Hasura GraphQL Engine v2.49.5 released with Ubuntu 24.04 base, security patches, and new JSONB operators

by

Overview

Hasura announced the v2.49.5 patch release for its GraphQL Engine. The vendor (Hasura) highlights a set of server, console, CLI, and data‑connector updates aimed at improving stability, security, and observability.

Server updates (vendor claim)

  • Base Docker images have been upgraded to Ubuntu 24.04. The previous standard support for Ubuntu 22.04 will end in June 2027.
  • UBI base image moved to version 10, aligning with Ubuntu 24.04; GLIBC 2.38 is now supported in UBI v9.
  • All error responses now include the x-request-id header, matching successful responses to aid correlation of failures with logs and traces.
  • Two new JSONB path filter operators have been added: _jsonb_path_exists and _jsonb_path_match.

Console fixes (vendor claim)

  • Resolved a TypeError that occurred when experimental_features was null in useRootFieldPermissions.ts.
  • Enabled selection of all columns when updating a trigger operation.

CLI security hardening (vendor claim)

  • The CLI binary was rebuilt with Go 1.26.5 and updated dependencies to remediate known security vulnerabilities.

Data‑connector vulnerability remediation (vendor claim)

  • Upgraded jackson-databind to 2.21.4 and Netty to 4.1.136.Final in the super‑connector.
  • These upgrades address three HIGH‑severity CVEs: CVE‑2026‑44891, CVE‑2026‑54512, and CVE‑2026‑54513.

Build cleanup (vendor claim)

  • Removed the unused default ssl-cert-snakeoil private key and certificate from the Ubuntu base image, reducing container footprint.

Metadata naming‑convention warning (vendor claim)

If your metadata enables the graphql-default naming convention, it may become inconsistent because the Sep 2023 naming convention is now enabled by default. Upgrading to v2.50.0 is recommended to resolve this.

Overall, v2.49.5 is a maintenance‑focused release that primarily addresses security concerns and modernises the underlying OS images while adding useful JSONB query capabilities.