OneDB v3.0.0

Release Date: July 2026
Release Type: Major Feature Release
Branch: 3.0.0

Overview

The OneDB v3.0.0 release notes introduce comprehensive MongoDB support across the OneDB platform.

This release adds MongoDB connectivity, Query Audit, Field Settings, Query Whitelist, Migration, Views, and Read Protection Rules. It also improves response protection, notification handling, and policy enforcement for supported MongoDB traffic.

New Features

MongoDB Database Support

OneDB v3.0.0 introduces MongoDB support. This expands protected database connectivity beyond Oracle, Microsoft SQL Server, PostgreSQL, and MySQL.

  • Administrators can create MongoDB Connections and Listeners using standard MongoDB client connectivity.
  • MongoDB Compass, mongosh, and supported MongoDB drivers can connect through OneDB.
  • Query Audit records supported MongoDB activity while redacting sensitive command values.
  • Field Settings use MongoDB Database, Collection, and Field Path concepts.
  • Response protection supports string fields returned through find, aggregate, and cursor getMore operations.
  • Protected fields can exist at the top level, inside nested documents, or within supported object arrays.

MongoDB Query Whitelist

MongoDB Query Whitelist controls supported command patterns.

  • OneDB supports find and aggregate command shapes.
  • Typed placeholders include ?objectId, ?string, and supported numeric placeholders.
  • Administrators can copy supported entries from MongoDB Query Audit into Query Whitelist.
  • Rules can match the Connection, Database, Collection, Command, canonical command shape, client address, and database username.
  • Supported getMore operations inherit the whitelist decision of the originating cursor.
  • Listeners can use multiple allowed MongoDB connection profiles.

MongoDB Migration

OneDB can migrate MongoDB collections between supported MongoDB connections.

  • Migration discovery identifies databases, collections, sampled BSON field paths, BSON data types, and document counts.
  • The migration preview uses MongoDB-specific labels and displays the target collection.
  • Collections are copied through batch reads and batch inserts.
  • OneDB preserves _id values and nested BSON structures.
  • Document-level progress is displayed during migration.
  • Administrators can append data, clear the target collection, or drop and recreate the target collection.
  • Tokenization and detokenization are supported for configured BSON string fields.
  • Tokenization lineage allows detokenization to use the original completed migration configuration without depending on current Field Settings.

MongoDB Views

OneDB now supports Field Settings for MongoDB Views.

  • Default View Field Settings can be created from protected source collection fields.
  • View policies can be managed independently from source collection policies.
  • Related Field Settings are removed when a MongoDB View is dropped.
  • Removed View policies are not automatically recreated at runtime.

MongoDB Read Protection Rules

OneDB provides Read Protection Rules for supported MongoDB operations.

  • Rules can detect Collection Full Scans, Broad Document Results, and Large Result Sets.
  • Administrators can choose Block or Monitor enforcement modes.
  • Rule evaluation occurs before supported MongoDB requests are forwarded.
  • OneDB can protect against unfiltered collection reads and broad document-returning queries.
  • Operational aggregate commands such as $count, $group-only pipelines, and $collStats are excluded where appropriate.

Enhancements

  • OneDB now fails closed when configured MongoDB protected values cannot be processed safely.
  • Reversible tokenization supports separators such as spaces, _, /, ., -, and @.
  • Separator positions are preserved during supported reversible tokenization.
  • Query Audit now includes MongoDB-specific records, rule details, notifications, cache reload handling, and diagnostics.
  • Protection event cooldowns reduce repeated emails for equivalent blocked or monitored requests.
  • Notification deduplication applies across MongoDB, Oracle, Microsoft SQL Server, PostgreSQL, and MySQL.

Bug Fixes

  • Fixed Query Whitelist copy-and-paste handling from MongoDB Query Audit.
  • Fixed whitelist canonicalization so client transport metadata is ignored without removing required command structure.
  • Fixed whitelist evaluation when a Listener uses an effective allowed connection profile instead of its primary connection.
  • Fixed masking-template handling for supported BSON string fields.
  • Improved diagnostics for canonical matching, effective connection resolution, and rejected rules.

Security Updates

  • MongoDB response protection fails closed when protected BSON values, response shapes, or protocol structures cannot be processed safely.
  • MongoDB Query Whitelist uses literal-free canonical command shapes and deterministic hashing.
  • MongoDB Read Protection Rules can block or monitor risky read patterns before requests reach the backend database.
  • Protection Event notifications retain audit visibility while reducing repetitive email alerts.

Known Limitations

  • MongoDB support focuses on authenticated OP_MSG traffic and the required legacy OP_QUERY handshake.
  • Response protection currently supports BSON string values only.
  • MongoDB Browser is read-only in v3.0.0.
  • Query Whitelist supports find and aggregate. Supported getMore operations inherit the original cursor decision.
  • MongoDB NoSQL Injection Protection is not included in this release.
  • Cross-database migration between MongoDB and relational databases is not supported.
  • Migration does not include indexes, validators, Views, GridFS, or scheduling.
  • MongoDB compressed traffic using OP_COMPRESSED is not supported when protection is active.