From 3c90496257dbec0be675b43df02250abfae78f24 Mon Sep 17 00:00:00 2001 From: webiny-bot Date: Mon, 17 Aug 2026 06:22:58 +0000 Subject: [PATCH 1/9] chore: generate changelog for 6.4.9 --- docs/release-notes/6.4.9/upgrade-guide.mdx | 61 ++++++++++++++++++++++ 1 file changed, 61 insertions(+) create mode 100644 docs/release-notes/6.4.9/upgrade-guide.mdx diff --git a/docs/release-notes/6.4.9/upgrade-guide.mdx b/docs/release-notes/6.4.9/upgrade-guide.mdx new file mode 100644 index 000000000..3a40986dc --- /dev/null +++ b/docs/release-notes/6.4.9/upgrade-guide.mdx @@ -0,0 +1,61 @@ +--- +id: bpegpurb +title: Upgrade from 6.4.x to 6.4.9 +description: Learn how to upgrade Webiny from 6.4.x to 6.4.9. +--- + +import { Alert } from "@/components/Alert"; +import { AdditionalNotes } from "@/components/upgrade/AdditionalNotes"; + + + +- how to upgrade Webiny from 6.4.x to 6.4.9 + + + + + +Make sure to check out the [6.4.9 changelog](./changelog) to get familiar with the changes introduced in this release. + + + +## Step-by-Step Guide + +### 1. Upgrade Webiny Packages + +Upgrade all Webiny packages by running the following command: + +```bash +yarn webiny upgrade 6.4.9 --debug +``` + +Note that the command above will run upgrades for all available versions of Webiny up to 6.4.9. If there are upgrades for 6.4.1, 6.4.5, they will be ran. + +You can omit the version to upgrade to the latest available: + +```bash +yarn webiny upgrade --debug +``` + +Once the upgrade has finished, running the `yarn webiny --version` command in your terminal should return **6.4.9**. + + + +If the above command fails or is not available in your setup, you can run the upgrade script directly via `npx`: + +```bash +npx https://github.com/webiny/webiny-upgrades-v6 6.4.9 --debug +``` + + + +### 2. Deploy Your Project + +Proceed by redeploying your Webiny project: + +```bash +# Execute in your project root. +yarn webiny deploy --env {environment} +``` + + From 0ce817a836ad8aa0f2b32983b24889882485dc5d Mon Sep 17 00:00:00 2001 From: webiny-bot Date: Mon, 17 Aug 2026 06:46:37 +0000 Subject: [PATCH 2/9] chore: regenerate release notes for 6.4.9 --- docs/release-notes/6.4.9/changelog.ai.txt | 8 ++++++++ docs/release-notes/6.4.9/changelog.mdx | 17 +++++++++++++++++ docs/release-notes/6.4.9/upgrade-guide.mdx | 2 +- 3 files changed, 26 insertions(+), 1 deletion(-) create mode 100644 docs/release-notes/6.4.9/changelog.ai.txt create mode 100644 docs/release-notes/6.4.9/changelog.mdx diff --git a/docs/release-notes/6.4.9/changelog.ai.txt b/docs/release-notes/6.4.9/changelog.ai.txt new file mode 100644 index 000000000..b4b9371ee --- /dev/null +++ b/docs/release-notes/6.4.9/changelog.ai.txt @@ -0,0 +1,8 @@ +AI Context: 6.4.9 Changelog (changelog.mdx) + +This file tracks manual edits made after the generation script ran. +The script reads the "Skipped PRs" section to avoid re-adding removed entries. + +## Skipped PRs + +## Manual Rewrites diff --git a/docs/release-notes/6.4.9/changelog.mdx b/docs/release-notes/6.4.9/changelog.mdx new file mode 100644 index 000000000..187434920 --- /dev/null +++ b/docs/release-notes/6.4.9/changelog.mdx @@ -0,0 +1,17 @@ +--- +id: n9opfalt +title: Webiny 6.4.9 Changelog +description: See what's new in Webiny version 6.4.9 +--- + +import { GithubRelease } from "@/components/GithubRelease"; +import { Alert } from "@/components/Alert"; + + + +## Headless CMS + +### Export `BindParentNameContext` for External Use ([#5573](https://github.com/webiny/webiny-js/pull/5573)) +{/* REVIEW-PENDING @Pavel910 — confirm this entry, then delete this line */} + +The `BindParentNameContext` is now exported from the CMS app, allowing external consumers to access it. Additionally, the `Fields` grid layout now wraps its children in a `BindParentNameContext.Provider`, ensuring nested field components receive the correct parent bind name through context when using `useBindParentName()`. diff --git a/docs/release-notes/6.4.9/upgrade-guide.mdx b/docs/release-notes/6.4.9/upgrade-guide.mdx index 3a40986dc..4229ce571 100644 --- a/docs/release-notes/6.4.9/upgrade-guide.mdx +++ b/docs/release-notes/6.4.9/upgrade-guide.mdx @@ -1,5 +1,5 @@ --- -id: bpegpurb +id: hegjc7du title: Upgrade from 6.4.x to 6.4.9 description: Learn how to upgrade Webiny from 6.4.x to 6.4.9. --- From 33d8cdf16d416bea5306302271334eda800e68c6 Mon Sep 17 00:00:00 2001 From: webiny-bot Date: Tue, 18 Aug 2026 11:49:41 +0000 Subject: [PATCH 3/9] chore: regenerate release notes for 6.4.9 --- docs/release-notes/6.4.9/changelog.mdx | 21 +++++++++++++++++++++ docs/release-notes/6.4.9/upgrade-guide.mdx | 2 +- 2 files changed, 22 insertions(+), 1 deletion(-) diff --git a/docs/release-notes/6.4.9/changelog.mdx b/docs/release-notes/6.4.9/changelog.mdx index 187434920..467e81b6d 100644 --- a/docs/release-notes/6.4.9/changelog.mdx +++ b/docs/release-notes/6.4.9/changelog.mdx @@ -15,3 +15,24 @@ import { Alert } from "@/components/Alert"; {/* REVIEW-PENDING @Pavel910 — confirm this entry, then delete this line */} The `BindParentNameContext` is now exported from the CMS app, allowing external consumers to access it. Additionally, the `Fields` grid layout now wraps its children in a `BindParentNameContext.Provider`, ensuring nested field components receive the correct parent bind name through context when using `useBindParentName()`. + +## Website Builder + +### Fixed Deletion of Non-Empty Folders ([#5574](https://github.com/webiny/webiny-js/pull/5574)) +{/* REVIEW-PENDING @Pavel910 — confirm this entry, then delete this line */} + +Deleting a Website Builder page or redirect folder that still contained items would silently succeed, leaving orphaned pages or redirects in the database that became invisible in the UI. Folder deletion now checks for contained pages or redirects before proceeding — if the folder is not empty, the operation is rejected with an error. Audit log entries are also now created when empty WB page and redirect folders are deleted. + +## Webiny SDK + +### New `AiModelRegistry` Abstraction ([#5575](https://github.com/webiny/webiny-js/pull/5575)) +{/* REVIEW-PENDING @Pavel910 — confirm this entry, then delete this line */} + +Model listing has been extracted from the `Ai` class into a standalone `AiModelRegistry` abstraction. This makes model listing a decoratable, independently injectable concern. The `Ai` class now delegates `listModels()`, `listModelsByConnections()`, and `listModelsByConnection()` to the registry. `AiModelRegistry` is exported from both `@webiny/api-core` and the `webiny` package. + +```typescript +import { AiModelRegistry } from "webiny/api"; + +// The registry can be injected and decorated independently +const models = await aiModelRegistry.listModels(); +``` diff --git a/docs/release-notes/6.4.9/upgrade-guide.mdx b/docs/release-notes/6.4.9/upgrade-guide.mdx index 4229ce571..390efb91e 100644 --- a/docs/release-notes/6.4.9/upgrade-guide.mdx +++ b/docs/release-notes/6.4.9/upgrade-guide.mdx @@ -1,5 +1,5 @@ --- -id: hegjc7du +id: a0mjd1z4 title: Upgrade from 6.4.x to 6.4.9 description: Learn how to upgrade Webiny from 6.4.x to 6.4.9. --- From 20aa9a59461d37a17ff9c345c4adbea65dadba85 Mon Sep 17 00:00:00 2001 From: webiny-bot Date: Tue, 18 Aug 2026 20:58:38 +0000 Subject: [PATCH 4/9] chore: regenerate release notes for 6.4.9 --- docs/release-notes/6.4.9/changelog.mdx | 7 +++++++ docs/release-notes/6.4.9/upgrade-guide.mdx | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/docs/release-notes/6.4.9/changelog.mdx b/docs/release-notes/6.4.9/changelog.mdx index 467e81b6d..40d79f8e5 100644 --- a/docs/release-notes/6.4.9/changelog.mdx +++ b/docs/release-notes/6.4.9/changelog.mdx @@ -16,6 +16,13 @@ import { Alert } from "@/components/Alert"; The `BindParentNameContext` is now exported from the CMS app, allowing external consumers to access it. Additionally, the `Fields` grid layout now wraps its children in a `BindParentNameContext.Provider`, ensuring nested field components receive the correct parent bind name through context when using `useBindParentName()`. +### Fixed Bulk Actions Silently Failing for Publish and Move to Folder ([#5577](https://github.com/webiny/webiny-js/pull/5577)) +{/* REVIEW-PENDING @Pavel910 — confirm this entry, then delete this line */} + +Bulk Publish and Move to Folder actions were silently completing without actually processing any entries. The issue was caused by entry IDs having their version suffix (`#0001`) stripped before being passed to the underlying operations. Since the database layer requires the full revision ID to fetch entries, it would skip entries without a version — the bulk action would report success, but nothing was actually published or moved. + +This has been fixed. All bulk actions now correctly preserve the full revision ID throughout the processing pipeline. + ## Website Builder ### Fixed Deletion of Non-Empty Folders ([#5574](https://github.com/webiny/webiny-js/pull/5574)) diff --git a/docs/release-notes/6.4.9/upgrade-guide.mdx b/docs/release-notes/6.4.9/upgrade-guide.mdx index 390efb91e..c3d8dfdcf 100644 --- a/docs/release-notes/6.4.9/upgrade-guide.mdx +++ b/docs/release-notes/6.4.9/upgrade-guide.mdx @@ -1,5 +1,5 @@ --- -id: a0mjd1z4 +id: 8shke2xs title: Upgrade from 6.4.x to 6.4.9 description: Learn how to upgrade Webiny from 6.4.x to 6.4.9. --- From fe47f72fb716e17f16d9908d233d38fccd6b230c Mon Sep 17 00:00:00 2001 From: webiny-bot Date: Thu, 20 Aug 2026 12:41:52 +0000 Subject: [PATCH 5/9] chore: regenerate release notes for 6.4.9 --- docs/release-notes/6.4.9/changelog.mdx | 7 +++++++ docs/release-notes/6.4.9/upgrade-guide.mdx | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/docs/release-notes/6.4.9/changelog.mdx b/docs/release-notes/6.4.9/changelog.mdx index 40d79f8e5..95928d430 100644 --- a/docs/release-notes/6.4.9/changelog.mdx +++ b/docs/release-notes/6.4.9/changelog.mdx @@ -43,3 +43,10 @@ import { AiModelRegistry } from "webiny/api"; // The registry can be injected and decorated independently const models = await aiModelRegistry.listModels(); ``` + +## Development + +### Fixed Security Vulnerabilities in Pulumi SDK ([#5584](https://github.com/webiny/webiny-js/pull/5584)) +{/* REVIEW-PENDING @Pavel910 — confirm this entry, then delete this line */} + +The `decompress` package used for extracting Pulumi binaries had known security vulnerabilities (SNYK-JS-DECOMPRESS-17874437 and SNYK-JS-DECOMPRESS-17937347). It has been replaced with `adm-zip` for Windows and the existing `tar` package for macOS/Linux, with added path traversal protection during extraction. diff --git a/docs/release-notes/6.4.9/upgrade-guide.mdx b/docs/release-notes/6.4.9/upgrade-guide.mdx index c3d8dfdcf..2d6253790 100644 --- a/docs/release-notes/6.4.9/upgrade-guide.mdx +++ b/docs/release-notes/6.4.9/upgrade-guide.mdx @@ -1,5 +1,5 @@ --- -id: 8shke2xs +id: kqiuxhxy title: Upgrade from 6.4.x to 6.4.9 description: Learn how to upgrade Webiny from 6.4.x to 6.4.9. --- From 7bde1cafbf972110e9cd17443b363b77a1631387 Mon Sep 17 00:00:00 2001 From: webiny-bot Date: Thu, 20 Aug 2026 13:29:07 +0000 Subject: [PATCH 6/9] chore: regenerate release notes for 6.4.9 --- docs/release-notes/6.4.9/changelog.mdx | 7 +++++++ docs/release-notes/6.4.9/upgrade-guide.mdx | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/docs/release-notes/6.4.9/changelog.mdx b/docs/release-notes/6.4.9/changelog.mdx index 95928d430..9edd1104f 100644 --- a/docs/release-notes/6.4.9/changelog.mdx +++ b/docs/release-notes/6.4.9/changelog.mdx @@ -50,3 +50,10 @@ const models = await aiModelRegistry.listModels(); {/* REVIEW-PENDING @Pavel910 — confirm this entry, then delete this line */} The `decompress` package used for extracting Pulumi binaries had known security vulnerabilities (SNYK-JS-DECOMPRESS-17874437 and SNYK-JS-DECOMPRESS-17937347). It has been replaced with `adm-zip` for Windows and the existing `tar` package for macOS/Linux, with added path traversal protection during extraction. + +## Infrastructure + +### Updated Sharp Lambda Layer to v0.35.3 ([#5585](https://github.com/webiny/webiny-js/pull/5585)) +{/* REVIEW-PENDING @Pavel910 — confirm this entry, then delete this line */} + +The Sharp image processing library used by Webiny's file manager has been updated to v0.35.3. The new Lambda layer has been published to all 17 supported AWS regions and now includes compatibility with Node.js 24.x in addition to Node.js 22.x. diff --git a/docs/release-notes/6.4.9/upgrade-guide.mdx b/docs/release-notes/6.4.9/upgrade-guide.mdx index 2d6253790..e87bb3fda 100644 --- a/docs/release-notes/6.4.9/upgrade-guide.mdx +++ b/docs/release-notes/6.4.9/upgrade-guide.mdx @@ -1,5 +1,5 @@ --- -id: kqiuxhxy +id: ydk1wb30 title: Upgrade from 6.4.x to 6.4.9 description: Learn how to upgrade Webiny from 6.4.x to 6.4.9. --- From 60ab9d65c84b9f034cfd7246734239944a1eb687 Mon Sep 17 00:00:00 2001 From: webiny-bot Date: Fri, 21 Aug 2026 10:28:39 +0000 Subject: [PATCH 7/9] chore: regenerate release notes for 6.4.9 --- docs/release-notes/6.4.9/changelog.mdx | 5 +++++ docs/release-notes/6.4.9/upgrade-guide.mdx | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/docs/release-notes/6.4.9/changelog.mdx b/docs/release-notes/6.4.9/changelog.mdx index 9edd1104f..96a9c4cf1 100644 --- a/docs/release-notes/6.4.9/changelog.mdx +++ b/docs/release-notes/6.4.9/changelog.mdx @@ -23,6 +23,11 @@ Bulk Publish and Move to Folder actions were silently completing without actuall This has been fixed. All bulk actions now correctly preserve the full revision ID throughout the processing pipeline. +### Fixed "null" String Appearing in Select and Radio Button Fields ([#5588](https://github.com/webiny/webiny-js/pull/5588)) +{/* REVIEW-PENDING @Pavel910 — confirm this entry, then delete this line */} + +When a CMS field had predefined values but none were marked as selected, the select and radio button renderers incorrectly displayed the literal string `"null"` instead of showing the placeholder. This happened because `null` was being converted to a string. The field renderers now correctly fall back to `undefined` when no default value is set. + ## Website Builder ### Fixed Deletion of Non-Empty Folders ([#5574](https://github.com/webiny/webiny-js/pull/5574)) diff --git a/docs/release-notes/6.4.9/upgrade-guide.mdx b/docs/release-notes/6.4.9/upgrade-guide.mdx index e87bb3fda..c2679492f 100644 --- a/docs/release-notes/6.4.9/upgrade-guide.mdx +++ b/docs/release-notes/6.4.9/upgrade-guide.mdx @@ -1,5 +1,5 @@ --- -id: ydk1wb30 +id: lhq5mt60 title: Upgrade from 6.4.x to 6.4.9 description: Learn how to upgrade Webiny from 6.4.x to 6.4.9. --- From 1fa0bcaac9e79552624969dc17d2783519648ce6 Mon Sep 17 00:00:00 2001 From: webiny-bot Date: Fri, 21 Aug 2026 13:17:35 +0000 Subject: [PATCH 8/9] chore: regenerate release notes for 6.4.9 --- docs/release-notes/6.4.9/changelog.mdx | 14 ++++++++++++++ docs/release-notes/6.4.9/upgrade-guide.mdx | 2 +- 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/docs/release-notes/6.4.9/changelog.mdx b/docs/release-notes/6.4.9/changelog.mdx index 96a9c4cf1..d0834d4d7 100644 --- a/docs/release-notes/6.4.9/changelog.mdx +++ b/docs/release-notes/6.4.9/changelog.mdx @@ -62,3 +62,17 @@ The `decompress` package used for extracting Pulumi binaries had known security {/* REVIEW-PENDING @Pavel910 — confirm this entry, then delete this line */} The Sharp image processing library used by Webiny's file manager has been updated to v0.35.3. The new Lambda layer has been published to all 17 supported AWS regions and now includes compatibility with Node.js 24.x in addition to Node.js 22.x. + +## Admin + +### Fixed File Picker Preview Layout in Narrow Containers ([#5587](https://github.com/webiny/webiny-js/pull/5587)) +{/* REVIEW-PENDING @adrians5j — confirm this entry, then delete this line */} + +In narrow containers like the Website Builder style sidebar (~200px wide), the file picker preview was unreadable — file names were truncated to roughly 40px of space, rendering as `tid...` or `65...`. + +The preview now uses container queries to adapt its layout based on available width: + +- **Narrow containers (< 280px):** The file name and metadata wrap onto their own full-width lines below the thumbnail and action buttons, giving them the entire row width. +- **Wide containers (≥ 280px):** The single-line layout remains unchanged. + +This fix applies to both `FilePicker` and `MultiFilePicker` components. diff --git a/docs/release-notes/6.4.9/upgrade-guide.mdx b/docs/release-notes/6.4.9/upgrade-guide.mdx index c2679492f..cc13d27a8 100644 --- a/docs/release-notes/6.4.9/upgrade-guide.mdx +++ b/docs/release-notes/6.4.9/upgrade-guide.mdx @@ -1,5 +1,5 @@ --- -id: lhq5mt60 +id: 1g4h4dtd title: Upgrade from 6.4.x to 6.4.9 description: Learn how to upgrade Webiny from 6.4.x to 6.4.9. --- From 94a860bdc17ec288e612a4d1647014eb579d2792 Mon Sep 17 00:00:00 2001 From: webiny-bot Date: Tue, 25 Aug 2026 13:29:05 +0000 Subject: [PATCH 9/9] chore: regenerate release notes for 6.4.9 --- docs/release-notes/6.4.9/changelog.mdx | 10 ++++++++++ docs/release-notes/6.4.9/upgrade-guide.mdx | 2 +- 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/docs/release-notes/6.4.9/changelog.mdx b/docs/release-notes/6.4.9/changelog.mdx index d0834d4d7..15d2a200f 100644 --- a/docs/release-notes/6.4.9/changelog.mdx +++ b/docs/release-notes/6.4.9/changelog.mdx @@ -28,6 +28,16 @@ This has been fixed. All bulk actions now correctly preserve the full revision I When a CMS field had predefined values but none were marked as selected, the select and radio button renderers incorrectly displayed the literal string `"null"` instead of showing the placeholder. This happened because `null` was being converted to a string. The field renderers now correctly fall back to `undefined` when no default value is set. +### Fixed Publish and Unpublish Actions on Non-Root Tenants ([#5593](https://github.com/webiny/webiny-js/pull/5593)) +{/* REVIEW-PENDING @brunozoric — confirm this entry, then delete this line */} + +Scheduled publish and unpublish actions were failing when triggered on tenants other than the root tenant. The scheduler was not correctly resolving the tenant context, causing operations to target the wrong tenant's data. This has been fixed — `RuntimeTenant` now serves as the authority for tenant resolution on all CMS storage operations, ensuring scheduled actions execute in the correct tenant context. + +### Scheduler Permissions Now Use Application-Specific Access Control ([#5593](https://github.com/webiny/webiny-js/pull/5593)) +{/* REVIEW-PENDING @brunozoric — confirm this entry, then delete this line */} + +The standalone `scheduler.action` permission has been removed. Scheduler access is now gated by each application's own permissions, resolved per-namespace at runtime. For Headless CMS, this means scheduled entry operations check `cms.contentEntry` permissions. For Page Builder, they check page publish permissions. This change provides more granular control and aligns scheduler permissions with the rest of the application's access model. + ## Website Builder ### Fixed Deletion of Non-Empty Folders ([#5574](https://github.com/webiny/webiny-js/pull/5574)) diff --git a/docs/release-notes/6.4.9/upgrade-guide.mdx b/docs/release-notes/6.4.9/upgrade-guide.mdx index cc13d27a8..e25dab8d2 100644 --- a/docs/release-notes/6.4.9/upgrade-guide.mdx +++ b/docs/release-notes/6.4.9/upgrade-guide.mdx @@ -1,5 +1,5 @@ --- -id: 1g4h4dtd +id: kwd4fy2o title: Upgrade from 6.4.x to 6.4.9 description: Learn how to upgrade Webiny from 6.4.x to 6.4.9. ---