Skip to content

Hasura

v2.45.4 Breaking

This release includes 1 breaking change for platform teams planning a safe upgrade.

Published 20d API Development
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

access-control api automatic-api bigquery graphql graphql-server
+8 more
haskell hasura mongodb postgresql rest sql-server subgraph supergraph

Affected surfaces

auth breaking_upgrade

ReleasePort's take

Moderate signal
editorial:auto 13d

Remote schema conflicts now surface as inconsistent_metadata instead of failing silently. Event trigger logs no longer expose secrets; dependency CVEs in SuperConnector patched.

Why it matters: Remote schema type conflicts now block deployments; validate before upgrading. Event trigger logs no longer expose secrets from value_from_env. SuperConnector patched for CVEs. Redis default pool increased 50→500; test with concurrent workloads.

Summary

AI summary

Remote schema type conflicts now cause metadata inconsistency errors, breaking previous silent handling.

Changes in this release

Security Medium

Event trigger logs no longer expose secrets from value_from_env

Event trigger logs no longer expose secrets from value_from_env

Source: llm_adapter@2026-05-21

Confidence: low

Security Medium

SuperConnector updated for CVEs in libraries and dependencies

SuperConnector updated for CVEs in libraries and dependencies

Source: llm_adapter@2026-05-21

Confidence: low

Security Medium

Sensitive values removed from event trigger logs to prevent secret leakage

Sensitive values removed from event trigger logs to prevent secret leakage

Source: granite4.1:30b@2026-05-22-audit

Confidence: low

Security Medium

SuperConnector libraries and Dockerfile base images updated for CVE fixes

SuperConnector libraries and Dockerfile base images updated for CVE fixes

Source: granite4.1:30b@2026-05-22-audit

Confidence: low

Breaking Medium

Remote schema type conflicts now marked as inconsistent_metadata

Remote schema type conflicts now marked as inconsistent_metadata

Source: llm_adapter@2026-05-21

Confidence: high

Breaking Medium

Event trigger log format changed

Event trigger log format changed

Source: llm_adapter@2026-05-21

Confidence: high

Feature Medium

New metric hasura_metadata_inconsistencies shows inconsistency count

New metric hasura_metadata_inconsistencies shows inconsistency count

Source: llm_adapter@2026-05-21

Confidence: high

Feature Medium

Redis pool size now configurable via environment variables

Redis pool size now configurable via environment variables

Source: llm_adapter@2026-05-21

Confidence: low

Feature Medium

Super-connector supports RSA key authentication with BouncyCastle

Super-connector supports RSA key authentication with BouncyCastle

Source: llm_adapter@2026-05-21

Confidence: low

Feature Medium

Redis pool default increased from 50 to 500 connections

Redis pool default increased from 50 to 500 connections

Source: llm_adapter@2026-05-21

Confidence: low

Feature Medium

BigQuery rest routine types now include AGGREGATE_FUNCTION

BigQuery rest routine types now include AGGREGATE_FUNCTION

Source: llm_adapter@2026-05-21

Confidence: low

Feature Low

Super‑connector sets JAVA_OPTS to enable BouncyCastle for RSA key authentication (Enterprise edition only)

Super‑connector sets JAVA_OPTS to enable BouncyCastle for RSA key authentication (Enterprise edition only)

Source: granite4.1:30b@2026-05-22-audit

Confidence: high

Feature Low

Redis pool size configurable via HASURA_GRAPHQL_CACHING_REDIS_POOL_SIZE and HASURA_GRAPHQL_RATE_LIMIT_REDIS_POOL_SIZE

Redis pool size configurable via HASURA_GRAPHQL_CACHING_REDIS_POOL_SIZE and HASURA_GRAPHQL_RATE_LIMIT_REDIS_POOL_SIZE

Source: granite4.1:30b@2026-05-22-audit

Confidence: low

Dependency Medium

Runtime upgraded to GHC 9.14.1 from 9.10.1

Runtime upgraded to GHC 9.14.1 from 9.10.1

Source: llm_adapter@2026-05-21

Confidence: high

Performance Medium

Large gzipped responses no longer cause excessive GC sync pauses

Large gzipped responses no longer cause excessive GC sync pauses

Source: llm_adapter@2026-05-21

Confidence: high

Performance Medium

BigQuery schema introspection performance improved for many tables

BigQuery schema introspection performance improved for many tables

Source: llm_adapter@2026-05-21

Confidence: high

Bugfix Medium

Active subscriptions gauge no longer goes negative due to race condition

Active subscriptions gauge no longer goes negative due to race condition

Source: llm_adapter@2026-05-21

Confidence: high

Bugfix Medium

Event triggers removed when moved between tables in metadata

Event triggers removed when moved between tables in metadata

Source: llm_adapter@2026-05-21

Confidence: high

Bugfix Medium

Connection lifetime pool setting now correctly applied

Connection lifetime pool setting now correctly applied

Source: llm_adapter@2026-05-21

Confidence: high

Bugfix Medium

Overloaded function error fixed during database oid rewriting

Overloaded function error fixed during database oid rewriting

Source: llm_adapter@2026-05-21

Confidence: high

Bugfix Medium

Remote join types no longer mixed when prefixes and namespaces differ

Remote join types no longer mixed when prefixes and namespaces differ

Source: llm_adapter@2026-05-21

Confidence: high

Bugfix Medium

Streaming subscriptions on non-unique columns fixed for Postgres

Streaming subscriptions on non-unique columns fixed for Postgres

Source: llm_adapter@2026-05-21

Confidence: high

Bugfix Medium

OpenAPI specs for REST GET endpoints no longer include requestBody

OpenAPI specs for REST GET endpoints no longer include requestBody

Source: llm_adapter@2026-05-21

Confidence: high

Bugfix Medium

Experimental remove_empty_subscription_responses applies to streaming subscriptions

Experimental remove_empty_subscription_responses applies to streaming subscriptions

Source: llm_adapter@2026-05-21

Confidence: high

Bugfix Medium

Tracing headers ignored in cached auth-hook responses

Tracing headers ignored in cached auth-hook responses

Source: llm_adapter@2026-05-21

Confidence: high

Bugfix Medium

Experimental remove_empty_subscription_responses fixed for non-array queries

Experimental remove_empty_subscription_responses fixed for non-array queries

Source: llm_adapter@2026-05-21

Confidence: high

Bugfix Medium

Data connector mutations correctly handle nullable column updates

Data connector mutations correctly handle nullable column updates

Source: llm_adapter@2026-05-21

Confidence: low

Bugfix Medium

MySQL self-referencing table queries with filters now work

MySQL self-referencing table queries with filters now work

Source: llm_adapter@2026-05-21

Confidence: low

Bugfix Medium

Snowflake self-referential relationship queries work correctly

Snowflake self-referential relationship queries work correctly

Source: llm_adapter@2026-05-21

Confidence: low

Bugfix Medium

Snowflake adapter handles repeated relationship selections

Snowflake adapter handles repeated relationship selections

Source: llm_adapter@2026-05-21

Confidence: low

Bugfix Medium

JWKs without use field now allowed, fixing v2.48.4 regression

JWKs without use field now allowed, fixing v2.48.4 regression

Source: llm_adapter@2026-05-21

Confidence: low

Bugfix Medium

Remote schema modification now works with space-containing names

Remote schema modification now works with space-containing names

Source: llm_adapter@2026-05-21

Confidence: low

Bugfix Medium

Metric hasura_http_response_bytes_total excludes internal error fields

Metric hasura_http_response_bytes_total excludes internal error fields

Source: llm_adapter@2026-05-21

Confidence: low

Bugfix Medium

Console properly handles query parameters for REST GET endpoints

Console properly handles query parameters for REST GET endpoints

Source: llm_adapter@2026-05-21

Confidence: low

Full changelog

Changelog

This is a patch release for v2.45.

Upgrade notes

Some compatibility notes

  1. Previously, when remote schema types conflicted with action types, the conflict was silently handled (the remote schema was just excluded). Now it's marked as inconsistent_metadata. Deployments that had conflicting types and appeared to "work" before (just missing some fields) will now show metadata inconsistency errors after upgrade.
  2. The event trigger log format has changed
  3. Users who configure the RTS should be aware that this version is now on GHC 9.14.1 (formerly 9.10.1). In particular users of the --nonmoving-gc may wish to tune the -F or -Fd flags if they set them.

Bug fixes and improvements

Server

  • Mark remote schemas as inconsistent when type conflicts occur with the existing schema.
  • Fix the hasura_http_response_bytes_total metric so it does not count the size of internal error fields when those fields are not returned to the client.
  • Set error status and message in OpenTelemetry spans, consistent with reporting in logs. (Enterprise/cloud only)
  • Fix active subscriptions EKG gauge going negative due to unconditional decrement in removeLiveQuery and removeStreamingQuery. A race condition between stopOperation and onClose could cause double-removal of the same subscriber, leading to the gauge drifting negative over time. The gauge decrement is now guarded to only fire when a subscriber is actually found and removed, matching the existing Prometheus metric guard pattern.
  • Fix a performance issue where large gzipped responses were causing long cumulative GC sync phase pauses
  • When an event trigger was moved from one table to another in Hasura metadata, the old trigger on the original table was not removed. This resulted in duplicate triggers firing for the same event.
  • Added HASURA_GRAPHQL_CACHING_REDIS_POOL_SIZE and HASURA_GRAPHQL_RATE_LIMIT_REDIS_POOL_SIZE options, making the limit of pooled connections to Redis configurable. Set the default to 500 (formerly it was 50). (Enterprise/cloud only)
  • Improve the performance of BigQuery schema introspection when there are many (e.g. hundreds of) tables in sourced datasets. This should improve performance on startup and during metadata operations, such as changing permissions. In the unexpected event that a BigQuery schema introspection-related bug is observed after upgrading, HASURA_BIGQUERY_SLOW_INTROSPECTION_FALLBACK=true can be set in the environment to revert to the previous introspection method.
  • Fix a bug in which the connection_lifetime pool setting was not correctly set, either as a default or manual setting. This fix may result in improvements to memory usage over time (as bloated libpq client buffers are recycled), and better balancing of connections when DNS load balancing is in use. (Enterprise/cloud only)
  • Ignore tracing related headers while caching auth-hook responses (Enterprise/cloud only)
  • Fix for erroneous "overloaded functions are not supported" error due to oid overlap. This may manifest during a database upgrade during which oids are rewritten.
  • Fix a bug in which types from two remote joins with different type prefixes and namespaces might be inter-mixed in the schema.
  • Partially fix big in streaming subscriptions on non-unique columns, in which rows may be skipped when the column contains duplicates. The bug is now fixed in Postgres and Citus, but remains for Cockroach and other postgres-likes. In databases that have the fix a batch may now return more rows than the requested batch_size, which follows from the behavior of FETCH ... WITH TIES which backs these queries.
  • Allow JWKs that omit the 'use' field, fixing a regression in v2.48.4
  • Remove all value_from_env and known-sensitive header values from event trigger logs, to protect secrets from leaking.
  • Set JAVA_OPTS=-Dnet.snowflake.jdbc.enableBouncyCastle=true to bundled super-connector to support RSA key authentication (Enterprise edition only)
  • Fix a bug in experimental remove_empty_subscription_responses feature resulting in a database query error for non-array-returning live queries.
  • The experimental feature remove_empty_subscription_responses erroneously did not affect streaming subscriptions, only live queries. After this change --experimental-features=remove_empty_subscription_responses will also work on streaming subscription fields, resulting in less data transferred between hasura and postgres for highly-multiplexed queries which most of the time return no updated data
  • New metric hasura_metadata_inconsistencies, which shows the number inconsistencies in the metadata. (Enterprise/cloud only)
  • Add AGGREGATE_FUNCTION to BigQuery rest routine types.
  • Ignore any unknown key types when parsing JWK-set json: Formerly any JWKs in the list with a use field besides sig or enc would result in an error. Now we silently ignore these irrelevant keys.
  • Added column sorting functionality to the One-off and Cron scheduled events tables.

Console

  • Fixed remote schema modification failing when schema names contain spaces
  • Fixed an issue where exported OpenAPI specs for REST endpoints with GET operations and query variables incorrectly included a requestBody, causing validation errors in tools like Swagger Editor (Enterprise/cloud only)
  • REST endpoints with GET method now properly handle query parameters in the console. (Enterprise/cloud only)

Data Connector

  • Fix a bug in the super-connector (MySQL) where queries on self-referencing tables fail with Relation not found when the SELECT permission filter navigates through the same self-referencing relationship. The internal relationship graph now preserves both the aliased and original table entries during LATERAL subquery generation. (Enterprise/cloud only)
  • Fix update mutations on nullable columns via data connectors. Previously, attempting to set a column value to null in an update mutation would fail because the row update value was not allowed to be nullable. Nullable values are now correctly handled and translated to SQL NULL. (Enterprise/cloud only)
  • Update SuperConnector libraries and Dockerfile base images for CVE's. (Enterprise/cloud only)
  • Fix queries which select self-referential relationships in Snowflake. (Enterprise/cloud only)
  • Fixes an issue in the SuperConnector Snowflake adapter which caused errors when performing queries that selected the same relationship more than once. (Enterprise/cloud only)

Breaking Changes

  • Remote schema type conflicts with existing action types now produce inconsistent_metadata errors instead of being silently excluded.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Hasura

Get notified when new releases ship.

Sign up free

About Hasura

Fast, instant realtime GraphQL APIs on Postgres with fine grained access control, also trigger webhooks on database events.

All releases →

Beta — feedback welcome: [email protected]