hasura/graphql-engine v2.45.9

on GitHub

Changelog

This is a patch release for v2.45.

Bug fixes and improvements

Server

• Fixed row-level permission filters that traverse a remote relationship into a Data Connector source (e.g. Snowflake). Such filters previously failed at query time with getColVals: not implemented for the Data Connector backend, or, once that was patched, with an invalid cast on the Postgres side (e.g. '1'::number). Both are now fixed.

Data Connector

• Fixed an issue in the Snowflake data connector where selecting multiple relationships targeting the same table, including nested relationships and repeated selections under different GraphQL aliases, could return incorrect results or unexpectedly null relationships.
• super-connector: upgraded the Quarkus platform (3.33.2.1 -> 3.33.3.1) to pull micrometer-core 1.16.6 (was 1.16.3), remediating CVE-2026-40983 and CVE-2026-40984 (both HIGH: DoS via crafted gRPC/HTTP requests) flagged by the container image scan. The bump also carries the earlier quarkus-vertx-http fix (CVE-2026-50559) and moves netty core to 4.1.136.Final and vertx-core to 4.5.31.

Build

• Fixed the UBI-based hasura/graphql-engine image breaking Postgres MD5 password authentication (via libpq/psql). The image no longer sets OPENSSL_FORCE_FIPS_MODE, whose mere presence caused Red Hat UBI's OpenSSL to enable FIPS behavior regardless of the value. (close #10880)