Hasura’s GraphQL Engine v2.49.2 is a patch release that focuses on security, stability, and developer workflow enhancements.
Security fix
The update addresses a high‑severity security issue (GHSA‑r27x‑gc74‑qmxh). The vendor strongly recommends upgrading to mitigate the vulnerability.
JSON control‑character handling
Prior to v2.49.1, malformed JSON containing control characters could leak those characters into parsed strings. v2.49.2 now translates all control characters to spaces before parsing, preserving legacy behavior for clients that relied on injected whitespace while leaving valid JSON untouched.
Data connector resilience
Transient connection failures to a data connector (NDC) agent during engine startup or reload_metadata no longer leave the source permanently inconsistent. The engine now retries the agent capabilities fetch with a bounded back‑off and provides a clearer error message if the retry limit is reached.
CLI per‑migration transaction control
The Hasura CLI gains a new flag --per-migration-transaction (or the environment variable HASURA_GRAPHQL_PER_MIGRATION_TRANSACTION=true). When enabled, individual migration files can opt out of a transaction by starting with the marker -- hasura:no-transaction. This allows statements such as CREATE INDEX CONCURRENTLY to coexist with fully transactional migrations without using the global --no-transaction flag.
Overall, v2.49.2 strengthens security, improves robustness against malformed requests and connector hiccups, and gives developers finer‑grained control over migration transactions.