This release includes 1 breaking change for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+8 more
Affected surfaces
ReleasePort's take
Moderate signalRemote schema conflicts now surface as inconsistent_metadata instead of failing silently. Event trigger logs no longer expose secrets; dependency CVEs in SuperConnector patched.
Why it matters: Remote schema type conflicts now block deployments; validate before upgrading. Event trigger logs no longer expose secrets from value_from_env. SuperConnector patched for CVEs. Redis default pool increased 50→500; test with concurrent workloads.
Summary
AI summaryRemote schema type conflicts now cause metadata inconsistency errors, breaking previous silent handling.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Medium |
Event trigger logs no longer expose secrets from value_from_env Event trigger logs no longer expose secrets from value_from_env Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Security | Medium |
SuperConnector updated for CVEs in libraries and dependencies SuperConnector updated for CVEs in libraries and dependencies Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Security | Medium |
Sensitive values removed from event trigger logs to prevent secret leakage Sensitive values removed from event trigger logs to prevent secret leakage Source: granite4.1:30b@2026-05-22-audit Confidence: low |
— |
| Security | Medium |
SuperConnector libraries and Dockerfile base images updated for CVE fixes SuperConnector libraries and Dockerfile base images updated for CVE fixes Source: granite4.1:30b@2026-05-22-audit Confidence: low |
— |
| Breaking | Medium |
Remote schema type conflicts now marked as inconsistent_metadata Remote schema type conflicts now marked as inconsistent_metadata Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Breaking | Medium |
Event trigger log format changed Event trigger log format changed Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
New metric hasura_metadata_inconsistencies shows inconsistency count New metric hasura_metadata_inconsistencies shows inconsistency count Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Redis pool size now configurable via environment variables Redis pool size now configurable via environment variables Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Super-connector supports RSA key authentication with BouncyCastle Super-connector supports RSA key authentication with BouncyCastle Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Redis pool default increased from 50 to 500 connections Redis pool default increased from 50 to 500 connections Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
BigQuery rest routine types now include AGGREGATE_FUNCTION BigQuery rest routine types now include AGGREGATE_FUNCTION Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Low |
Super‑connector sets JAVA_OPTS to enable BouncyCastle for RSA key authentication (Enterprise edition only) Super‑connector sets JAVA_OPTS to enable BouncyCastle for RSA key authentication (Enterprise edition only) Source: granite4.1:30b@2026-05-22-audit Confidence: high |
— |
| Feature | Low |
Redis pool size configurable via HASURA_GRAPHQL_CACHING_REDIS_POOL_SIZE and HASURA_GRAPHQL_RATE_LIMIT_REDIS_POOL_SIZE Redis pool size configurable via HASURA_GRAPHQL_CACHING_REDIS_POOL_SIZE and HASURA_GRAPHQL_RATE_LIMIT_REDIS_POOL_SIZE Source: granite4.1:30b@2026-05-22-audit Confidence: low |
— |
| Dependency | Medium |
Runtime upgraded to GHC 9.14.1 from 9.10.1 Runtime upgraded to GHC 9.14.1 from 9.10.1 Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Performance | Medium |
Large gzipped responses no longer cause excessive GC sync pauses Large gzipped responses no longer cause excessive GC sync pauses Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Performance | Medium |
BigQuery schema introspection performance improved for many tables BigQuery schema introspection performance improved for many tables Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Active subscriptions gauge no longer goes negative due to race condition Active subscriptions gauge no longer goes negative due to race condition Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Event triggers removed when moved between tables in metadata Event triggers removed when moved between tables in metadata Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Connection lifetime pool setting now correctly applied Connection lifetime pool setting now correctly applied Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Overloaded function error fixed during database oid rewriting Overloaded function error fixed during database oid rewriting Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Remote join types no longer mixed when prefixes and namespaces differ Remote join types no longer mixed when prefixes and namespaces differ Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Streaming subscriptions on non-unique columns fixed for Postgres Streaming subscriptions on non-unique columns fixed for Postgres Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
OpenAPI specs for REST GET endpoints no longer include requestBody OpenAPI specs for REST GET endpoints no longer include requestBody Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Experimental remove_empty_subscription_responses applies to streaming subscriptions Experimental remove_empty_subscription_responses applies to streaming subscriptions Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Tracing headers ignored in cached auth-hook responses Tracing headers ignored in cached auth-hook responses Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Experimental remove_empty_subscription_responses fixed for non-array queries Experimental remove_empty_subscription_responses fixed for non-array queries Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Data connector mutations correctly handle nullable column updates Data connector mutations correctly handle nullable column updates Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
MySQL self-referencing table queries with filters now work MySQL self-referencing table queries with filters now work Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Snowflake self-referential relationship queries work correctly Snowflake self-referential relationship queries work correctly Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Snowflake adapter handles repeated relationship selections Snowflake adapter handles repeated relationship selections Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
JWKs without use field now allowed, fixing v2.48.4 regression JWKs without use field now allowed, fixing v2.48.4 regression Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Remote schema modification now works with space-containing names Remote schema modification now works with space-containing names Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Metric hasura_http_response_bytes_total excludes internal error fields Metric hasura_http_response_bytes_total excludes internal error fields Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Console properly handles query parameters for REST GET endpoints Console properly handles query parameters for REST GET endpoints Source: llm_adapter@2026-05-21 Confidence: low |
— |
Full changelog
Changelog
This is a patch release for v2.45.
Upgrade notes
Some compatibility notes
- Previously, when remote schema types conflicted with action types, the conflict was silently handled (the remote schema was just excluded). Now it's marked as inconsistent_metadata. Deployments that had conflicting types and appeared to "work" before (just missing some fields) will now show metadata inconsistency errors after upgrade.
- The event trigger log format has changed
- Users who configure the RTS should be aware that this version is now on GHC 9.14.1 (formerly 9.10.1). In particular users of the
--nonmoving-gcmay wish to tune the-For-Fdflags if they set them.
Bug fixes and improvements
Server
- Mark remote schemas as inconsistent when type conflicts occur with the existing schema.
- Fix the
hasura_http_response_bytes_totalmetric so it does not count the size of internal error fields when those fields are not returned to the client. - Set error status and message in OpenTelemetry spans, consistent with reporting in logs. (Enterprise/cloud only)
- Fix active subscriptions EKG gauge going negative due to unconditional decrement in
removeLiveQueryandremoveStreamingQuery. A race condition betweenstopOperationandonClosecould cause double-removal of the same subscriber, leading to the gauge drifting negative over time. The gauge decrement is now guarded to only fire when a subscriber is actually found and removed, matching the existing Prometheus metric guard pattern. - Fix a performance issue where large gzipped responses were causing long cumulative GC sync phase pauses
- When an event trigger was moved from one table to another in Hasura metadata, the old trigger on the original table was not removed. This resulted in duplicate triggers firing for the same event.
- Added
HASURA_GRAPHQL_CACHING_REDIS_POOL_SIZEandHASURA_GRAPHQL_RATE_LIMIT_REDIS_POOL_SIZEoptions, making the limit of pooled connections to Redis configurable. Set the default to 500 (formerly it was 50). (Enterprise/cloud only) - Improve the performance of BigQuery schema introspection when there are many (e.g. hundreds of) tables in sourced datasets. This should improve performance on startup and during metadata operations, such as changing permissions. In the unexpected event that a BigQuery schema introspection-related bug is observed after upgrading,
HASURA_BIGQUERY_SLOW_INTROSPECTION_FALLBACK=truecan be set in the environment to revert to the previous introspection method. - Fix a bug in which the
connection_lifetimepool setting was not correctly set, either as a default or manual setting. This fix may result in improvements to memory usage over time (as bloated libpq client buffers are recycled), and better balancing of connections when DNS load balancing is in use. (Enterprise/cloud only) - Ignore tracing related headers while caching auth-hook responses (Enterprise/cloud only)
- Fix for erroneous "overloaded functions are not supported" error due to oid overlap. This may manifest during a database upgrade during which oids are rewritten.
- Fix a bug in which types from two remote joins with different type prefixes and namespaces might be inter-mixed in the schema.
- Partially fix big in streaming subscriptions on non-unique columns, in which rows may be skipped when the column contains duplicates. The bug is now fixed in Postgres and Citus, but remains for Cockroach and other postgres-likes. In databases that have the fix a batch may now return more rows than the requested
batch_size, which follows from the behavior ofFETCH ... WITH TIESwhich backs these queries. - Allow JWKs that omit the 'use' field, fixing a regression in v2.48.4
- Remove all
value_from_envand known-sensitive header values from event trigger logs, to protect secrets from leaking. - Set
JAVA_OPTS=-Dnet.snowflake.jdbc.enableBouncyCastle=trueto bundled super-connector to support RSA key authentication (Enterprise edition only) - Fix a bug in experimental
remove_empty_subscription_responsesfeature resulting in a database query error for non-array-returning live queries. - The experimental feature
remove_empty_subscription_responseserroneously did not affect streaming subscriptions, only live queries. After this change--experimental-features=remove_empty_subscription_responseswill also work on streaming subscription fields, resulting in less data transferred between hasura and postgres for highly-multiplexed queries which most of the time return no updated data - New metric
hasura_metadata_inconsistencies, which shows the number inconsistencies in the metadata. (Enterprise/cloud only) - Add
AGGREGATE_FUNCTIONto BigQuery rest routine types. - Ignore any unknown key types when parsing JWK-set json: Formerly any JWKs in the list with a
usefield besidessigorencwould result in an error. Now we silently ignore these irrelevant keys. - Added column sorting functionality to the One-off and Cron scheduled events tables.
Console
- Fixed remote schema modification failing when schema names contain spaces
- Fixed an issue where exported OpenAPI specs for REST endpoints with GET operations and query variables incorrectly included a requestBody, causing validation errors in tools like Swagger Editor (Enterprise/cloud only)
- REST endpoints with GET method now properly handle query parameters in the console. (Enterprise/cloud only)
Data Connector
- Fix a bug in the super-connector (MySQL) where queries on self-referencing tables fail with
Relation not foundwhen the SELECT permission filter navigates through the same self-referencing relationship. The internal relationship graph now preserves both the aliased and original table entries during LATERAL subquery generation. (Enterprise/cloud only) - Fix update mutations on nullable columns via data connectors. Previously, attempting to set a column value to
nullin an update mutation would fail because the row update value was not allowed to be nullable. Nullable values are now correctly handled and translated to SQLNULL. (Enterprise/cloud only) - Update SuperConnector libraries and Dockerfile base images for CVE's. (Enterprise/cloud only)
- Fix queries which select self-referential relationships in Snowflake. (Enterprise/cloud only)
- Fixes an issue in the SuperConnector Snowflake adapter which caused errors when performing queries that selected the same relationship more than once. (Enterprise/cloud only)
Breaking Changes
- Remote schema type conflicts with existing action types now produce inconsistent_metadata errors instead of being silently excluded.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Hasura
Fast, instant realtime GraphQL APIs on Postgres with fine grained access control, also trigger webhooks on database events.
Related context
Beta — feedback welcome: [email protected]