# Hasura GraphQL Engine v2.49.2

- Product: Hasura GraphQL Engine (https://whatsnew.fyi/product/hasura)
- Vendor: Hasura
- Date: 2026-06-11
- Version: v2.49.2
- Original notes: https://github.com/hasura/graphql-engine/releases/tag/v2.49.2
- Permalink: https://whatsnew.fyi/product/hasura/releases/v2.49.2

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Fix a high-severity security issue related to control character handling in request JSON
- **fixed** — Control characters in malformed request JSON are now translated to spaces before parsing to preserve compatibility with clients relying on injected whitespace as delimiters
- **fixed** — Fix transient connection failures to data connector agents during engine startup or reload_metadata that could leave sources permanently inconsistent by implementing retried agent capabilities fetch with bounded backoff
- **added** — Add per-migration transaction control via hasura migrate apply --per-migration-transaction flag to allow individual SQL migrations to opt out of transactions using -- hasura:no-transaction marker

##### Changelog

This is a patch release for `v2.49`.

###### Bug fixes and improvements

###### Server

- Fix a high-severity security issue: https://github.com/hasura/graphql-engine/security/advisories/GHSA-r27x-gc74-qmxh . Users are strongly encouraged to upgrade.
- Prior to v2.49.1 control characters in (malformed) request json could erroneously make their way into parsed json strings. v2.49.1 made such malformed json an error. This change translates all control characters to spaces before json parsing, attempting to preserve the old behavior for dodgy clients who were relying on injected literal whitespace as a whitespace delimiter in graphql payloads. Valid json bodies are unaffected by this change.
- Fixed a bug where a transient connection failure to a data connector (NDC) agent during engine startup or `reload_metadata` could leave a source that uses that connector permanently inconsistent (`Data connector named '<name>' was not found in the data connector backend info`) until metadata was manually reloaded. The engine now retries the agent capabilities fetch with bounded backoff before giving up, and the resulting error message is more actionable.

###### CLI

- (cli) Add per-migration transaction control. Running `hasura migrate apply --per-migration-transaction` (or setting `HASURA_GRAPHQL_PER_MIGRATION_TRANSACTION=true`) enables a mode where individual SQL migrations can opt out of transactions by placing `-- hasura:no-transaction` as the first line of the file. This allows statements like `CREATE INDEX CONCURRENTLY` to coexist with fully transactional migrations in the same project, without requiring the global `--no-transaction` flag. The marker is ignored and behavior is unchanged when the flag is not set.