Webiny 6.4.9 Changelog

For the full list of changes, check out the Webiny 6.4.9 release on GitHub.

Headless CMS

ExportBindParentNameContextfor External Use (#5573)

{/ REVIEW-PENDING @Pavel910 — confirm this entry, then delete this line /}

The BindParentNameContext is now exported from the CMS app, allowing external consumers to access it. Additionally, the Fields grid layout now wraps its children in a BindParentNameContext.Provider, ensuring nested field components receive the correct parent bind name through context when using useBindParentName().

Fixed Bulk Actions Silently Failing for Publish and Move to Folder (#5577)

{/ REVIEW-PENDING @Pavel910 — confirm this entry, then delete this line /}

Bulk Publish and Move to Folder actions were silently completing without actually processing any entries. The issue was caused by entry IDs having their version suffix (#0001) stripped before being passed to the underlying operations. Since the database layer requires the full revision ID to fetch entries, it would skip entries without a version — the bulk action would report success, but nothing was actually published or moved.

This has been fixed. All bulk actions now correctly preserve the full revision ID throughout the processing pipeline.

Website Builder

Fixed Deletion of Non-Empty Folders (#5574)

{/ REVIEW-PENDING @Pavel910 — confirm this entry, then delete this line /}

Deleting a Website Builder page or redirect folder that still contained items would silently succeed, leaving orphaned pages or redirects in the database that became invisible in the UI. Folder deletion now checks for contained pages or redirects before proceeding — if the folder is not empty, the operation is rejected with an error. Audit log entries are also now created when empty WB page and redirect folders are deleted.

Webiny SDK

NewAiModelRegistryAbstraction (#5575)

{/ REVIEW-PENDING @Pavel910 — confirm this entry, then delete this line /}

Model listing has been extracted from the Ai class into a standalone AiModelRegistry abstraction. This makes model listing a decoratable, independently injectable concern. The Ai class now delegates listModels(), listModelsByConnections(), and listModelsByConnection() to the registry. AiModelRegistry is exported from both @webiny/api-core and the webiny package.

Development

Fixed Security Vulnerabilities in Pulumi SDK (#5584)

{/ REVIEW-PENDING @Pavel910 — confirm this entry, then delete this line /}

The decompress package used for extracting Pulumi binaries had known security vulnerabilities (SNYK-JS-DECOMPRESS-17874437 and SNYK-JS-DECOMPRESS-17937347). It has been replaced with adm-zip for Windows and the existing tar package for macOS/Linux, with added path traversal protection during extraction.

Infrastructure

Updated Sharp Lambda Layer to v0.35.3 (#5585)

{/ REVIEW-PENDING @Pavel910 — confirm this entry, then delete this line /}

The Sharp image processing library used by Webiny’s file manager has been updated to v0.35.3. The new Lambda layer has been published to all 17 supported AWS regions and now includes compatibility with Node.js 24.x in addition to Node.js 22.x.