docs: improve corsOrigins documentation (#5390)

docs/companion.md

@@ -680,14 +680,15 @@ the
 for `postMessage` calls in the context of OAuth.
 
 Setting it to `true` treats any origin as a trusted one, making it easier to
-impersonate your brand. Setting it to `false` disables cross-origin supports,
-use this if you’re serving Companion and Uppy from the same domain name.
+impersonate your brand. Setting it to `false` disables cross-origin support, use
+this if you’re serving Companion and Uppy from the same domain name.
 
 ##### `COMPANION_CLIENT_ORIGINS`
 
-A comma-separated string of origins, or `'true'` (which will be interpreted as
-the boolean value `true`), or `'false'` (which will be interpreted as the
-boolean value `false`).
+Stand-alone alternative to the `corsOrigins` option. A comma-separated string of
+origins, or `'true'` (which will be interpreted as the boolean value `true`), or
+`'false'` (which will be interpreted as the boolean value `false`).
+`COMPANION_CLIENT_ORIGINS_REGEX` will be ignored if this option is used.
 
 ##### `COMPANION_CLIENT_ORIGINS_REGEX`
 
@@ -700,9 +701,8 @@ make sure you’re validating the entirety of the string.
 
 :::
 
-Like COMPANION_CLIENT_ORIGINS, but allows a single regex instead.
-`COMPANION_CLIENT_ORIGINS` will be ignored if this is used. This is a
-standalone-only option.
+Stand-alone alternative to the `corsOrigins` option. Like
+`COMPANION_CLIENT_ORIGINS`, but allows a single regex instead.
 
 #### `chunkSize` `COMPANION_CHUNK_SIZE`
 

docs/guides/migration-guides.md

@@ -6,10 +6,10 @@ These cover all the major Uppy versions and how to migrate to them.
 
 - End-of-Life versions of Node.js are no longer supported (use latest 18.x LTS,
   20.x LTS, or 22.x current).
-- Setting the `corsOrigin` option is now required. You should define the list of
-  origins you expect your app to be served from, otherwise it can be
-  impersonated from a different origin you don’t control. Set it to `true` if
-  you don’t care about impersonating.
+- Setting the `corsOrigin` (`COMPANION_CLIENT_ORIGINS`) option is now required.
+  You should define the list of origins you expect your app to be served from,
+  otherwise it can be impersonated from a different origin you don’t control.
+  Set it to `true` if you don’t care about impersonating.
 - `COMPANION_REDIS_EXPRESS_SESSION_PREFIX` now defaults to `companion-session:`
   (before `sess:`). To revert keep backwards compatibility, set the environment
   variable `COMPANION_REDIS_EXPRESS_SESSION_PREFIX=sess:`.