add migration guide

docs/guides/migration-guides.md

@@ -2,6 +2,58 @@
 
 These cover all the major Uppy versions and how to migrate to them.
 
+## Migrate from Uppy 3.x to 4.x
+
+### Companion
+
+- Dropped support for Node.js 16 and older.
+- `COMPANION_REDIS_EXPRESS_SESSION_PREFIX` now defaults to `companion-session:`
+  (before `sess:`). To revert keep backwards compatibility, set the environment
+  variable `COMPANION_REDIS_EXPRESS_SESSION_PREFIX=sess:`.
+- The Url endpoint (used by the Url/Link plugin) is now turned off by default
+  and must be explicitly enabled with `COMPANION_ENABLE_URL_ENDPOINT=true` or
+  `enableUrlEndpoint: true`.
+- Custom provider breaking changes. If you have not implemented a custom
+  provider, you should not be affected.
+  - `static getExtraConfig` property has been renamed to `getExtraGrantConfig`.
+  - `static authProvider` property has been renamed to `oauthProvider`. Also
+    internal functions have been renamed accordingly.
+    https://github.com/transloadit/uppy/pull/5198/commits/10d93b52f7a93b58f0e86491e7f3159865c30d81
+- Endpoint `GET /s3/params` now returns `{ method: "POST" }` instead of
+  `{ method: "post" }`. This will not affect most people.
+  https://github.com/transloadit/uppy/pull/5198/commits/d1b5d01c1c85c4a4cdfdebd26e4b4ec8c8526617
+- The Companion [`error` event](https://uppy.io/docs/companion/#events) now no
+  longer includes `extraData` inside the `payload.error` property. `extraData`
+  is (and was also before) included in the `payload`. See
+  https://github.com/transloadit/uppy/pull/5198/commits/1726053fbc88f547a8443edb5e9840094b55983f.
+  If you use Companion stand-alone this shouldn't affect you.
+- `metadata` no will now throw an error if a Symbol is passed. This most likely
+  won't affect anyone.
+  https://github.com/transloadit/uppy/pull/5198/commits/217cba4747d9740c3a185b7ea0dc1a41a9e5edb2
+- `access-control-allow-headers` is no longer included in
+  `Access-Control-Expose-Headers`, and `uppy-versions` is no longer an allowed
+  header. We are not aware of any issues this might cause.
+- Internal refactoring (probably won't affect you)
+  - `getProtectedGot` parameter `blockLocalIPs` changed to `allowLocalIPs`
+    (inverted boolean).
+  - `getURLMeta` 2nd (boolean) argument inverted.
+  - `getProtectedHttpAgent` parameter `blockLocalIPs` changed to `allowLocalIPs`
+    (inverted boolean).
+  - `downloadURL` 2nd (boolean) argument inverted.
+
+### `@uppy/companion-client`
+
+- `supportsRefreshToken` now defaults to `false` instead of `true`. If you have
+  implemented a custom provider, this might affect you.
+- `Socket` class is no longer in use and has been removed. Unless you used this
+  class you don't need to do anything.
+- Remove deprecated options `serverUrl` and `serverPattern` (they were merely
+  defined in Typescript, not in use).
+- `RequestClient` methods `get`, `post`, `delete` no longer accepts a boolean as
+  the third argument. Instead, pass `{ skipPostResponse: true | false }`. This
+  won't affect you unless you've been using `RequestClient`.
+  https://github.com/transloadit/uppy/pull/5198/commits/80a0bbc1ff87450aae54ee3ab10924536754036a
+
 ## Migrate from Robodog to Uppy plugins
 
 Uppy is flexible and extensible through plugins. But the integration code could