v6.0_deprecations.md) for the full list of changes. +See [Cohesivo v6.0 renames, deprecations and removals](cohesivo_v6.0_deprecations.md) for the full list of changes. #### Remove IbexaAppSwitcher bundle @@ -25,7 +25,7 @@ Remove the entry from `config/bundles.php`: - Ibexa\Bundle\AppSwitcher\IbexaAppSwitcherBundle::class => ['all' => true], ``` -### Drain the background task queue +### Empty the background task queue The message format used for [background task deduplication](cohesivo_v6.0_deprecations.md#ibexamessenger) changed between v5.0 and v6.0. Before you update, process or manually remove pending messages stored in the `ibexa_messenger_messages` table, so no message in the old format remains.