# Hasura GraphQL Engine v2.50.0

- Product: Hasura GraphQL Engine (https://whatsnew.fyi/product/hasura)
- Vendor: Hasura
- Date: 2026-08-05
- Version: v2.50.0
- Original notes: https://github.com/hasura/graphql-engine/releases/tag/v2.50.0
- Permalink: https://whatsnew.fyi/product/hasura/releases/v2.50.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Fix a bug in the MSSQL backend that could allow an authenticated user to observe data they were not authorized for
- **added** — Add cascade option to the remove_remote_schema API
- **changed** — Async actions now preserve the originating GraphQL request's distributed trace context (W3C TraceContext / B3) and continue the original trace when invoking the action handler webhook
- **added** — Add --disable-admin-secret (HASURA_GRAPHQL_DISABLE_ADMIN_SECRET) flag to disable authentication via the x-hasura-admin-secret request header
- **changed** — Event trigger names now undergo stricter validation and must only contain alphanumeric, underscore and hyphen characters
- **changed** — Restore the pre-existing naming behaviour as the default, with September-2023 naming convention now opt-in via the HASURA_FF_NAMING_CONVENTION_SEP_2023 environment variable
- **changed** — Improve the performance of order_by ...asc_nulls_first and ...desc_nulls_last in the MSSQL backend
- **security** — Upgrade Go to v1.26 and fix security vulnerabilities in CLI
- **security** — Upgrade dependencies for the Super Connector to fix vulnerabilities
- **added** — Add the HASURA_GRAPHQL_DISALLOW_INCONSISTENT_METADATA environment variable to cli-migrations-v3 to enable --disallow-inconsistent-metadata for the metadata apply command
- **fixed** — Fix Postgres SSL connection failures for the self-hosted Ubuntu image when running on FIPS-enabled hosts by setting OPENSSL_FORCE_FIPS_MODE=0

##### Changelog

###### Bug fixes and improvements

###### Server

- **IMPORTANT**: fix a bug in the mssql backend that could in certain cases allow an authenticated user to observe data they were not authorized for. All MS SQL Server users are encouraged to upgrade. More details to be released.
- Add `cascade` option to the `remove_remote_schema` API.
- Async actions now preserve the originating GraphQL request's distributed trace context (W3C TraceContext / B3). The async actions processor continues the original trace when invoking the action handler webhook instead of starting a new, disconnected trace, restoring end-to-end visibility in OTel-compatible tracing backends. _(Enterprise/cloud only)_
- Add `--disable-admin-secret` (`HASURA_GRAPHQL_DISABLE_ADMIN_SECRET`) flag to disable the authentication via the `x-hasura-admin-secret` request header. Require webhook or JWT auth if the admin secret is disabled. 
- Event trigger names now undergo stricter validation, and must only contain alphanumeric, underscore and hyphen characters. Formerly this was only a warning on `replace_metadata`. Server upgrades over metadata containing non-conforming names should continue to work, but names must be fixed before the next `replace_metadata`.
- Restore the pre-existing naming behaviour as the default. A previous change made the September-2023 naming convention the unconditional default, which was a breaking change for existing OSS/EE users. The September-2023 behaviour is once again opt-in, now via the `HASURA_FF_NAMING_CONVENTION_SEP_2023` environment variable (`true`/`false`, case-insensitive, default `false`).
- Improve the performance of `order_by ...asc_nulls_first` and `...desc_nulls_last` in the MSSQL backend (contributed by Behzad Fattahi)

###### CLI

- Upgrade Go v1.26 and fix security vulnerabilities.

###### Data Connector

- Upgraded dependencies for the Super Connector to fix vulnerabilities _(Enterprise/cloud only)_

###### Build

- cli-migrations-v3: add the `HASURA_GRAPHQL_DISALLOW_INCONSISTENT_METADATA` environment variable to the enable `--disallow-inconsistent-metadata` for the `metadata apply` command. 
- Fixed Postgres SSL connection failures for the self-hosted Ubuntu image when
running on FIPS-enabled hosts. Since v2.49.5 (Ubuntu Noble base), OpenSSL tried
to load a FIPS provider that is not shipped in the container, causing libpq SSL
context initialization to fail (could not create SSL context: could not load the shared library) and fall back to a rejected cleartext connection. The
image now sets `OPENSSL_FORCE_FIPS_MODE=0` (upstream-documented workaround for
Ubuntu bug LP#2141933) so it boots and negotiates TLS to Postgres on FIPS hosts.
This is a container bootability fix and is not a FIPS certification claim.