Release 6.4.9

docs/release-notes/6.4.9/changelog.ai.txt

@@ -0,0 +1,8 @@
+AI Context: 6.4.9 Changelog (changelog.mdx)
+
+This file tracks manual edits made after the generation script ran.
+The script reads the "Skipped PRs" section to avoid re-adding removed entries.
+
+## Skipped PRs
+
+## Manual Rewrites

docs/release-notes/6.4.9/changelog.mdx

@@ -0,0 +1,88 @@
+---
+id: n9opfalt
+title: Webiny 6.4.9 Changelog
+description: See what's new in Webiny version 6.4.9
+---
+
+import { GithubRelease } from "@/components/GithubRelease";
+import { Alert } from "@/components/Alert";
+
+<GithubRelease version={"6.4.9"} />
+
+## Headless CMS
+
+### Export `BindParentNameContext` for External Use ([#5573](https://github.com/webiny/webiny-js/pull/5573))
+{/* REVIEW-PENDING @Pavel910 — confirm this entry, then delete this line */}
+
+The `BindParentNameContext` is now exported from the CMS app, allowing external consumers to access it. Additionally, the `Fields` grid layout now wraps its children in a `BindParentNameContext.Provider`, ensuring nested field components receive the correct parent bind name through context when using `useBindParentName()`.
+
+### Fixed Bulk Actions Silently Failing for Publish and Move to Folder ([#5577](https://github.com/webiny/webiny-js/pull/5577))
+{/* REVIEW-PENDING @Pavel910 — confirm this entry, then delete this line */}
+
+Bulk Publish and Move to Folder actions were silently completing without actually processing any entries. The issue was caused by entry IDs having their version suffix (`#0001`) stripped before being passed to the underlying operations. Since the database layer requires the full revision ID to fetch entries, it would skip entries without a version — the bulk action would report success, but nothing was actually published or moved.
+
+This has been fixed. All bulk actions now correctly preserve the full revision ID throughout the processing pipeline.
+
+### Fixed "null" String Appearing in Select and Radio Button Fields ([#5588](https://github.com/webiny/webiny-js/pull/5588))
+{/* REVIEW-PENDING @Pavel910 — confirm this entry, then delete this line */}
+
+When a CMS field had predefined values but none were marked as selected, the select and radio button renderers incorrectly displayed the literal string `"null"` instead of showing the placeholder. This happened because `null` was being converted to a string. The field renderers now correctly fall back to `undefined` when no default value is set.
+
+### Fixed Publish and Unpublish Actions on Non-Root Tenants ([#5593](https://github.com/webiny/webiny-js/pull/5593))
+{/* REVIEW-PENDING @brunozoric — confirm this entry, then delete this line */}
+
+Scheduled publish and unpublish actions were failing when triggered on tenants other than the root tenant. The scheduler was not correctly resolving the tenant context, causing operations to target the wrong tenant's data. This has been fixed — `RuntimeTenant` now serves as the authority for tenant resolution on all CMS storage operations, ensuring scheduled actions execute in the correct tenant context.
+
+### Scheduler Permissions Now Use Application-Specific Access Control ([#5593](https://github.com/webiny/webiny-js/pull/5593))
+{/* REVIEW-PENDING @brunozoric — confirm this entry, then delete this line */}
+
+The standalone `scheduler.action` permission has been removed. Scheduler access is now gated by each application's own permissions, resolved per-namespace at runtime. For Headless CMS, this means scheduled entry operations check `cms.contentEntry` permissions. For Page Builder, they check page publish permissions. This change provides more granular control and aligns scheduler permissions with the rest of the application's access model.
+
+## Website Builder
+
+### Fixed Deletion of Non-Empty Folders ([#5574](https://github.com/webiny/webiny-js/pull/5574))
+{/* REVIEW-PENDING @Pavel910 — confirm this entry, then delete this line */}
+
+Deleting a Website Builder page or redirect folder that still contained items would silently succeed, leaving orphaned pages or redirects in the database that became invisible in the UI. Folder deletion now checks for contained pages or redirects before proceeding — if the folder is not empty, the operation is rejected with an error. Audit log entries are also now created when empty WB page and redirect folders are deleted.
+
+## Webiny SDK
+
+### New `AiModelRegistry` Abstraction ([#5575](https://github.com/webiny/webiny-js/pull/5575))
+{/* REVIEW-PENDING @Pavel910 — confirm this entry, then delete this line */}
+
+Model listing has been extracted from the `Ai` class into a standalone `AiModelRegistry` abstraction. This makes model listing a decoratable, independently injectable concern. The `Ai` class now delegates `listModels()`, `listModelsByConnections()`, and `listModelsByConnection()` to the registry. `AiModelRegistry` is exported from both `@webiny/api-core` and the `webiny` package.
+
+```typescript
+import { AiModelRegistry } from "webiny/api";
+
+// The registry can be injected and decorated independently
+const models = await aiModelRegistry.listModels();
+```
+
+## Development
+
+### Fixed Security Vulnerabilities in Pulumi SDK ([#5584](https://github.com/webiny/webiny-js/pull/5584))
+{/* REVIEW-PENDING @Pavel910 — confirm this entry, then delete this line */}
+
+The `decompress` package used for extracting Pulumi binaries had known security vulnerabilities (SNYK-JS-DECOMPRESS-17874437 and SNYK-JS-DECOMPRESS-17937347). It has been replaced with `adm-zip` for Windows and the existing `tar` package for macOS/Linux, with added path traversal protection during extraction.
+
+## Infrastructure
+
+### Updated Sharp Lambda Layer to v0.35.3 ([#5585](https://github.com/webiny/webiny-js/pull/5585))
+{/* REVIEW-PENDING @Pavel910 — confirm this entry, then delete this line */}
+
+The Sharp image processing library used by Webiny's file manager has been updated to v0.35.3. The new Lambda layer has been published to all 17 supported AWS regions and now includes compatibility with Node.js 24.x in addition to Node.js 22.x.
+
+## Admin
+
+### Fixed File Picker Preview Layout in Narrow Containers ([#5587](https://github.com/webiny/webiny-js/pull/5587))
+{/* REVIEW-PENDING @adrians5j — confirm this entry, then delete this line */}
+
+In narrow containers like the Website Builder style sidebar (~200px wide), the file picker preview was unreadable — file names were truncated to roughly 40px of space, rendering as `tid...` or `65...`.
+
+The preview now uses container queries to adapt its layout based on available width:
+
+- **Narrow containers (< 280px):** The file name and metadata wrap onto their own full-width lines below the thumbnail and action buttons, giving them the entire row width.
+- **Wide containers (≥ 280px):** The single-line layout remains unchanged.
+
+This fix applies to both `FilePicker` and `MultiFilePicker` components.

docs/release-notes/6.4.9/upgrade-guide.mdx

@@ -0,0 +1,61 @@
+---
+id: kwd4fy2o
+title: Upgrade from 6.4.x to 6.4.9
+description: Learn how to upgrade Webiny from 6.4.x to 6.4.9.
+---
+
+import { Alert } from "@/components/Alert";
+import { AdditionalNotes } from "@/components/upgrade/AdditionalNotes";
+
+<Alert type="success" title="What you'll learn">
+
+- how to upgrade Webiny from 6.4.x to 6.4.9
+
+</Alert>
+
+<Alert type="info">
+
+Make sure to check out the [6.4.9 changelog](./changelog) to get familiar with the changes introduced in this release.
+
+</Alert>
+
+## Step-by-Step Guide
+
+### 1. Upgrade Webiny Packages
+
+Upgrade all Webiny packages by running the following command:
+
+```bash
+yarn webiny upgrade 6.4.9 --debug
+```
+
+Note that the command above will run upgrades for all available versions of Webiny up to 6.4.9. If there are upgrades for 6.4.1, 6.4.5, they will be ran.
+
+You can omit the version to upgrade to the latest available:
+
+```bash
+yarn webiny upgrade --debug
+```
+
+Once the upgrade has finished, running the `yarn webiny --version` command in your terminal should return **6.4.9**.
+
+<Alert type="info">
+
+If the above command fails or is not available in your setup, you can run the upgrade script directly via `npx`:
+
+```bash
+npx https://github.com/webiny/webiny-upgrades-v6 6.4.9 --debug
+```
+
+</Alert>
+
+### 2. Deploy Your Project
+
+Proceed by redeploying your Webiny project:
+
+```bash
+# Execute in your project root.
+yarn webiny deploy --env {environment}
+```
+
+<AdditionalNotes />