Hasura GraphQL Engine

Changelog

Bug fixes and improvements

Server

• IMPORTANT: fix a bug in the mssql backend that could in certain cases allow an authenticated user to observe data they were not authorized for. All MS SQL Server users are encouraged to upgrade. More details to be released.
• Add cascade option to the remove_remote_schema API.
• Async actions now preserve the originating GraphQL request's distributed trace context (W3C TraceContext / B3). The async actions processor continues the original trace when invoking the action handler webhook instead of starting a new, disconnected trace, restoring end-to-end visibility in OTel-compatible tracing backends. (Enterprise/cloud only)
• Add --disable-admin-secret (HASURA_GRAPHQL_DISABLE_ADMIN_SECRET) flag to disable the authentication via the x-hasura-admin-secret request header. Require webhook or JWT auth if the admin secret is disabled.
• Event trigger names now undergo stricter validation, and must only contain alphanumeric, underscore and hyphen characters. Formerly this was only a warning on replace_metadata. Server upgrades over metadata containing non-conforming names should continue to work, but names must be fixed before the next replace_metadata.
• Restore the pre-existing naming behaviour as the default. A previous change made the September-2023 naming convention the unconditional default, which was a breaking change for existing OSS/EE users. The September-2023 behaviour is once again opt-in, now via the HASURA_FF_NAMING_CONVENTION_SEP_2023 environment variable (true/false, case-insensitive, default false).
• Improve the performance of order_by ...asc_nulls_first and ...desc_nulls_last in the MSSQL backend (contributed by Behzad Fattahi)

CLI

• Upgrade Go v1.26 and fix security vulnerabilities.

Data Connector

• Upgraded dependencies for the Super Connector to fix vulnerabilities (Enterprise/cloud only)

Build

• cli-migrations-v3: add the HASURA_GRAPHQL_DISALLOW_INCONSISTENT_METADATA environment variable to the enable --disallow-inconsistent-metadata for the metadata apply command.
• Fixed Postgres SSL connection failures for the self-hosted Ubuntu image when running on FIPS-enabled hosts. Since v2.49.5 (Ubuntu Noble base), OpenSSL tried to load a FIPS provider that is not shipped in the container, causing libpq SSL context initialization to fail (could not create SSL context: could not load the shared library) and fall back to a rejected cleartext connection. The image now sets OPENSSL_FORCE_FIPS_MODE=0 (upstream-documented workaround for Ubuntu bug LP#2141933) so it boots and negotiates TLS to Postgres on FIPS hosts. This is a container bootability fix and is not a FIPS certification claim.

Changelog

This is a patch release for v2.45.

Bug fixes and improvements

Server

• IMPORTANT: fix a bug in the mssql backend that could in certain cases allow an authenticated user to observe data they were not authorized for. All MS SQL Server users are encouraged to upgrade. More details to be released.
• event trigger names now undergo stricter validation, and must only contain alphanumeric, underscore and hyphen characters. Formerly this was only a warning on replace_metadata. Server upgrades over metadata containing non-conforming names should continue to work, but names must be fixed before the next replace_metadata.
• Improve the performance of order_by ...asc_nulls_first and ...desc_nulls_last in the MSSQL backend (contributed by Behzad Fattahi)

Data Connector

• super-connector: upgraded the Quarkus platform (3.33.1.1 -> 3.33.2.1, for quarkus-vertx-http) to remediate CVE-2026-50559 (HIGH: authorization bypass in HTTP path-based policies via encoded characters) flagged by the container image scan. (Enterprise/cloud only)

Build

• Upgraded frontend/console npm dependencies to remediate HIGH/CRITICAL security advisories (axios, semver, and transitive packages via Yarn resolutions). No user-facing behaviour change.
• cli-migrations-v3: add the HASURA_GRAPHQL_DISALLOW_INCONSISTENT_METADATA environment variable to the enable --disallow-inconsistent-metadata for the metadata apply command.
• Fixed Postgres SSL connection failures for the self-hosted Ubuntu image when running on FIPS-enabled hosts. Since v2.49.5 (Ubuntu Noble base), OpenSSL tried to load a FIPS provider that is not shipped in the container, causing libpq SSL context initialization to fail (could not create SSL context: could not load the shared library) and fall back to a rejected cleartext connection. The image now sets OPENSSL_FORCE_FIPS_MODE=0 (upstream-documented workaround for Ubuntu bug LP#2141933) so it boots and negotiates TLS to Postgres on FIPS hosts. This is a container bootability fix and is not a FIPS certification claim.

Changelog

This is a patch release for v2.49.

[!Warning] If your metadata enables the naming convention graphql-default, the metadata could be inconsistent because the naming convention Sep 2023 is enabled by default. Please upgrade to v2.50.0 to fix that issue.

Bug fixes and improvements

Server

• Upgrade Ubuntu base images to 24.04). The standard support of Ubuntu 22.04 will end on June 2027.
• Upgrade UBI base image to v10 to up-to-date with Ubuntu 24.04. GLIBC_2.38 is supported in UBI v9.
• Error responses now include the x-request-id header, matching successful responses so clients can correlate failures with logs and traces.
• Add jsonb path filter operators _jsonb_path_exists and _jsonb_path_match

Console

• Fix TypeError when experimental_features is null in useRootFieldPermissions.ts
• allow selecting all columns when updating trigger operation

CLI

• cli: upgraded Go v1.26.5 and dependencies to address known security vulnerabilities reported.

Data Connector

• Bump jackson-databind (2.21.4) and Netty (4.1.136.Final) in the super-connector data connector to remediate HIGH severity CVEs (CVE-2026-54512, CVE-2026-54513, CVE-2026-44891).

Build

• Remove the unused default ssl-cert-snakeoil private key and certificate from the graphql-engine ubuntu base image so they are no longer shipped in the container filesystem.

Changelog

This is a patch release for v2.45.

Bug fixes and improvements

• packaging: upgrade openssl in ubuntu base image to fix openssl CVE-2026-45447

Changelog

This is a patch release for v2.49.

Bug fixes and improvements

Server

• Made catalog and PG source migrations idempotent by adding IF NOT EXISTS to all ADD COLUMN statements, preventing re-application failures when a migration was applied to the database but its version was not recorded.
• Add a new option HASURA_GRAPHQL_WEBSOCKET_QUEUE_SIZE to bound the formerly unbounded internal queue used for sends on a websocket, set to 100 by default. Previously a very slow and long-lived client could in theory allow outgoing messages to pile up indefinitely. Now when the limit is reached the oldest message will be discarded. Users who don't use streaming subscriptions can consider setting this value to 1, which will have the effect of slow or delayed clients always pulling the freshest value. Eviction events can be monitored with the new hasura_websocket_messages_queued_total and hasura_websocket_messages_evicted_total metrics.
• Remove handling of the long-deprecated X-Hasura-Access-Key header. Clients should switch to X-Hasura-Admin-Secret.
• Add an 'extra_required_claims' option to JWT configuration. This allows the user to do more strict validation: when an expected issuer and/or audience is configured, make sure that the supplied JWT contains such a field. By default validation passes in such a situation. Users with self-hosted identity systems should be aware and consider turning on this option if they know they don't rely upon the default behavior.

CLI

• Added a new hasura metadata apply-data-sources command (config v3) that applies only the data sources' connection configuration from the project metadata, without replacing the rest of the metadata. It is an idempotent, non-destructive upsert (existing sources keep their tracked tables; new sources are added empty; sources are never dropped). This allows applying data sources before migrations, so the full metadata can be applied after the database schema exists — avoiding the window where newly-applied metadata exposes schema that pending migrations haven't created yet, and supporting change sets that add a new source together with its migrations.

Changelog

This is a patch release for v2.49.

Bug fixes and improvements

Server

• Added HASURA_GRAPHQL_DISABLE_EVENT_PROCESSING env var (and --disable-event-processing CLI flag) to stop the eventing background pollers — event triggers, scheduled events, the cron event generator, and async actions — without disabling the rest of the eventing subsystem. Unlike HASURA_GRAPHQL_DISABLE_EVENTING, source catalog migrations still run, so the eventing catalog tables are created on a fresh database. The cli-migrations v2 and v3 entrypoints now use this flag, fixing metadata apply failing on a fresh database when the metadata defines event triggers.

Data Connector

• super-connector: upgraded redshift-jdbc42 (2.2.2), Netty (4.1.135.Final, including the copy shaded into the Athena JDBC driver), and the Quarkus platform (3.33.1.1, for quarkus-vertx-http) to remediate CRITICAL/HIGH CVEs flagged by the container image scan. (Enterprise/cloud only)

Build

• Updated the Ubuntu base image of the graphql-engine Docker images to pull patched OS packages, fixing CVE-2026-45447 (openssl heap use-after-free in PKCS7_verify()) by upgrading openssl/libssl3 from 3.0.2-0ubuntu1.21 to 3.0.2-0ubuntu1.25.

Changelog

This is a patch release for v2.45.

Bug fixes and improvements

Server

• Fix a high-severity security issue: https://github.com/hasura/graphql-engine/security/advisories/GHSA-r27x-gc74-qmxh . Users are strongly encouraged to upgrade.
• Prior to v2.49.1 control characters in (malformed) request json could erroneously make their way into parsed json strings. v2.49.1 made such malformed json an error. This change translates all control characters to spaces before json parsing, attempting to preserve the old behavior for dodgy clients who were relying on injected literal whitespace as a whitespace delimiter in graphql payloads. Valid json bodies are unaffected by this change.
• Fixed a bug where a transient connection failure to a data connector (NDC) agent during engine startup or reload_metadata could leave a source that uses that connector permanently inconsistent (Data connector named '<name>' was not found in the data connector backend info) until metadata was manually reloaded. The engine now retries the agent capabilities fetch with bounded backoff before giving up, and the resulting error message is more actionable.
• Fix a bug where event triggers could prevent prompt server shutown; now we correctly only pause for actual in-flight processing
• Fix a bug where, with multiple sources, in-flight event triggers which were stuck during shutdown may not have been unlocked in the database before shutdown
• Mitigate two assymetrical DoS vectors.
• Improvements to schema memory usage.

Data Connector

• Fix MariaDB `update`/`delete` mutations still failing with `Table 'temp_table_xxx' doesn't exist` on v2.48.15. The previous fix (#11473) ran the temp-table CREATE outside the transaction, which made the CREATE and the mutation body race over pooled connections; MariaDB temp tables are session-scoped, so when the mutation body got a different pooled connection the temp table was invisible. The full CREATE / mutation / DROP lifecycle now runs pinned to one JDBC connection. (Enterprise/cloud only)

Changelog

This is a patch release for v2.49.

Bug fixes and improvements

Server

• Fix a high-severity security issue: https://github.com/hasura/graphql-engine/security/advisories/GHSA-r27x-gc74-qmxh . Users are strongly encouraged to upgrade.
• Prior to v2.49.1 control characters in (malformed) request json could erroneously make their way into parsed json strings. v2.49.1 made such malformed json an error. This change translates all control characters to spaces before json parsing, attempting to preserve the old behavior for dodgy clients who were relying on injected literal whitespace as a whitespace delimiter in graphql payloads. Valid json bodies are unaffected by this change.
• Fixed a bug where a transient connection failure to a data connector (NDC) agent during engine startup or reload_metadata could leave a source that uses that connector permanently inconsistent (Data connector named '<name>' was not found in the data connector backend info) until metadata was manually reloaded. The engine now retries the agent capabilities fetch with bounded backoff before giving up, and the resulting error message is more actionable.

CLI

• (cli) Add per-migration transaction control. Running hasura migrate apply --per-migration-transaction (or setting HASURA_GRAPHQL_PER_MIGRATION_TRANSACTION=true) enables a mode where individual SQL migrations can opt out of transactions by placing -- hasura:no-transaction as the first line of the file. This allows statements like CREATE INDEX CONCURRENTLY to coexist with fully transactional migrations in the same project, without requiring the global --no-transaction flag. The marker is ignored and behavior is unchanged when the flag is not set.

Changelog

This is a patch release for v2.49.

Bug fixes and improvements

Server

• Fix a bug where event triggers could prevent prompt server shutown; now we correctly only pause for actual in-flight processing
• Fix a bug where, with multiple sources, in-flight event triggers which were stuck during shutdown may not have been unlocked in the database before shutdown
• Mitigate two assymetrical DoS vectors.

Changelog

Bug fixes and improvements

Server

• feat: promote Relay API to stable /v1/relay and deprecate /v/1beta1/relay endpoint.
• feat: add the --enable-relay (HASURA_GRAPHQL_ENABLE_RELAY) flag to enable/disable Relay API. You can disable Relay to reduce memory usage if it isn't required for your applications. The default value is:
  • Community/Enterprise: true for backward compatibility.
  • Cloud: false. You need to enable it manually on the project settings.
• enhancement: improvements to schema memory usage.
• feat: added HASURA_GRAPHQL_DISABLE_EVENTING env var (and --disable-eventing CLI flag) to disable the entire eventing subsystem — event triggers, scheduled events, the cron event generator, and async actions — on the OSS / single-tenant build. Previously only multi-tenant cloud had this control. The cli-migrations v2 and v3 entrypoints now set this flag on their temporary HGE instance so migration jobs no longer compete with eventing pollers for database resources.

Data Connector

• fix: MariaDB `update`/`delete` mutations still failing with `Table 'temp_table_xxx' doesn't exist` on v2.48.15. The previous fix (#11473) ran the temp-table CREATE outside the transaction, which made the CREATE and the mutation body race over pooled connections; MariaDB temp tables are session-scoped, so when the mutation body got a different pooled connection the temp table was invisible. The full CREATE / mutation / DROP lifecycle now runs pinned to one JDBC connection. (Enterprise/cloud only)