Add upgrade note for allowed outbound destinations

docs/guides/administration/debugging-notifications.md

@@ -14,9 +14,10 @@ through how to narrow it down.
   [Filter expressions](../../reference/notifications/filter-expressions.md).
 - **Publisher destination is unreachable.** Network outage, firewall,
   proxy misconfiguration, or expired webhook URL.
-- **Local destination blocked.** The destination resolves to a local or
-  loopback address and the corresponding `allow-local-connections` flag
-  is `false`.
+- **Destination denied.**
+  [`dt.outbound.allowed-destinations`](../../reference/configuration/properties.md#dtoutboundallowed-destinations)
+  does not allow the destination. Before v5.2.0, the email and Kafka publishers used their own
+  `allow-local-connections` properties instead.
 - **Custom template fails to render.** A syntax error or missing
   variable causes the publisher to stop before sending.
 

docs/guides/upgrading/v5.2.0.md

@@ -35,6 +35,16 @@
     Earlier versions added a `Bearer` prefix. If your registry expects the prefix, add it to the token you configured.
     Repositories with a username still use basic authentication.
 
+* **The API server restricts outbound connections**. See [`dt.outbound.allowed-destinations`][allowed-destinations].
+  If an integration connects to `localhost`, for example a Trivy sidecar, add `loopback`. The restrictions apply
+  to notifications, data sources, package repositories, vulnerability analyzers, and integrations like DefectDojo.
+
+* **The `allow-local-connections` properties no longer exist**. This affects the email and Kafka notification publishers,
+  the OSS Index vulnerability analyzer, and the NVD and JVN vulnerability data sources.
+  The API server refuses to start if your configuration still sets any of them to prevent silent misconfiguration.
+  [`dt.outbound.allowed-destinations`][allowed-destinations] replaces them.
+
 [access-control-svc]: ../../concepts/access-control.md#service-accounts
+[allowed-destinations]: ../../reference/configuration/properties.md#dtoutboundallowed-destinations
 [cargo-alt-reg]: https://doc.rust-lang.org/cargo/reference/registries.html#using-an-alternate-registry
 [cargo-idx]: https://doc.rust-lang.org/cargo/reference/registry-index.html#sparse-protocol

docs/reference/notifications/publishers.md

@@ -1,16 +1,18 @@
 # Publishers
 
-## Restricting local connections
-
-For destinations that accept arbitrary endpoints, Dependency-Track
-blocks connections to local and loopback addresses by default to prevent
-server-side request forgery. Operators can override this per publisher
-via
-[`dt.notification-publisher.email.allow-local-connections`](../configuration/properties.md#dtnotification-publisheremailallow-local-connections)
-and
-[`dt.notification-publisher.kafka.allow-local-connections`](../configuration/properties.md#dtnotification-publisherkafkaallow-local-connections).
-Leave both `false` outside of development and trusted single-host
-deployments.
+## Restricting destinations
+
+Dependency-Track only connects to publisher destinations that
+[`dt.outbound.allowed-destinations`](../configuration/properties.md#dtoutboundallowed-destinations) allows.
+
+!!! note "Changed in v5.2.0"
+    Before v5.2.0, the email and Kafka publishers used their own properties.
+    To allow local connections, set:
+
+    * `dt.notification-publisher.email.allow-local-connections=true`
+    * `dt.notification-publisher.kafka.allow-local-connections=true`
+
+    See [Upgrading to v5.2.0](../../guides/upgrading/v5.2.0.md).
 
 ## Console