redb 4.0 Released: XML Routes, Lazy References, Unique Keys and WS-Trust Across the Ecosystem
redb 4.0 delivers a coordinated major release across the entire ecosystem, updating redb.Core, redb.Route, redb.Tsak and redb.Identity in a single 4.0.0 version. Seventy-six NuGet packages, seven container images in GHCR and archives for Windows and Linux are now published. The Pro edition remains free and does not require a license key on the entire 4.x line.
redb.Route receives ten new packages and a substantial engine redesign. Declarative routes can now be defined in .route.xml files using the new redb.Route.Xml package and loaded into the same fluent DSL used for C# routes. The redb.Route.TestKit allows testing without brokers or route modifications through AdviceRoute, MockEndpoints and NotifyBuilder. Additional packages provide Scriban and Liquid templates, CSV, Protobuf, Avro and YAML data formats, JSONata transformations, in-memory or distributed caching, and XPath 2.0 support.
The routing engine now uses a single expression language and compiler for conditions, values and templates. New functions include stats, format, uuid and the modulo operator. The bean component allows custom objects to be used as endpoints with dependency injection. REST DSL, OpenAPI 3.0.3 generation, OpenTelemetry metrics inside routes and removal of Newtonsoft.Json in favour of System.Text.Json are also included.
Hosting improvements cover concurrent request limits with 429 responses, automatic consumer scaling for RabbitMQ, AMQP 1.0, IBM MQ, SQS and MQTT, WebSocket and SignalR support on the shared Kestrel host, and trusted proxy handling for X-Forwarded headers. Kafka consumers now preserve unprocessed records on partition revocation, and connectors for S3, Firebase and LLM providers received multiple stability and feature updates.
redb.Core introduces lazy references that load only on first access to Props when EnableLazyReferences is active, and unique keys via the new ValueUnique mechanism and [RedbUnique] attribute. Unique constraints are enforced by database indexes for scalars, nested objects, collections and entire subtrees. Schema upgrades are applied at startup with typed exceptions when rights are insufficient. CancellationToken support, save interceptors, per-request isolation levels and maintenance operations such as AnalyzeAsync are now available across PostgreSQL, MSSQL and SQLite.
redb.Tsak cluster coordination now relies on unique database keys from redb.Core. XML-only modules can be loaded and reloaded at runtime. The dashboard distinguishes load shedding from idle routes, Audit and Dead-letter pages are functional on PostgreSQL, and trusted proxy configuration is exposed for API throttling.
redb.Identity adds a WS-Trust SOAP facade supporting Issue, Validate, Cancel and Renew operations. Access tokens now include audience claims according to RFC 9068. The administrative console has been rebuilt with full pages instead of dialogs, and DPoP support behind TLS-terminating proxies has been improved.
Several security issues were addressed. Internal headers are now stripped on all three identity facades. Consent pages validate signed tickets and Origin headers. Introspection responses are restricted to token audiences. Dashboard pages require authentication with role-based access. Module signatures are verified on every load path, and the default password hasher is now bcrypt.
Clusters must be fully stopped before upgrading because mixed versions are unsupported. Large databases require a maintenance window for schema changes performed under exclusive locks. Full change logs are published at redb.ru/releases.
Related articles
How a Personal Site Counts Bots Without Storing Any IPs: Pure PHP, No Database, Strict CSP and 160 Tests
A personal website built entirely in pure PHP without frameworks or databases demonstrates advanced defensive security practices while tracking bot activity from an SSH honeypot. The site stores all content in a single JSON file with atomic writes and automatic backups, eliminating database-related attack surfaces and simplifying deployment to folder copying. Strict Content-Security-Policy rules prohibit inline styles and scripts without nonces, forcing the use of SVG attributes, CSSOM updates, and JSON data blocks instead of direct attribute injection. Over 160 automated tests written in PHP attack the site with XSS payloads, CSRF attempts, path traversals, and malformed Markdown to verify that no malicious output reaches the browser. Bot identification relies on behavioral signatures derived from the first twelve cleaned commands of each session, combined with HASSH fingerprints and activity patterns, allowing the site to report unique bot families and address counts without ever publishing IPs. Additional browser-based tests using Chromium validate accessibility, performance budgets, and CSP compliance across desktop and mobile viewports. The entire system runs with zero external dependencies and integrates tests directly into the deployment pipeline.
Russian Finance Ministry Seeks Central Bank Reports on Systematic P2P Transfers to Tax Authorities
The Russian Ministry of Finance has proposed amendments requiring the Central Bank to share data with the Federal Tax Service on individuals whose bank accounts show signs of regular income received from other private citizens. The changes target article 85 of the Tax Code and form part of the budget package bill numbered 617-9. Under the new rules, the Central Bank would identify such citizens through transaction analysis and transmit the information according to a future agreement with the tax service. The Federal Tax Service would also gain expanded powers to request bank statements from non-entrepreneurs without needing prior debt collection or audit triggers. If approved, the provisions would take effect on 1 January 2027 and apply to operations conducted after 1 January 2026. Separate bills under discussion would impose monthly transfer limits of 30,000 rubles on suspected clients starting in 2028 and require the tax service to notify the Central Bank about account openings and income categories.
Baidu Launches Ciyuan Exchange to Establish Trust Standards for AI Model Trading
Baidu Intelligent Cloud has introduced the Ciyuan Exchange, a dedicated trading platform for large AI models that aims to solve quality verification and credit issues in an increasingly crowded market. The platform, unveiled at the Baidu World 2026 Conference, already hosts over 100 supply resources with daily calls exceeding 50 million and daily token usage surpassing 700 billion. Founder Li Yanhong positioned the exchange as an infrastructure layer that moves beyond simple model aggregation toward verifiable identity, ongoing performance monitoring, and supplier credit records. The initiative addresses real procurement risks where identical models from different providers show up to twofold differences in throughput and reliability, according to a China Academy of Information and Communications Technology report. By combining model fingerprinting, capability testing, periodic audits, and continuous credit scoring, the platform seeks to create transparent market mechanisms similar to commodity exchanges. This development signals a broader industry shift from raw model capability competition toward standardized service quality, pricing transparency, and reliable delivery infrastructure.
Windows and MacBook Pro Setup Combines Local Network Access with Dual VPNs and Kill Switch Protection
A user detailed how they integrated an older MacBook Pro into an existing Windows workstation environment while preserving separate user accounts, file sharing, and independent VPN connections. The setup required careful routing configuration to keep the Kill Switch active on both Amnezia VLESS and AmneziaWG without breaking local SMB connectivity. After initial failures caused by the Windows Kill Switch blocking the 192.168.1.0/24 subnet, split tunneling was implemented to route local traffic directly. Separate macOS accounts were created for daily use and a dedicated “Serverok” account for remote scripting and compute tasks. SSH and SFTP ultimately replaced problematic SMB shares for the secondary account, enabling reliable file transfers at over 50 MB/s. The configuration allows simultaneous or sequential use of both machines while maintaining strong VPN protection on each.