OneDB v2.9.0

Release Date: June 2026
Release Type: Feature Release
Branch: 2.9.0

New Features

Credential-Aware Listener Database Scope

OneDB Listener now supports multiple registered connection profiles for the same database or schema when different database credentials are required.

Administrators can configure allowed profiles using the same database name while keeping credential-specific policy selection clear and controlled. Listener scope entries are displayed using the database, connection, and username, making it easier to identify the intended access profile.

For PostgreSQL listeners, OneDB can resolve the effective policy context using the requested database and username. Unknown or ambiguous profiles are rejected instead of allowing OneDB to apply an arbitrary policy.

Cluster Membership Topology and Export

The Cluster / High Availability page now includes a visual cluster membership topology.

The topology automatically adapts to one-node, two-node, and larger cluster environments, and provides filtering for All, Online, Offline, and Removed node records.

Cluster information can now be exported as:

  • Excel report
  • PDF report
  • PNG topology image

Exports are generated locally without requiring an internet connection or external CDN dependency.

Stable Cluster Node Identity

OneDB Cluster membership now supports stable appliance identity handling.

Cluster nodes are identified using a persistent appliance identity rather than relying only on IP address. This helps preserve cluster membership when an appliance IP address changes and reduces the risk of consuming additional HA capacity for the same appliance.

OneDB also detects duplicate appliance identities to help prevent accidental cluster membership conflicts caused by cloned or copied initialized appliances.

Listener ResultSet Debug Logging

OneDB now provides a unified Listener ResultSet debug capability for:

  • Oracle
  • MySQL
  • Microsoft SQL Server
  • PostgreSQL

The debug capability provides low-level listener and proxy visibility for controlled troubleshooting scenarios, including result-set metadata, protected field mappings, detected rows, and masking activity.

This feature is intended for development and support troubleshooting only and should remain disabled in normal production operation.

Enhancements

  • Improved Listener scope management for environments that use the same database or schema with multiple database users.
  • Improved Listener profile visibility through a password-free profile detail view.
  • Enhanced Cluster page usability with dynamic topology rendering, status filters, and historical removed-node visibility.
  • Improved Cluster capacity calculations by excluding removed nodes from active HA capacity counts.
  • Improved protection against stale loopback cluster membership records.
  • Improved handling of node endpoint changes while preserving applicable cluster membership and replication state.

Bug Fixes

  • Fixed PostgreSQL Query Whitelist behavior for prepared statements. Approved parameterized queries now retain their response-protection bypass correctly until command completion or an error response.
  • Fixed MySQL native prepared-statement result masking. Protected binary result rows now remain in the masking flow and are masked correctly.
  • Fixed Microsoft SQL Server result masking for Node.js applications using mssql and Tedious prepared statements.
  • Improved SQL Server RPC request handling for supported sp_executesql execution flows, including Query Whitelist evaluation, Query Audit, result-set context, and field masking.

Security Updates

  • Improved fail-closed policy behavior when multiple credential-specific connection profiles exist for the same database.
  • Unknown or ambiguous credential profiles are rejected instead of allowing arbitrary policy selection.
  • Cluster identity information is protected and is not exposed through the user interface, cluster APIs, logs, or diagnostic output.
  • Cluster exports exclude sensitive operational details such as internal identities, tokens, checkpoints, truststore information, and license payloads.

Known Notes

  • All cluster nodes should run the same OneDB application version and compatible database schema before enabling credential-specific listener profiles.
  • Stable cluster identity is designed to detect cloned appliance conflicts. Cloned appliances should be assigned a controlled new identity and appropriate license before joining a cluster.
  • Listener ResultSet debug logging may expose raw and masked field values during troubleshooting. Enable it only in controlled support or development environments.