v2.45.8
Breaking Changes📦 hasura-authView on GitHub →
⚠ 1 breaking✨ 1 features🐛 5 fixes🔧 15 symbols
Summary
This patch release addresses critical security vulnerabilities in the super-connector and frontend dependencies, alongside important bug fixes for the MSSQL backend and Postgres SSL connections on FIPS-enabled hosts.
⚠️ Breaking Changes
- Event trigger names now undergo stricter validation and must only contain alphanumeric, underscore, and hyphen characters. While server upgrades with non-conforming names will work, these names must be fixed before the next `replace_metadata` operation.
Migration Steps
- Fix event trigger names to only contain alphanumeric, underscore, and hyphen characters before the next `replace_metadata` operation.
✨ New Features
- The `HASURA_GRAPHQL_DISALLOW_INCONSISTENT_METADATA` environment variable is now available for the `metadata apply` command via `cli-migrations-v3`.
🐛 Bug Fixes
- Fixed a bug in the mssql backend that could allow an authenticated user to observe unauthorized data.
- Improved the performance of `order_by ...asc_nulls_first` and `...desc_nulls_last` in the MSSQL backend.
- Remediated CVE-2026-50559 (authorization bypass in HTTP path-based policies via encoded characters) in the super-connector by upgrading the Quarkus platform.
- Upgraded frontend/console npm dependencies to remediate HIGH/CRITICAL security advisories.
- Fixed Postgres SSL connection failures for the self-hosted Ubuntu image when running on FIPS-enabled hosts by setting `OPENSSL_FORCE_FIPS_MODE=0`.