# Hasura GraphQL Engine v2.49.3

- Product: Hasura GraphQL Engine (https://whatsnew.fyi/product/hasura)
- Vendor: Hasura
- Date: 2026-06-22
- Version: v2.49.3
- Original notes: https://github.com/hasura/graphql-engine/releases/tag/v2.49.3
- Permalink: https://whatsnew.fyi/product/hasura/releases/v2.49.3

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Add HASURA_GRAPHQL_DISABLE_EVENT_PROCESSING env var and --disable-event-processing CLI flag to stop event triggers, scheduled events, cron event generator, and async actions without disabling the rest of the eventing subsystem
- **fixed** — Fix metadata apply failing on a fresh database when metadata defines event triggers by having cli-migrations v2 and v3 entrypoints use the disable-event-processing flag
- **security** — Remediate CRITICAL/HIGH CVEs by upgrading redshift-jdbc42 to 2.2.2, Netty to 4.1.135.Final, and Quarkus platform to 3.33.1.1
- **security** — Fix CVE-2026-45447 (openssl heap use-after-free in PKCS7_verify) by upgrading openssl/libssl3 to 3.0.2-0ubuntu1.25 in Ubuntu base image

##### Changelog

This is a patch release for `v2.49`.

###### Bug fixes and improvements

###### Server

- Added `HASURA_GRAPHQL_DISABLE_EVENT_PROCESSING` env var (and `--disable-event-processing` CLI flag) to stop the eventing background pollers — event triggers, scheduled events, the cron event generator, and async actions — without disabling the rest of the eventing subsystem. Unlike `HASURA_GRAPHQL_DISABLE_EVENTING`, source catalog migrations still run, so the eventing catalog tables are created on a fresh database. The `cli-migrations` v2 and v3 entrypoints now use this flag, fixing metadata apply failing on a fresh database when the metadata defines event triggers.

###### Data Connector

- super-connector: upgraded `redshift-jdbc42` (2.2.2), Netty (4.1.135.Final, including the copy shaded into the Athena JDBC driver), and the Quarkus platform (3.33.1.1, for `quarkus-vertx-http`) to remediate CRITICAL/HIGH CVEs flagged by the container image scan. _(Enterprise/cloud only)_

###### Build

- Updated the Ubuntu base image of the graphql-engine Docker images to pull patched OS packages, fixing CVE-2026-45447 (openssl heap use-after-free in `PKCS7_verify()`) by upgrading `openssl`/`libssl3` from `3.0.2-0ubuntu1.21` to `3.0.2-0ubuntu1.25`.