v2.50.1
📦 hasura-authView on GitHub →
✨ 2 features🐛 3 fixes🔧 5 symbols
Summary
This patch release for v2.50 introduces opt-in logging redaction for various triggers and handlers, and improves the behavior of the @cached directive when the Redis store is unavailable. It also fixes a critical SSO login issue in the Console and addresses security vulnerabilities in the data connector.
✨ New Features
- Added three opt-in flags to redact request body, session variables, and webhook response body from delivery logs for Event Triggers, Scheduled/Cron Triggers, and Action handlers. Redacted fields will be emitted as JSON null.
- Queries with the @cached directive now fail open when the caching Redis store is unavailable, executing the query without caching instead of failing with a 400 error. This matches the documented startup behavior and is similar to rate limiting behavior. (Enterprise edition only)
🐛 Bug Fixes
- Fixed a regression in v2.50.0 that prevented SSO users from logging in to the Console due to a change in the decoded JWT token shape after migrating to jwt-decode@4. The decodeToken function now restores the expected { header, payload } shape.
- Remediated CVE-2026-40983 and CVE-2026-40984 (HIGH: DoS via crafted gRPC/HTTP requests) by upgrading the Quarkus platform for the super-connector.
- Included earlier quarkus-vertx-http fix (CVE-2026-50559) and updated netty core to 4.1.136.Final and vertx-core to 4.5.31 as part of the Quarkus platform upgrade.