Hasura GraphQL Engine v2.50.0 Release: Security Fixes, New Admin Controls, and Tracing Enhancements

by

Hasura released version v2.50.0 of its GraphQL Engine, delivering a mix of security hardening, new configuration flags, and performance tweaks.

  • Critical MSSQL security fix: The update patches a bug that could let an authenticated user read data they were not authorized to see. All Microsoft SQL Server users are urged to upgrade.
  • Remote schema removal: A new cascade option is added to the remove_remote_schema API, simplifying cleanup of dependent objects.
  • Async‑action tracing (Enterprise/cloud only): Async actions now carry the original GraphQL request’s W3C TraceContext or B3 headers, preserving end‑to‑end visibility in OpenTelemetry‑compatible backends.
  • Admin secret control: The --disable-admin-secret flag (environment variable HASURA_GRAPHQL_DISABLE_ADMIN_SECRET) disables authentication via the x-hasura-admin-secret header, forcing webhook or JWT authentication instead.
  • Event‑trigger name validation: Names must now consist only of alphanumeric characters, underscores, or hyphens. Non‑conforming names will be rejected on metadata replacement.
  • Naming‑convention toggle: The September‑2023 naming convention is no longer the default; it can be enabled with the HASURA_FF_NAMING_CONVENTION_SEP_2023 environment variable.
  • MSSQL ordering performance: Queries using order_by …asc_nulls_first or …desc_nulls_last are now faster.
  • CLI upgrade: The CLI is rebuilt with Go v1.26, addressing several security vulnerabilities.
  • Docker image fix for FIPS hosts: The Ubuntu‑based container now sets OPENSSL_FORCE_FIPS_MODE=0, allowing TLS connections to PostgreSQL on FIPS‑enabled systems.

These changes reinforce Hasura’s focus on security, observability, and developer ergonomics. Users of the MSSQL backend should upgrade immediately, and anyone relying on the admin secret should review the new flag to align with their authentication strategy.