v2.50.0
Breaking Changes📦 hasura-authView on GitHub →
⚠ 1 breaking✨ 4 features🐛 6 fixes🔧 10 symbols
Summary
This patch release for v2.50 includes critical security fixes for the mssql backend and CLI dependencies, alongside improvements to async actions and event trigger validation. It also addresses compatibility issues with FIPS-enabled hosts and restores previous naming conventions as the default.
⚠️ Breaking Changes
- Event trigger names now undergo stricter validation and must only contain alphanumeric, underscore, and hyphen characters. While server upgrades will work with existing metadata, names must be fixed before the next `replace_metadata` operation.
Migration Steps
- Fix event trigger names to only contain alphanumeric, underscore, and hyphen characters before the next `replace_metadata` operation.
✨ New Features
- Added `cascade` option to the `remove_remote_schema` API.
- Async actions now preserve the originating GraphQL request's distributed trace context (W3C TraceContext / B3), restoring end-to-end visibility in OTel-compatible tracing backends (Enterprise/cloud only).
- Added `HASURA_GRAPHQL_DISABLE_ADMIN_SECRET` and `--disable-admin-secret` to ignore the `x-hasura-admin-secret` request header and use configured webhook, JWT, SSO, or collaborator-token authentication instead.
- Added the `HASURA_GRAPHQL_DISALLOW_INCONSISTENT_METADATA` environment variable to enable `--disallow-inconsistent-metadata` for the `metadata apply` command.
🐛 Bug Fixes
- Fixed a bug in the mssql backend that could allow an authenticated user to observe data they were not authorized for.
- Fixed security vulnerabilities in `cli-ext` dependencies by bumping vulnerable transitive packages including `@babel/traverse`, `tar`, `lodash`, and `immutable`.
- Upgraded the Quarkus platform (3.33.1.1 -> 3.33.2.1) to remediate CVE-2026-50559 (authorization bypass in HTTP path-based policies via encoded characters) in the super-connector (Enterprise/cloud only).
- Fixed security vulnerabilities in documentation-site dependencies by bumping vulnerable packages including `tar`, `shell-quote`, `postcss`, `svgo`, `immutable`, `serialize-javascript`, `lodash`, `axios`, `sharp`, `dompurify`, `uuid`, and `wrangler`.
- Upgraded frontend/console npm dependencies to remediate HIGH/CRITICAL security advisories (axios, semver, and transitive packages via Yarn resolutions).
- Fixed Postgres SSL connection failures for the self-hosted Ubuntu image when running on FIPS-enabled hosts by setting `OPENSSL_FORCE_FIPS_MODE=0`.