- Add opt-in flag --redact-event-trigger-logs to redact request body, session variables and webhook response body from Event Trigger delivery logs
- Add opt-in flag --redact-scheduled-trigger-logs to redact request body, session variables and webhook response body from Scheduled/Cron Trigger delivery logs
- Add opt-in flag --redact-action-handler-logs to redact request body, session variables and webhook response body from Action handler delivery logs
- Queries with the @cached directive now execute without caching when the Redis store is unavailable instead of failing with a 400 not-supported error
- Fix regression in v2.50.0 that prevented SSO users from logging in to the Console by restoring the { header, payload } shape in decodeToken
- Upgrade Quarkus platform to 3.33.3.1 to remediate CVE-2026-40983 and CVE-2026-40984 in micrometer-core
From Hasura GraphQL Engine
Changelog
This is a patch release for v2.50.
Bug fixes and improvements
Server
-
Added three opt-in flags (all default
false) that redact the request body, session variables and webhook response body from the respective delivery logs (Event Triggers, Scheduled/Cron Triggers, and Action handlers). Redacted fields are emitted as JSONnull. When disabled (the default), log output is unchanged.:--redact-event-trigger-logs(HASURA_GRAPHQL_REDACT_EVENT_TRIGGER_LOGS)--redact-scheduled-trigger-logs(HASURA_GRAPHQL_REDACT_SCHEDULED_TRIGGER_LOGS)--redact-action-handler-logs(HASURA_GRAPHQL_REDACT_ACTION_HANDLER_LOGS)
-
Queries carrying the
@cacheddirective no longer fail with a400 not-supported("Caching is not configured") error when the caching Redis store is unavailable. Whenever the cache cannot serve the request — whether because caching was never configured, or because its Redis connection could not be established (for example a failed startup connect underHASURA_GRAPHQL_REDIS_NO_FAIL_ON_STARTUP) — the query is now executed without caching. Caching now fails open like rate limiting, matching the documented startup behaviour. Normal cache hit/miss behaviour is unchanged. (Enterprise edition only)
Console
- Fixed a regression in v2.50.0 that prevented SSO users from logging in to the
Console (login hung at "Validating…" with
TypeError: Cannot read properties of undefined (reading 'id')). The v2.50.0 migration tojwt-decode@4changed the decoded-token shape (claims returned directly instead of under.payload);decodeTokennow restores the{ header, payload }shape so SSO login and the API Explorer JWT analyzer work again. (Enterprise/cloud only)
Data Connector
- super-connector: upgraded the Quarkus platform (3.33.2.1 -> 3.33.3.1) to pull
micrometer-core1.16.6 (was 1.16.3), remediating CVE-2026-40983 and CVE-2026-40984 (both HIGH: DoS via crafted gRPC/HTTP requests) flagged by the container image scan. The bump also carries the earlier quarkus-vertx-http fix (CVE-2026-50559) and moves netty core to 4.1.136.Final and vertx-core to 4.5.31. (Enterprise/cloud only)