Webiny 6.4.9 Changelog

For the full list of changes, check out the Webiny 6.4.9 release on GitHub.

Headless CMS

ExportBindParentNameContextfor External Use (#5573)

{/ REVIEW-PENDING @Pavel910 — confirm this entry, then delete this line /}

The BindParentNameContext is now exported from the CMS app, allowing external consumers to access it. Additionally, the Fields grid layout now wraps its children in a BindParentNameContext.Provider, ensuring nested field components receive the correct parent bind name through context when using useBindParentName().

Fixed Bulk Actions Silently Failing for Publish and Move to Folder (#5577)

{/ REVIEW-PENDING @Pavel910 — confirm this entry, then delete this line /}

Bulk Publish and Move to Folder actions were silently completing without actually processing any entries. The issue was caused by entry IDs having their version suffix (#0001) stripped before being passed to the underlying operations. Since the database layer requires the full revision ID to fetch entries, it would skip entries without a version — the bulk action would report success, but nothing was actually published or moved.

This has been fixed. All bulk actions now correctly preserve the full revision ID throughout the processing pipeline.

Fixed "Null" String Appearing in Select and Radio Button Fields (#5588)

{/ REVIEW-PENDING @Pavel910 — confirm this entry, then delete this line /}

When a CMS field had predefined values but none were marked as selected, the select and radio button renderers incorrectly displayed the literal string "null" instead of showing the placeholder. This happened because null was being converted to a string. The field renderers now correctly fall back to undefined when no default value is set.

Fixed Publish and Unpublish Actions on Non-Root Tenants (#5593)

{/ REVIEW-PENDING @brunozoric — confirm this entry, then delete this line /}

Scheduled publish and unpublish actions were failing when triggered on tenants other than the root tenant. The scheduler was not correctly resolving the tenant context, causing operations to target the wrong tenant’s data. This has been fixed — RuntimeTenant now serves as the authority for tenant resolution on all CMS storage operations, ensuring scheduled actions execute in the correct tenant context.

Scheduler Permissions Now Use Application-Specific Access Control (#5593)

{/ REVIEW-PENDING @brunozoric — confirm this entry, then delete this line /}

The standalone scheduler.action permission has been removed. Scheduler access is now gated by each application’s own permissions, resolved per-namespace at runtime. For Headless CMS, this means scheduled entry operations check cms.contentEntry permissions. For Page Builder, they check page publish permissions. This change provides more granular control and aligns scheduler permissions with the rest of the application’s access model.

Website Builder

Fixed Deletion of Non-Empty Folders (#5574)

{/ REVIEW-PENDING @Pavel910 — confirm this entry, then delete this line /}

Deleting a Website Builder page or redirect folder that still contained items would silently succeed, leaving orphaned pages or redirects in the database that became invisible in the UI. Folder deletion now checks for contained pages or redirects before proceeding — if the folder is not empty, the operation is rejected with an error. Audit log entries are also now created when empty WB page and redirect folders are deleted.

Webiny SDK

NewAiModelRegistryAbstraction (#5575)

{/ REVIEW-PENDING @Pavel910 — confirm this entry, then delete this line /}

Model listing has been extracted from the Ai class into a standalone AiModelRegistry abstraction. This makes model listing a decoratable, independently injectable concern. The Ai class now delegates listModels(), listModelsByConnections(), and listModelsByConnection() to the registry. AiModelRegistry is exported from both @webiny/api-core and the webiny package.

Development

Fixed Security Vulnerabilities in Pulumi SDK (#5584)

{/ REVIEW-PENDING @Pavel910 — confirm this entry, then delete this line /}

The decompress package used for extracting Pulumi binaries had known security vulnerabilities (SNYK-JS-DECOMPRESS-17874437 and SNYK-JS-DECOMPRESS-17937347). It has been replaced with adm-zip for Windows and the existing tar package for macOS/Linux, with added path traversal protection during extraction.

Infrastructure

Updated Sharp Lambda Layer to v0.35.3 (#5585)

{/ REVIEW-PENDING @Pavel910 — confirm this entry, then delete this line /}

The Sharp image processing library used by Webiny’s file manager has been updated to v0.35.3. The new Lambda layer has been published to all 17 supported AWS regions and now includes compatibility with Node.js 24.x in addition to Node.js 22.x.

Admin

Fixed File Picker Preview Layout in Narrow Containers (#5587)

{/ REVIEW-PENDING @adrians5j — confirm this entry, then delete this line /}

In narrow containers like the Website Builder style sidebar (~200px wide), the file picker preview was unreadable — file names were truncated to roughly 40px of space, rendering as tid... or 65....

The preview now uses container queries to adapt its layout based on available width:

• Narrow containers (< 280px): The file name and metadata wrap onto their own full-width lines below the thumbnail and action buttons, giving them the entire row width.
• Wide containers (≥ 280px): The single-line layout remains unchanged.

This fix applies to both FilePicker and MultiFilePicker components.