# Hasura GraphQL Engine v2.50.1

- Product: Hasura GraphQL Engine (https://whatsnew.fyi/product/hasura)
- Vendor: Hasura
- Date: 2026-08-18
- Version: v2.50.1
- Original notes: https://github.com/hasura/graphql-engine/releases/tag/v2.50.1
- Permalink: https://whatsnew.fyi/product/hasura/releases/v2.50.1

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Add opt-in flag --redact-event-trigger-logs to redact request body, session variables and webhook response body from Event Trigger delivery logs
- **added** — Add opt-in flag --redact-scheduled-trigger-logs to redact request body, session variables and webhook response body from Scheduled/Cron Trigger delivery logs
- **added** — Add opt-in flag --redact-action-handler-logs to redact request body, session variables and webhook response body from Action handler delivery logs
- **changed** — Queries with the @cached directive now execute without caching when the Redis store is unavailable instead of failing with a 400 not-supported error
- **fixed** — Fix regression in v2.50.0 that prevented SSO users from logging in to the Console by restoring the { header, payload } shape in decodeToken
- **security** — Upgrade Quarkus platform to 3.33.3.1 to remediate CVE-2026-40983 and CVE-2026-40984 in micrometer-core

##### Changelog

This is a patch release for `v2.50`.

###### Bug fixes and improvements

###### Server

- Added three opt-in flags (all default `false`) that redact the request body, session variables and webhook response body from the respective delivery logs (Event Triggers,   Scheduled/Cron Triggers, and Action handlers). Redacted fields are emitted as JSON `null`. When disabled (the default), log output is  unchanged.:
  - `--redact-event-trigger-logs` (`HASURA_GRAPHQL_REDACT_EVENT_TRIGGER_LOGS`)
  - `--redact-scheduled-trigger-logs` (`HASURA_GRAPHQL_REDACT_SCHEDULED_TRIGGER_LOGS`)
  - `--redact-action-handler-logs` (`HASURA_GRAPHQL_REDACT_ACTION_HANDLER_LOGS`)

 
- Queries carrying the `@cached` directive no longer fail with a `400 not-supported` (`"Caching is not configured"`) error when the caching Redis store is unavailable. Whenever the cache cannot serve the request — whether because caching was never configured, or because its Redis connection could not be established (for example a failed startup connect under `HASURA_GRAPHQL_REDIS_NO_FAIL_ON_STARTUP`) — the query is now executed without caching. Caching now fails open like rate limiting, matching the documented startup behaviour. Normal cache hit/miss behaviour is unchanged. _(Enterprise edition only)_

###### Console

- Fixed a regression in v2.50.0 that prevented SSO users from logging in to the
Console (login hung at "Validating…" with `TypeError: Cannot read properties of
undefined (reading 'id')`). The v2.50.0 migration to `jwt-decode@4` changed the
decoded-token shape (claims returned directly instead of under `.payload`);
`decodeToken` now restores the `{ header, payload }` shape so SSO login and the
API Explorer JWT analyzer work again. _(Enterprise/cloud only)_

###### Data Connector

- super-connector: upgraded the Quarkus platform (3.33.2.1 -> 3.33.3.1) to pull `micrometer-core` 1.16.6 (was 1.16.3), remediating CVE-2026-40983 and CVE-2026-40984 (both HIGH: DoS via crafted gRPC/HTTP requests) flagged by the container image scan. The bump also carries the earlier quarkus-vertx-http fix (CVE-2026-50559) and moves netty core to 4.1.136.Final and vertx-core to 4.5.31. _(Enterprise/cloud only)_