redb 4.0 Released: XML Routes, Lazy References, Unique Keys and WS-Trust Across the Ecosystem
redb 4.0 delivers a coordinated major release across the entire ecosystem, updating redb.Core, redb.Route, redb.Tsak and redb.Identity in a single 4.0.0 version. Seventy-six NuGet packages, seven container images in GHCR and archives for Windows and Linux are now published. The Pro edition remains free and does not require a license key on the entire 4.x line.
redb.Route receives ten new packages and a substantial engine redesign. Declarative routes can now be defined in .route.xml files using the new redb.Route.Xml package and loaded into the same fluent DSL used for C# routes. The redb.Route.TestKit allows testing without brokers or route modifications through AdviceRoute, MockEndpoints and NotifyBuilder. Additional packages provide Scriban and Liquid templates, CSV, Protobuf, Avro and YAML data formats, JSONata transformations, in-memory or distributed caching, and XPath 2.0 support.
The routing engine now uses a single expression language and compiler for conditions, values and templates. New functions include stats, format, uuid and the modulo operator. The bean component allows custom objects to be used as endpoints with dependency injection. REST DSL, OpenAPI 3.0.3 generation, OpenTelemetry metrics inside routes and removal of Newtonsoft.Json in favour of System.Text.Json are also included.
Hosting improvements cover concurrent request limits with 429 responses, automatic consumer scaling for RabbitMQ, AMQP 1.0, IBM MQ, SQS and MQTT, WebSocket and SignalR support on the shared Kestrel host, and trusted proxy handling for X-Forwarded headers. Kafka consumers now preserve unprocessed records on partition revocation, and connectors for S3, Firebase and LLM providers received multiple stability and feature updates.
redb.Core introduces lazy references that load only on first access to Props when EnableLazyReferences is active, and unique keys via the new ValueUnique mechanism and [RedbUnique] attribute. Unique constraints are enforced by database indexes for scalars, nested objects, collections and entire subtrees. Schema upgrades are applied at startup with typed exceptions when rights are insufficient. CancellationToken support, save interceptors, per-request isolation levels and maintenance operations such as AnalyzeAsync are now available across PostgreSQL, MSSQL and SQLite.
redb.Tsak cluster coordination now relies on unique database keys from redb.Core. XML-only modules can be loaded and reloaded at runtime. The dashboard distinguishes load shedding from idle routes, Audit and Dead-letter pages are functional on PostgreSQL, and trusted proxy configuration is exposed for API throttling.
redb.Identity adds a WS-Trust SOAP facade supporting Issue, Validate, Cancel and Renew operations. Access tokens now include audience claims according to RFC 9068. The administrative console has been rebuilt with full pages instead of dialogs, and DPoP support behind TLS-terminating proxies has been improved.
Several security issues were addressed. Internal headers are now stripped on all three identity facades. Consent pages validate signed tickets and Origin headers. Introspection responses are restricted to token audiences. Dashboard pages require authentication with role-based access. Module signatures are verified on every load path, and the default password hasher is now bcrypt.
Clusters must be fully stopped before upgrading because mixed versions are unsupported. Large databases require a maintenance window for schema changes performed under exclusive locks. Full change logs are published at redb.ru/releases.
Related articles
Context is Everything: How to Avoid Drowning in Security Incidents and Distinguish Employees from Attackers
The article explains that false positives in security systems often stem from missing business context rather than technical flaws. It outlines three levels of filtering that combine process rules, access logs, and job-specific behavior to rank risk accurately. Behavioral analysis tools like UEBA can help but require proper training and human oversight to avoid generating more noise. Key metrics focus on reducing false alerts, improving MTTD and MTTR, and minimizing daily administration time. For smaller companies without dedicated SOC teams, the guidance emphasizes starting with log collection, identifying existential risks, and aligning policies with real business processes. The piece stresses that technology alone cannot replace analysts who deeply understand company operations.
Astra Automation 2.1 Adds Dashboard to Quantify Automation ROI for IT Infrastructure
Group Astra has released Astra Automation 2.1, an updated version of its centralized IT infrastructure management platform. The key addition is the Automation Dashboard, which tracks job execution statistics including run frequency, duration, success rates, and scenario popularity to help organizations determine whether automation delivers measurable value. Built on Ansible, the platform supports automation of server, cloud, and network environments for tasks such as mass operations, configuration management, and software deployment. New economic metrics calculate time savings and ROI to assist executives in evaluating the return on automation investments. All components can now be deployed in containers, simplifying operations in modern corporate setups, while an enhanced Fast Fail mechanism performs pre-installation checks on time synchronization, network reachability, disk space, load balancers, and the Automation Gateway database.
Hashcat Password Cracking: Why Complex Passwords Like Summer2026! Often Fail First
Password cracking tools such as hashcat and John the Ripper exploit predictable human patterns when generating candidates, allowing structured passwords to be recovered faster than truly random strings. The process relies on comparing computed hashes against stored values without needing to reverse the one-way function. Modern password storage uses salted, computationally expensive algorithms including bcrypt, Argon2id, sha512crypt and yescrypt to increase the cost of each guess. Different formats require specific hashcat modes, and parameters such as cost factors or memory settings directly affect cracking speed. WordPress 6.8 introduced bcrypt with SHA-384 preprocessing while older phpass records remain supported. Audits must preserve full hash records, verify modes on test data, and combine dictionaries, rules, masks and statistical models to measure real risk. After testing, organizations should migrate to properly tuned Argon2id and enforce long unique passphrases managed by password managers.
Why HTTP to HTTPS Redirects Fall Short: Risks of Exposed Requests and the Role of HSTS Preload
A simple HTTP to HTTPS redirect satisfies basic audit requirements but leaves the initial request fully exposed in plaintext. The request carries the full path, query parameters, and cookies lacking the Secure flag, allowing observers on open Wi-Fi or compromised routers to read or tamper with traffic before TLS begins. Modern browsers such as Chrome since version 90 attempt HTTPS first, yet legacy clients, explicit http:// links in emails, scripts, and failed HTTPS fallbacks continue to send unprotected requests. HSTS instructs browsers to use HTTPS after the first successful visit, yet the header itself travels over HTTPS and cannot protect the very first connection from a new device or cleared cache. Preloading embeds the rule directly in the browser, eliminating the initial plaintext request entirely, but demands includeSubDomains and a one-year max-age, making the change effectively irreversible for months. The article recommends verifying Secure flags on all cookies, ensuring single-step redirects to the same host, and testing HSTS incrementally before considering preload.