Changed

• Built on redb 4.7.2 and redb.Route 4.7.2. The images and archives take the SQLite fix of redb 4.7.2: a save repeated
  after a rolled-back transaction no longer overwrites another object. redb.Tsak itself has no change.

Security

• Archives ship the .NET 10.0.15 runtime, SignalR client dependencies are patched. The self-contained archives
  carried the 10.0.14 runtime, affected by CVE-2026-114147 (ASP.NET Core denial of service); they now carry 10.0.15.
  The container images already run on the patched base. Replace the archive or pull the new image.

Fixed

• Dashboard log lines show their date. The Logs page (Live tab) and the node's Logs tab showed only the time of a
  line; they now show yyyy-MM-dd HH:mm:ss.fff in the node's time zone, with the UTC offset in the tooltip. The Files
  tab labels its modification time as UTC. Packages: redb.Tsak.Web.
• The cluster dashboard waits for the redb schema on its first start instead of failing once. Against an empty
  database it no longer logs a hosting failure before the worker has created the schema: it waits, up to 300 s by
  default (Tsak:Web:SchemaWaitSeconds, 0 keeps the old behaviour), and then fails with a message naming the cause. Packages: redb.Tsak.Web.Pro.

Added

• The worker ships the xmljson data format. A route package can convert XML to JSON and back with
  <dataFormat type="redb.Route.DataFormats.XmlJson.XmlJsonDataFormat, redb.Route.DataFormats.XmlJson">, <marshal type>
  or MarshalXmlJson on the worker without carrying redb.Route.DataFormats.XmlJson.dll in the package.

Deprecated

• .NET 8 and .NET 9 targets end with 4.7. Microsoft's support for both ends on 10 November 2026, so 4.7.0 is the
  last release whose packages target them; from 4.8.0 the packages target .NET 10 and later. The images already run on
  .NET 10 and do not change. Fixes on the 4.7.x line are still built for .NET 8, 9 and 10 while those lines can be built
  without known vulnerabilities. Move projects that reference the packages to .NET 10 before taking 4.8.

Earlier versions

Earlier releases are archived by line in changelog/: 4.6.x, 4.5.x, 4.4.x, 4.3.x, 4.2.x, 4.1.x, 4.0.x, 3.x, 2.x, 1.x.
The worker's development log of March 2026, before the versioned releases, is
changelog/worker-devlog-2026-03.md.

Changed

• Built on redb 4.6.2 and redb.Route 4.6.2. No change in Tsak itself: the worker, its images and archives move to
  4.6.2 with the rest of the ecosystem. Nothing to do on your side.

Changed

• Built on redb 4.6.1 and redb.Route 4.6.1. The worker, its images and archives carry the SQL Server integer
  average fix of redb and the AS4 fixes of redb.Route (issuer-serial key references, malformed base64, the receipt of
  a duplicate, the refusal codes the eDelivery tests expect). No change in Tsak itself; nothing to do on your side.

Added

• A pipeline can ask a node how to deploy a package. GET /api/health/deploy answers 200 hot-swap (copy it into
  modules/) or 409 cold-deploy with reason codes (stop, replace the packages, start); /api/health/deploy/cluster
  asks every node, and tsak system deploy-advice [--cluster] exits 0 or 3. No API key needed, like the probes.
  DEPLOYMENT.md, "Deploy advice in a pipeline", has the steps for Kubernetes and for compose with TeamCity. Packages: redb.Tsak.Core, redb.Tsak.Core.Pro, redb.Tsak.Contracts, redb.Tsak.Client, redb.Tsak.CLI.
• A node shows how many old module versions stay in memory after hot swaps. GET /api/system/info, the
  diagnostic dump, the dashboard node page and tsak system info show ModuleContextsAlive and OrphanedModuleContexts.
  The new hotreload health check turns Degraded above Tsak:HotReload:MaxOrphanedContexts (default KeepVersions + 3)
  and says to restart the node; DEPLOYMENT.md, "After a series of hot swaps", has the procedure. Packages: redb.Tsak.Core, redb.Tsak.Contracts, redb.Tsak.CLI.

Changed

• With Tsak:HotReload:Collectible=true Tsak checks that a replaced module version really leaves memory. One still
  alive after the check is logged as a warning (module context ... still alive after 10 collections) and counted.
  HotReloadService.LeakedAlcCount now counts the old versions still in memory in both modes, the same number as
  OrphanedModuleContexts; it used to count only swaps with Collectible=false. The default stays false. The cluster
  record _tsak_metrics gains both counts; a node of an older version does not write them, its record reads 0. Packages: redb.Tsak.Core.

Fixed

• A hot swap no longer keeps old module versions in memory that it should release. The first swap of a package
  loaded at startup kept its old version, with Collectible=true as well, and each reload of a package with companion
  DLLs kept the throwaway context of its pre-load check, in both modes. Nothing to change on your side. Packages: redb.Tsak.Core.

Earlier versions

Earlier releases are archived by line in changelog/: 4.5.x, 4.4.x, 4.3.x, 4.2.x, 4.1.x, 4.0.x, 3.x, 2.x, 1.x.
The worker's development log of March 2026, before the versioned releases, is
changelog/worker-devlog-2026-03.md.

Fixed

• A C# module (InitRoute) that loads XML resolves <bean type> from its own package. After a hot reload the type
  came from the previous version of the package, and a property the new version added was "not writable". An own
  IBeanTypeResolver registered in InitRoute to work around this can be removed. Packages: redb.Tsak.Core.

Added

• Requests refused as the caller's fault show on the dashboard and in the CLI. An endpoint's Refused counter (an AS4
  or SOAP message with a bad signature, a broken envelope, an unknown agreement) appears next to Rejected on the overview,
  the endpoint and route pages and in tsak diagnostics, with the reason of the last refusal; a route that refuses requests
  is listed among the things that need attention. These refusals count no error, so before they did not show at all. Packages: redb.Tsak.Contracts, redb.Tsak.Core, redb.Tsak.Web, redb.Tsak.CLI.
• The dead-letter store keeps the message attachments. A failed exchange captured at a .Replayable(...) checkpoint
  is replayed with its attachments (names, types and content). The tsak_dlq table gets an attachments_json column on
  startup; entries captured before the upgrade are replayed as before. Packages: redb.Tsak.Core.
• The worker carries the MIME multipart data format. A module can call AddMimeMultipartDataFormat() from
  redb.Route.DataFormats.Mime on a Tsak worker without shipping the package in its own .tpkg, like the CSV, YAML, Avro
  and Protobuf formats.

Changed

• A {Module}.config.json beside a .tpkg overrides the one inside the package. The package's own config used to win
  over the file on disk, so a deployment could not change a package's value without repacking it. The context name follows
  the same order. Only a folder with both files holding different values for one key behaves differently. Packages: redb.Tsak.Core. Upgrade: UPGRADING.md.

Fixed

• A Contexts section in the config inside a .tpkg is applied. The <Module>.config.json embedded in a package
  was read flat: a Contexts section became one property, and its values never reached the context. It is now read like
  context.json and the file on disk: Contexts.default, then the module's own context. A flat file works as before. Packages: redb.Tsak.Core.
• <rest> and from http:// in an XML module work on the worker. A module's context had https and wss but not
  http and ws, and such a module failed to start with "No component registered for scheme 'http'". The fix is in
  redb.Route.Http and redb.Route.WebSocket, which this release uses. Packages: redb.Tsak.Core.
• A SQL module in XML works on the worker. Such a module failed with "provider not registered" unless its provider
  happened to be the one of the audit log. The worker now registers Npgsql, Microsoft.Data.SqlClient and
  Microsoft.Data.Sqlite at start; name one of them as ProviderName or provider=. Packages: redb.Tsak.Core.
• "AutoStart": false in a module's config is honoured. A context's AutoStart was read only from appsettings, so the
  value in a package's {Module}.config.json, the file beside it or context.json had no effect and the context always
  started. It is now read from the merged layers; Tsak:Contexts:{name}:AutoStart in appsettings still overrides them. Packages: redb.Tsak.Core.
• An XML module that reads a file from resources/ starts on the worker. The worker extracted resources/order.xsd to
  the root of the package's folder, so file="resources/order.xsd" in <validateXsd>, <validateJsonSchema>, <xslt> or
  <payload> was not found and the module failed to initialize. Resources now keep their path; file="order.xsd" works too. Packages: redb.Tsak.Core.
• At start the worker opens the packages of a folder in dependency order. A package that uses a carrier's shared DLLs
  (Dependencies in its manifest, as redb.Identity.Http uses redb.Identity.Contracts) could be opened first, fail with
  "Failed to scan package" and start only on the next hot-reload scan, seconds later. Now carriers are opened first, as the
  hot-reload scan already did. Packages: redb.Tsak.Core.
• The watchdog does not count a planned wait as a hang. An exchange waiting for an onException redelivery longer than
  SuspectedThresholdMinutes was reported as suspected, and past HungThresholdMinutes with AutoRestartHungRoutes its
  route was restarted in the middle of the wait. Such an exchange is now skipped while it waits, with one log line saying
  why, and measured from the end of the wait afterwards. The same holds for Retry, the dead letter channel and delay. Packages: redb.Tsak.Core.
• The cluster dashboard seeds its administrator from Tsak:Web:AdminPasswordHash. Cluster mode read only the plaintext
  AdminPassword; with the recommended hash alone the admin had no password and nobody could sign in. The hash now wins over
  the plaintext, as in standalone mode; a value that is not a BCrypt hash is reported once and the seed stops. Packages: redb.Tsak.Web.Pro.
• The cluster dashboard no longer crashes on its first start against an empty database. Started together with the
  worker (the stack image), it read the user table before the worker had created the redb schema and ended with an
  unhandled exception, restarted by supervisord. The administrator is now seeded in the background once the schema is
  there; the dashboard serves meanwhile. Packages: redb.Tsak.Web.Pro.

Earlier versions

Earlier releases are archived by line in changelog/: 4.4.x, 4.3.x, 4.2.x, 4.1.x, 4.0.x, 3.x, 2.x, 1.x.
The worker's development log of March 2026, before the versioned releases, is
changelog/worker-devlog-2026-03.md.

Added

• The redb health check: /api/system/health reports Degraded while a redb database of the worker (the host's
  own or a named instance of a context) has schema problems that need a person, with the problem and a link to redb's
  UPGRADING.md in the new details field; the dashboard's node page and tsak system health show it. Readiness stays
  200 on Degraded unless Tsak:Health:DegradedNotReady=true. Packages: redb.Tsak.Core, redb.Tsak.Contracts, redb.Tsak.CLI, redb.Tsak.Web.

Changed

• tsak module keygen needs --out and never replaces a key by itself. Without --out it wrote a new private key
  as tsak-module.key into the current directory, over one already there. It now refuses without --out, refuses to
  overwrite an existing pair unless --force is given, and prints the full paths it wrote. A script that called it
  without --out passes --out tsak-module to keep the old file names. Packages: redb.Tsak.CLI.

Fixed

• The CLI names the arguments left out. A command with two required arguments (route get <context> <routeId> and
  the like) printed "Required argument missing for command: 'get'." twice; it now prints one line per missing argument
  with its name, then the help of the command as before. Other parse errors keep their "Did you mean" suggestions. Packages: redb.Tsak.CLI.

Fixed

• A context with a seda: hop works again after a restart. From 4.2.2 to 4.4.0, after /stop then /start,
  /restart or the watchdog's automatic restart, the context reported its routes Started, but nothing behind a seda hop
  was processed (ChannelClosedException on every send). The fix is in redb.Route 4.4.1, which this release uses. On an
  older version, recreate the context instead of restarting it: stop it and touch its .tpkg. Packages: redb.Tsak.Core.