Hasura GraphQL Engine v2.49.5

Changelog

This is a patch release for v2.49.

[!Warning] If your metadata enables the naming convention graphql-default, the metadata could be inconsistent because the naming convention Sep 2023 is enabled by default. Please upgrade to v2.50.0 to fix that issue.

Bug fixes and improvements

Server

• Upgrade Ubuntu base images to 24.04). The standard support of Ubuntu 22.04 will end on June 2027.
• Upgrade UBI base image to v10 to up-to-date with Ubuntu 24.04. GLIBC_2.38 is supported in UBI v9.
• Error responses now include the x-request-id header, matching successful responses so clients can correlate failures with logs and traces.
• Add jsonb path filter operators _jsonb_path_exists and _jsonb_path_match

Console

• Fix TypeError when experimental_features is null in useRootFieldPermissions.ts
• allow selecting all columns when updating trigger operation

CLI

• cli: upgraded Go v1.26.5 and dependencies to address known security vulnerabilities reported.

Data Connector

• Bump jackson-databind (2.21.4) and Netty (4.1.136.Final) in the super-connector data connector to remediate HIGH severity CVEs (CVE-2026-54512, CVE-2026-54513, CVE-2026-44891).

Build

• Remove the unused default ssl-cert-snakeoil private key and certificate from the graphql-engine ubuntu base image so they are no longer shipped in the container filesystem.