craftersoftware · alhambrav · Jun 4, 2026 · Jun 8, 2026 · Jun 15, 2026 · Jun 19, 2026
diff --git a/source/conf.py b/source/conf.py
@@ -29,7 +29,7 @@
 # The short X.Y version.
 version = u'current'
 # The full version, including alpha/beta/rc tags.
-release = u'4.5.2'
+release = u'4.6.0'
 
 
 # -- General configuration ---------------------------------------------------

diff --git a/source/contribute/acknowledgements.rst b/source/contribute/acknowledgements.rst
@@ -1,5 +1,5 @@
 :is-up-to-date: True
-:last-updated: 4.5.2
+:last-updated: 4.6.0
 
 .. meta::
     :description lang=en:

diff --git a/source/index.rst b/source/index.rst
@@ -1,5 +1,5 @@
 :is-up-to-date: True
-:last-updated: 4.5.2
+:last-updated: 4.6.0
 
 ########################
 CrafterCMS Documentation
@@ -75,8 +75,8 @@ CrafterCMS is used by three main constituencies:
 =========================
 Latest CrafterCMS Release
 =========================
-The latest community version of CrafterCMS is `4.5.2 <https://craftercms.com/download>`__ and the latest
-enterprise version is ``4.5.2E``.
+The latest community version of CrafterCMS is `4.6.0 <https://craftercms.com/download>`__ and the latest
+enterprise version is ``4.6.0E``.
 
 Start exploring the latest version of CrafterCMS in a few minutes using Docker by simply running the following command:
 

diff --git a/source/reference/api/search.rst b/source/reference/api/search.rst
@@ -1,5 +1,5 @@
 :is-up-to-date: True
-:last-updated: 4.1.6
+:last-updated: 4.6.0
 
 .. index:: Search, Query, OpenSearch, GraphQL
 
@@ -377,7 +377,7 @@ Here's how the query will look like for the above image of a multi-index query f
     }
     '
 
-|
+Note that the Site Search REST API ``POST /api/1/site/search/search.json`` rejects request bodies that contain restricted JSON object keys, including keys in nested objects and objects contained in arrays, with an HTTP 400 response. See :ref:`engine-search-restricted-key-patterns` for more information.
 
 See :base_url:`here <_static/api/engine.html#tag/search/operation/search>` for more information on the Crafter Engine API ``search``.
 

diff --git a/source/reference/modules/engine.rst b/source/reference/modules/engine.rst
@@ -1,5 +1,5 @@
 :is-up-to-date: True
-:last-updated: 4.5.0
+:last-updated: 4.6.0
 
 .. meta::
    :description: Crafter Engine is the CrafterCMS content delivery module — serving REST, GraphQL, and FreeMarker-rendered content for web and mobile apps.
@@ -729,6 +729,8 @@ In this section we will highlight some of the more commonly used properties in t
       - Allows you to set the content root folder
     * - :ref:`engine-turn-off-show-error`
       - Allows you to turn off showing errors in line with content
+    * - :ref:`engine-site-allowed-descriptor-paths`
+      - Allows you to configure allowed descriptor patterns used by ``SiteItemService``
     * - :ref:`engine-http-response-headers`
       - Allows you to add headers to responses, such as caching policies
     * - :ref:`engine-url-rewrite-configuration`
@@ -755,6 +757,8 @@ In this section we will highlight some of the more commonly used properties in t
       - Allows you to configure the search client connection timeout, socket timeout and number of threads
     * - :ref:`engine-search-default-filters`
       - Allows you to enable/disable default filters for search queries
+    * - :ref:`engine-search-restricted-key-patterns`
+      - Allows you to configure JSON keys that are not allowed in Site Search API request bodies
     * - :ref:`engine-search-connection-pool`
       - Allows you to configure the search connection pool max total connections and max connections per route
     * - :ref:`engine-content-length-headers`
@@ -822,6 +826,38 @@ Templates in CrafterCMS will display the errors in line with content as they enc
 
 |
 
+|hr|
+
+.. _engine-site-allowed-descriptor-paths:
+
+""""""""""""""""""""""""
+Allowed Descriptor Paths
+""""""""""""""""""""""""
+.. version_tag::
+    :label: Since
+    :version: 4.6.0
+
+Crafter Engine limits which site URLs ``SiteItemService`` can return as content items. This is set with a
+comma-separated list of regular expressions in the following property (default: ``/site/.*``):
+
+.. code-block:: properties
+    :caption: *CRAFTER_HOME/bin/apache-tomcat/shared/classes/crafter/engine/extension/server-config.properties*
+
+    # List of regular expressions for the paths that are allowed to be used as descriptor paths (the SiteItemService will only return items from these paths)
+    crafter.engine.site.default.descriptors.allowed.paths=/site/.*
+
+``SiteItemService.getSiteItem(...)`` returns an item only when the item URL matches one of the patterns.
+``SiteItemService.getSiteTree(...)`` includes only matching items in the tree.
+
+``SiteItemService.exists(path)`` is not limited by these patterns. It only checks whether the path is present in
+the site content store. Engine configuration lookups use ``exists()`` and ``getRawContent()`` rather than
+``getSiteItem()``, so configuration files outside the allowed descriptor paths can still be detected and read.
+
+If Groovy, Freemarker, or other Engine code calls ``getSiteItem`` or ``getSiteTree`` for paths outside the allowed
+patterns, those calls receive ``null`` or an empty tree. To include extra descriptor locations, add more regexes to
+the property.
+
+
 |hr|
 
 .. _engine-http-response-headers:
@@ -1665,6 +1701,35 @@ To enable/disable the default filters for all queries, set the following:
 
 |hr|
 
+.. _engine-search-restricted-key-patterns:
+
+"""""""""""""""""""""""""""""""
+Search Restricted Key Patterns
+"""""""""""""""""""""""""""""""
+.. version_tag::
+    :label: Since
+    :version: 4.6.0
+
+The Site Search REST API (``POST /api/1/site/search/search.json``, and the legacy
+``POST /api/1/site/elasticsearch/search.json``) rejects request bodies that contain restricted JSON object keys.
+
+Configure the restricted key patterns used by the Site Search REST API, using the ``crafter.engine.search.restricted.key.patterns`` property. The value is a comma-separated list of Java regular expressions with a default value of ``script``:
+
+.. code-block:: properties
+    :caption: *CRAFTER_HOME/bin/apache-tomcat/shared/classes/crafter/engine/extension/server-config.properties*
+    :linenos:
+
+    # Comma-separated list of regex patterns for JSON keys that are not allowed in search requests
+    crafter.engine.search.restricted.key.patterns=script
+
+
+The Site Search API checks the entire JSON payload, including nested objects and arrays, and evaluates object keys.
+If there's a match, it returns a HTTP 400 with a message such as ``Search request must not contain a 'script' key``.
+
+|
+
+|hr|
+
 .. _engine-content-length-headers:
 
 """"""""""""""""""""""

diff --git a/source/release-notes/4-6-0.rst b/source/release-notes/4-6-0.rst
@@ -0,0 +1,53 @@
+.. index:: CrafterCMS version 4.6.0 Release Notes
+
+-----------------------------------
+CrafterCMS Version 4.6.0 and 4.6.0E
+-----------------------------------
+
+Released *September TBD, 2026*
+
+.. important::
+
+    Please see :ref:`Breaking changes <breaking-changes-4-x>` for breaking changes and other
+    things to consider before upgrading
+
+    For instructions on how to update your CrafterCMS install, please see :ref:`upgrading-craftercms`
+
+^^^^^^^^^^^^
+Enhancements
+^^^^^^^^^^^^
+* `Improved publishing <https://github.com/craftersoftware/craftercms/issues/8793>`__
+
+  Publishing soft dependencies are limited to items the current user is allowed to publish. Items the user cannot publish are omitted from the soft dependency list when requesting to publish.
+
+* ``SiteItemService`` now returns items only for URLs that match the configured descriptor paths in ``crafter.engine.site.default.descriptors.allowed.paths``.
+
+  See :ref:`engine-site-allowed-descriptor-paths` for more information.
+
+* The Site Search API now rejects restricted JSON keys in the request body.
+
+  See :ref:`engine-search-restricted-key-patterns` for more information on configuring restricted key patterns.
+
+^^^^^^^^^
+Bug Fixes
+^^^^^^^^^
+* `Fixed issue with Groovy based REST APIs defaulting to XML even when JSON extension is present <https://github.com/craftersoftware/craftercms/issues/9015>`__
+
+  See :ref:`breaking-changes-in-craftercms-4-6-0` for some important changes to Engine REST scripts.
+
+^^^^^^^^^^^^^^^^^^
+Dependency Updates
+^^^^^^^^^^^^^^^^^^
+* Noteworthy dependency updates:
+
+  - Spring Framework to version 7.0.9
+  - Spring Security to version 7.1.1
+  - Spring Boot to version 4.1.1
+  - Mybatis-Spring to version 4.1.0
+
+For a complete list of community tickets, please visit: `GitHub 4.6.0 <https://github.com/orgs/craftersoftware/projects/63/views/1?filterQuery=>`_
+
+For information on upgrading 3.1.x sites, see :ref:`here <compatibility-with-3.1.x>`
+
+|hr|
+
diff --git a/source/release-notes/4-x-breaking-changes.rst b/source/release-notes/4-x-breaking-changes.rst
@@ -1,5 +1,5 @@
 :is-up-to-date: True
-:last-updated: 4.5.1
+:last-updated: 4.6.0
 :orphan:
 
 .. _breaking-changes-4-x:
@@ -23,6 +23,29 @@ before upgrading. Please review the following and apply changes as required:
 
 |hr|
 
+.. _breaking-changes-in-craftercms-4-6-0:
+
+------------------------------------
+Breaking Changes in CrafterCMS 4.6.0
+------------------------------------
+* Groovy, Freemarker, or other Engine code that called ``siteItemService.getSiteItem(url)`` or ``getSiteTree(...)`` for paths outside the allowed descriptor patterns now receives null or an empty tree. To include extra descriptor locations, extend:
+
+  ``crafter.engine.site.default.descriptors.allowed.paths=/site/.*``
+
+  See :ref:`engine-site-allowed-descriptor-paths` for more information.
+
+* Use ``siteItemService.exists(path)`` when you only need to know if a path exists. That check is not limited by the allowed-path patterns.
+
+* Search clients that send a script key (or any key matching ``crafter.engine.search.restricted.key.patterns``) in the JSON body will get 400 Bad Request.
+
+  See :ref:`engine-search-restricted-key-patterns` for more information
+
+* Users without ``Publish`` permission on a related item will no longer see that item in the publish soft-dependency list.
+
+* Engine REST Scripts No Longer Produce XML.
+
+  Clients that request XML via the ``Accept: application/xml`` header or a ``.xml`` URL will receive ``HTTP 406 Not Acceptable``. Update those clients to request JSON (``Accept: application/json`` or a ``.json`` URL) and parse JSON instead of XML.
+
 .. _breaking-changes-in-craftercms-4-5-1:
 
 ------------------------------------

diff --git a/source/release-notes/index.rst b/source/release-notes/index.rst
@@ -1,5 +1,5 @@
 :is-up-to-date: True
-:last-updated: 4.5.2
+:last-updated: 4.6.0
 
 .. meta::
     :description lang=en:
@@ -15,6 +15,7 @@ version release's release notes page :ref:`below <other-release-notes>`
 
 .. note:: CrafterCMS requires Java 21
 
+.. include:: /release-notes/4-6-0.rst
 .. include:: /release-notes/4-5-2.rst
 .. include:: /release-notes/4-5-1.rst
 .. include:: /release-notes/4-5-0.rst

diff --git a/source/support.rst b/source/support.rst
@@ -1,5 +1,5 @@
 :is-up-to-date: True
-:last-updated: 4.5.2
+:last-updated: 4.6.0
 
 .. meta::
     :description lang=en:
@@ -25,9 +25,14 @@ What's Supported?
       - Commercial Support
       - Latest
 
-    * - `4.5 <https://craftercms.com/download>`__
-      - January 23, 2026
+    * - `4.6 <https://craftercms.com/download>`__
+      - September TBD, 2026
+      - :green:`Active`
       - :green:`Active`
+      - 4.6.0 (September TBD, 2026)
+    * - 4.5
+      - January 23, 2026
+      - :maroon:`Ended on September TBD, 2026`
       - :green:`Active`
       - 4.5.2 (August 27, 2026)
     * - 4.4