Hasura

Hasura 2.50.0 fixes a bug in the mssql backend that could let an authenticated user observe data they were not authorized to see, and all MS SQL Server users are encouraged to upgrade; it also adds an --disable-admin-secret flag to disable x-hasura-admin-secret authentication and requires webhook or JWT auth in that case, adds a cascade option to remove_remote_schema, and fixes Postgres SSL connection failures on FIPS-enabled Ubuntu hosts.

Matters for: Relevant to teams running Hasura against Microsoft SQL Server backends, and to Enterprise/cloud operators who need to lock down admin-secret authentication or deploy the self-hosted Ubuntu image on FIPS-enabled hosts.

This patch closes a bug in the MSSQL backend that could let an authenticated user observe data they were not authorized to see, tightens event trigger name validation to alphanumeric, underscore, and hyphen characters, and fixes a Postgres SSL connection failure on FIPS-enabled Ubuntu hosts by disabling forced FIPS mode in OpenSSL. It also upgrades the Quarkus platform used by the super-connector to remediate a HIGH-severity authorization bypass CVE, and adds an environment variable to enforce metadata consistency during migrations.

Matters for: This matters for teams running Hasura's MS SQL Server backend with row-level authorization rules, and for teams deploying the self-hosted Ubuntu image on FIPS-enabled infrastructure.