hasura/graphql-engine v2.50.1

on GitHub

Changelog

This is a patch release for v2.50.

Bug fixes and improvements

Server

• Added three opt-in flags (all default false) that redact the request body, session variables and webhook response body from the respective delivery logs (Event Triggers, Scheduled/Cron Triggers, and Action handlers). Redacted fields are emitted as JSON null. When disabled (the default), log output is unchanged.:

  • --redact-event-trigger-logs (HASURA_GRAPHQL_REDACT_EVENT_TRIGGER_LOGS)
  • --redact-scheduled-trigger-logs (HASURA_GRAPHQL_REDACT_SCHEDULED_TRIGGER_LOGS)
  • --redact-action-handler-logs (HASURA_GRAPHQL_REDACT_ACTION_HANDLER_LOGS)

• Queries carrying the @cached directive no longer fail with a 400 not-supported ("Caching is not configured") error when the caching Redis store is unavailable. Whenever the cache cannot serve the request — whether because caching was never configured, or because its Redis connection could not be established (for example a failed startup connect under HASURA_GRAPHQL_REDIS_NO_FAIL_ON_STARTUP) — the query is now executed without caching. Caching now fails open like rate limiting, matching the documented startup behaviour. Normal cache hit/miss behaviour is unchanged. (Enterprise edition only)

Console

• Fixed a regression in v2.50.0 that prevented SSO users from logging in to the
  Console (login hung at "Validating…" with TypeError: Cannot read properties of undefined (reading 'id')). The v2.50.0 migration to jwt-decode@4 changed the
  decoded-token shape (claims returned directly instead of under .payload);
  decodeToken now restores the { header, payload } shape so SSO login and the
  API Explorer JWT analyzer work again. (Enterprise/cloud only)

Data Connector

• super-connector: upgraded the Quarkus platform (3.33.2.1 -> 3.33.3.1) to pull micrometer-core 1.16.6 (was 1.16.3), remediating CVE-2026-40983 and CVE-2026-40984 (both HIGH: DoS via crafted gRPC/HTTP requests) flagged by the container image scan. The bump also carries the earlier quarkus-vertx-http fix (CVE-2026-50559) and moves netty core to 4.1.136.Final and vertx-core to 4.5.31. (Enterprise/cloud only)