Overview
Hasura v2.49.3 is a maintenance release for the v2.49 line. It focuses on a new runtime flag for event processing, several enterprise‑only connector upgrades, and a critical security patch for the Docker images.
New environment variable: HASURA_GRAPHQL_DISABLE_EVENT_PROCESSING
Vendor claim: The flag (and its CLI counterpart --disable-event-processing) stops all background pollers that drive event triggers, scheduled events, the cron generator, and async actions. Unlike the older HASURA_GRAPHQL_DISABLE_EVENTING, source‑catalog migrations still run, so the eventing catalog tables are created on a fresh database. The flag is also used by the cli-migrations v2 and v3 entrypoints, fixing metadata‑apply failures when the metadata defines event triggers on a fresh DB.
Enterprise / Cloud data‑connector upgrades
For enterprise customers, the super‑connector now ships newer versions of redshift-jdbc42 (2.2.2), Netty (4.1.135.Final), and the Quarkus platform (3.33.1.1). These upgrades address several critical and high‑severity CVEs identified in the container image scan.
Security fix: OpenSSL heap use‑after‑free (CVE‑2026‑45447)
The Docker images for graphql-engine now use an updated Ubuntu base that upgrades openssl/libssl3 from 3.0.2-0ubuntu1.21 to 3.0.2-0ubuntu1.25, mitigating CVE‑2026‑45447 – a heap use‑after‑free in PKCS7_verify(). The vulnerability record is documented at OSV.
Impact for users
- Operators can now disable only the event‑processing background work without turning off the entire eventing subsystem, simplifying maintenance and reducing resource usage.
- Enterprise users benefit from up‑to‑date connector libraries that close known security gaps.
- All users receive a hardened Docker image that eliminates a critical OpenSSL flaw, improving the security posture of deployments that rely on the official images.
Overall, v2.49.3 is a modest but important release that tightens security and adds operational flexibility.