hasura/graphql-engine v2.51.4 on GitHub

Changelog

This is a patch release for v2.51.

The OpenTelemetry span attribute holding the SQL query text for Postgres queries is renamed from db.query to db.query.text, following the OpenTelemetry semantic conventions. This lets APM tools such as Datadog link traces to their database monitoring queries. Monitors or dashboards that reference db.query must be updated to use db.query.text.

console: fix three regressions in the table permissions UI — row/column permission selections now appear immediately after client-side navigation (previously blank until a page refresh), existing _exists conditions now show their operators in the permissions Builder, and saving a select permission that uses named computed fields no longer corrupts the metadata.
Fix OpenAPI import generating invalid templates for renamed array fields
Show an error instead of "Reload successful!" when a reloaded database is still inconsistent
Set GraphiQL text to 14px and display row-form JSON values as pretty-printed text when expanded and compact text when collapsed. Fix Raw SQL that always creates a migration, ignoring "This is a migration" checkbox.

Upgrade Ubuntu libbrotli1 to at least 1.1.0-2ubuntu0.1 for CVE-2026-111497 and super-connector Guava to 33.7.2-jre for CVE-2026-102554. Preserve explicit eMudhra-chain distrust while supporting newer UBI trust stores that already removed the affected roots.
Update the Node.js runtime bundled into the cli-ext CLI extension to 24.22.1 (via pkg 6.24.0 / pkg-fetch 3.6.7), which includes a security fix for its embedded Brotli library