ibexa · mnocon · Aug 25, 2026 · Aug 24, 2026 · Aug 24, 2026 · Aug 24, 2026
diff --git a/docs/infrastructure_and_maintenance/clustering/clustering_with_ddev.md b/docs/infrastructure_and_maintenance/clustering/clustering_with_ddev.md
@@ -110,7 +110,7 @@ x-cache-hits: 5
 x-cache-ttl: 87654.321
 x-debug-token: 012345
 x-debug-token-link: https://<your-project>.ddev.site:<https-port>//_profiler/012345
-x-powered-by: Ibexa Commerce v5
+x-powered-by: Cohesivo CMS
 x-robots-tag: noindex
 x-varnish: 12345 67890
 xkey: ez-all c52 ct42 l2 pl1 p1 p2

diff --git a/docs/infrastructure_and_maintenance/devops.md b/docs/infrastructure_and_maintenance/devops.md
@@ -98,6 +98,27 @@
 Here you can see the name of the current SiteAccess and how it was matched.
 For reference see the [list of possible SiteAccess matchers](siteaccess_matching.md#available-siteaccess-matchers).
 
+## X-Powered-By header
+
+The system sets an `X-Powered-By` header on every response, identifying the platform running the site:
+
+``` http
+X-Powered-By: Cohesivo CMS
+```
+
+The header is enabled by default.
+To remove it, disable it under the `ibexa_system_info` configuration:
+
+```yaml
+ibexa_system_info:
+    system_info:
+        powered_by:
+            enabled: false
+```
+
+The header doesn't expose anything that couldn't be detected through other means.
+Still, as part of [minimizing exposure](security/security_checklist.md#minimize-exposure), you may want to disable it, for example to avoid revealing what software powers your site to automated scanners.
+
 ## Logging and debug configuration
 
 Logging in [[= product_name =]] consists of two parts.

diff --git a/docs/infrastructure_and_maintenance/security/security_checklist.md b/docs/infrastructure_and_maintenance/security/security_checklist.md
@@ -117,17 +117,8 @@
 
 - If possible, make the back office unavailable on the open internet.
 - [Symfony FOSJsRoutingBundle](https://github.com/FriendsOfSymfony/FOSJsRoutingBundle) is required in those releases where it's included, to expose routes to JavaScript. It exposes only the required routes, nothing more. It's only required in the back office SiteAccess though, so you can consider blocking it in other SiteAccesses. You should also go through your own custom routes, and decide for each if you need to expose them or not. See the documentation on [YAML route definitions for exposure](https://github.com/FriendsOfSymfony/FOSJsRoutingBundle/blob/master/Resources/doc/usage.rst#generating-uris).
-- By default, a [Powered-By header](update_db_to_2.5.md#powered-by-header) is set. It specifies what version of [[= product_name =]] is running. For example, `x-powered-by: [[= product_name_exp =]] v4`. This doesn't expose anything that couldn't be detected through other means. But if you wish to obscure this, you can either omit the version number, or disable the header entirely by setting `enabled: false`.
-
-    ```yaml
-    ibexa_system_info:
-      system_info:
-        powered_by:
-          # major => v4 || minor => v4.6 || none
-          release: major
-          # true || false
-          enabled: false
-    ```
+- By default, an `X-Powered-By` header is set.
+This doesn't expose anything that couldn't be detected through other means, but to obscure this information you can [disable the header entirely](devops.md#x-powered-by-header).
 
 - Consider whether certain interfaces must be left available on the open internet. For example:
     - The `/search` and `/graphql` endpoints

diff --git a/docs/release_notes/cohesivo_v6.0_deprecations.md b/docs/release_notes/cohesivo_v6.0_deprecations.md
@@ -24,6 +24,10 @@
 
 This page lists backwards compatibility breaks introduced in Cohesivo v6.0.
 
+## Removed packages
+
+The `ibexa/app-switcher` package, and its `IbexaAppSwitcherBundle`, is no longer part of the 6.0.
+
 ## PHP API changes
 
 ### ibexa/http-cache
@@ -46,3 +50,15 @@
 | v5.0.9 | [`\Ibexa\Contracts\Messenger\Stamp\SudoStamp`](background_tasks.md#sudostamp)     | No longer attached automatically to every dispatched message. For messages that should be processed without taking permissions into account, always attach the SudoStamp manually.                                             |
 | v5.0.9 | <nobr>`\Ibexa\Bundle\Messenger\Stamp\DeduplicateStamp`</nobr>                                     | Moved to [`\Ibexa\Contracts\Messenger\Stamp\DeduplicateStamp`](/api/php_api/php_api_reference/classes/Ibexa-Contracts-Messenger-Stamp-DeduplicateStamp.html). Covered by [[[= product_name_base =]] Rector](../resources/rector.md) refactoring rules. |
 | v5.0.10 | <nobr>[`\Ibexa\Contracts\Messenger\Stamp\DeduplicateStamp`](/api/php_api/php_api_reference/classes/Ibexa-Contracts-Messenger-Stamp-DeduplicateStamp.html)</nobr>                               | Replaced in v6.0 with [`\Symfony\Component\Messenger\Stamp\DeduplicateStamp`]([[= symfony_doc =]]/messenger.html#message-deduplication). A Rector rule will be available for the Cohesivo 6.0 upgrade. Until then, keep using the deprecated `\Ibexa\Contracts\Messenger\Stamp\DeduplicateStamp`, as Ibexa DXP 5.0 doesn't handle the native Symfony stamp. |
+
+### ibexa/user
+
+| Deprecated since | Entity                                                    | Change                                                                                                                       |
+| --- |----------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------|
+| N/A | `\Ibexa\User\UserSetting\Group\LocationGroup`                   | Renamed to `\Ibexa\User\UserSetting\Group\LocaleGroup`. The [user setting](add_user_setting.md) group identifier `location` is renamed to `locale`. Custom settings registered under the `location` identifier must be updated to use `locale` instead. |
+
+## Configuration keys
+
+| Old name | New name / Comment |
+| --- | --- |
+| `ibexa_system_info.system_info.powered_by.release` | Removed. See [X-Powered-By header](devops.md#x-powered-by-header) for how the header works in Cohesivo v6.0. |
diff --git a/docs/update_and_migration/from_5.0/update_to_6.0.md b/docs/update_and_migration/from_5.0/update_to_6.0.md
@@ -0,0 +1,31 @@
+---
+description: Update your installation to v6.0 from the latest v5.0 version.
+month_change: false
+---
+
+# Update from v5.0 to Cohesivo v6.0
+
+## Update from v5.0.x to v5.0.latest
+
+Before you update to v6.0, you need to [update to the latest maintenance release of v5.0 (v[[= latest_tag_5_0 =]])](update_from_5.0.md).
+
+## Update from v5.0.latest to v6.0.0
+
+### Update custom code for Cohesivo v6.0
+
+See [Cohesivo v6.0 renames, deprecations and removals](cohesivo_v6.0_deprecations.md) for the full list of changes.
+
+#### Remove IbexaAppSwitcher bundle
+
+The `IbexaAppSwitcherBundle` bundle, part of the `ibexa/app-switcher` package, is removed in 6.0.
+
+Remove the entry from `config/bundles.php`:
+
+``` diff
+-     Ibexa\Bundle\AppSwitcher\IbexaAppSwitcherBundle::class => ['all' => true],
+```
+
+### Empty the background task queue
+
+The message format used for [background task deduplication](cohesivo_v6.0_deprecations.md#ibexamessenger) changed between v5.0 and v6.0.
+Before you update, process or manually remove pending messages stored in the `ibexa_messenger_messages` table, so no message in the old format remains.
diff --git a/mkdocs.yml b/mkdocs.yml
@@ -934,6 +934,7 @@ nav:
               - Update to v5.0: update_and_migration/from_4.6/update_to_5.0.md
         - Update from v5.0:
               - Update to v5.0: update_and_migration/from_5.0/update_from_5.0.md
+              - Update to v6.0: update_and_migration/from_5.0/update_to_6.0.md
         - Migrate to Ibexa DXP or Cohesivo:
             - Migrate from eZ Publish Platform: update_and_migration/migrate_to_ibexa_dxp/migrating_from_ez_publish_platform.md
             - Migrate from eZ Publish: update_and_migration/migrate_to_ibexa_dxp/migrating_from_ez_publish.md