redb 3.7.2 Released with Custom gRPC Protocol, Dependency Vulnerability Fixes and .NET 10 Migration
The redb ecosystem published three consecutive releases—3.7.0, 3.7.1 and 3.7.2—within three days after version 3.7.0 was withdrawn from nuget.org. The withdrawn build targeted .NET 9 and carried high-severity vulnerabilities in its published artifacts.
NuGet audit only surfaced the problems during a full rebuild; incremental builds had masked the issues. Affected packages included SSH.NET 2025.1.0 (GHSA-q939-rpr3-3284) in redb.Route.Sftp, transitive SSH.NET 2024.2.0 via Testcontainers 4.3.0, SQLitePCLRaw.lib.e_sqlite3 2.1.10 through Microsoft.Data.Sqlite 9.0.3, System.Security.Cryptography.Xml 9.0.4 from Microsoft.AspNetCore.DataProtection 9.0.4, and Microsoft.Bcl.Memory 9.0.0 via OpenIddict.Abstractions.
All libraries were updated and the entire stack migrated to .NET 10. redb.Tsak and redb.Identity now declare the same multi-targeting matrix (net8.0;net9.0;net10.0) already used by redb.Core and redb.Route. Host applications and container images are pinned to net10.0.
redb.Route: native gRPC wire protocol
The largest change replaces the previous Grpc.AspNetCore dependency with a custom GrpcWire implementation. Each gRPC method address is now registered as an independent route on the shared Kestrel instance already serving HTTP, AS2 and SOAP traffic. The wire format implements length-prefixed framing, grpc-status and grpc-message trailers, and grpc-timeout deadlines.
Applications can now expose typed .proto services without server stubs, stream in both directions via IAsyncEnumerable, enforce mTLS with certificate pinning, and serve the standard grpc.health.v1.Health/Check endpoint. Interoperability was validated against the Node.js @grpc/grpc-js client in both directions.
Additional redb.Route features
A new redb.Route.Soap connector supports SOAP 1.1/1.2 envelopes, WS-Security, MTOM/XOP and WSDL publication. Control Bus operations (start, stop, suspend, resume, status) are now available via messaging, including an asynchronous notify consumer for route lifecycle events. The Claim Check pattern was completed so that Set/Get operations can safely park message bodies around enrichment steps.
Critical file-transport defects were fixed: readLock=Rename and FileLock no longer return empty payloads, idempotency keys are released on error, and path validation now uses directory-boundary checks to prevent escape via ../ or absolute paths.
Security and compatibility notes
Two behavioral changes were introduced for gRPC producers: ThrowOnError defaults to true and status mapping is enabled by default. Existing behavior can be restored with throwOnError=false or suppressStatusMapping=true. .NET 8 and .NET 9 reach end of support on 10 November 2026; redb.CLI now requires .NET 10.
Related articles
CodeScoring Launches CodeScoring.Save Artifact Repository for Secure Enterprise Development
CodeScoring has introduced its own artifact storage solution called CodeScoring.Save, designed to handle packages, libraries, container images, and other software components used in development. The product targets corporate users of any size seeking a predictable and resilient repository that integrates security checks directly into storage and distribution workflows. Built in Go for modern Kubernetes environments, Save supports multiple package formats including Maven, npm, NuGet, PyPI, Go Modules, Docker/OCI, DEB, and RPM while providing proxy access to external repositories. It features role-based access, auditing, independent scaling of compute and storage layers, and native integration with CodeScoring.OSA to surface vulnerability data inside the repository itself. The company positions Save as a standalone local deployment option that can operate independently or alongside its existing OSA Proxy module to block malicious components at the repository level. Future plans include support for AI models as artifacts, starting with storage and distribution for ecosystems such as Hugging Face, along with certification for Russian secure development requirements.
WordPress to Automatically Block High-Risk Plugin Updates Before Distribution
WordPress is introducing an automated security screening process for every new plugin release before it reaches millions of sites through the WordPress.org API. Updates flagged with high risk will be blocked from automatic installation, giving developers time to address issues. Previously, only initial plugin submissions were reviewed, while subsequent versions could introduce vulnerabilities, backdoors, or malicious ownership changes without checks. Each release now undergoes a six-hour delay under the Protect The Shire initiative, where multiple AI models and Jetpack Scan analyze changes to produce a combined risk score. High-risk updates are withheld from auto-updates, and developers receive detailed reports. The system has already proven effective by catching a backdoor in a plugin with around 20,000 active installations on July 28, preventing distribution after Wordfence notification. Developers can fix problems and resubmit, or appeal results, though fixing is usually faster than manual review.
Twitch Enhanced Viewer Extension Leaks OAuth Tokens From Nearly 31,000 Users
The browser extension Twitch Enhanced Viewer | JeetBot, available in the official Chrome Web Store and Mozilla Add-ons, secretly forwarded OAuth session tokens to proxies controlled by its operator. These bearer tokens allow full account takeover without passwords or second-factor authentication, enabling actions such as reading and sending whispers, posting in chat, and modifying account settings. The issue surfaced prominently in the v85.x branch where tokens were appended as the &auth= query parameter during network redirects to operator-controlled proxy servers, exposing them in clear text within proxy logs. Earlier v4.x versions had already transmitted tokens via POST requests to a set-token endpoint and backup servers on deno.dev and deno.net. A fix appeared in Firefox version 85.8.7 that stops token exfiltration by altering playlist retrieval, while a Chrome patch is in preparation. Users are advised to uninstall the extension immediately, revoke all active Twitch sessions, and review recent account activity for signs of unauthorized use.
Twitch Enhanced Viewer Extension Leaks OAuth Tokens from Nearly 31,000 Users
The browser extension Twitch Enhanced Viewer | JeetBot, available in the official Chrome Web Store and Mozilla Add-ons, secretly forwarded OAuth session tokens to proxies controlled by its operator. These bearer tokens allow full account takeover without passwords or second-factor authentication, enabling actions such as reading and sending whispers, posting in chat, and modifying account settings. The issue became especially severe in the v85.x branch, where tokens were appended as the &auth= query parameter during network redirects to the operator’s proxy servers, exposing them in clear text within proxy logs. Earlier versions had already transmitted tokens via POST requests to a set-token endpoint and maintained backup endpoints on deno.dev and deno.net. A fix is available in Firefox starting with version 85.8.7, which stops token exfiltration by changing the playlist retrieval method, while a corresponding Chrome patch is in preparation. Users are advised to uninstall the extension immediately, revoke all active Twitch sessions, and review recent account activity for signs of unauthorized use.