OneDB v3.0.0

Release Date: July 2026
Release Type: Major Feature Release
Branch: 3.0.0

New Features

MongoDB Database Support

OneDB v3.0.0 introduces MongoDB support, extending protected database connectivity beyond Oracle, Microsoft SQL Server, PostgreSQL, and MySQL.

  • Added MongoDB Connections and Listeners using standard MongoDB client connectivity.
  • Added compatibility for MongoDB Compass, mongosh, and supported MongoDB drivers.
  • Added MongoDB Query Audit support with sensitive command values redacted.
  • Added MongoDB Field Settings using Database, Collection, and Field Path concepts.
  • Added MongoDB response protection for supported string fields returned through find, aggregate, and cursor getMoreoperations.
  • Added support for top-level fields, nested document fields, and supported object-array field paths.

MongoDB Query Whitelist

  • Added MongoDB Query Whitelist support for find and aggregate command shapes.
  • Added typed MongoDB placeholders such as ?objectId, ?string, and numeric placeholders for deterministic query-shape matching.
  • Added copy-and-paste support from MongoDB Query Audit into Query Whitelist management.
  • Added whitelist matching by Connection, Database, Collection, Command, canonical command shape, optional client address, and optional database username.
  • Added cursor-aware whitelist inheritance for supported getMore continuations.
  • Added support for listeners with multiple allowed MongoDB connection profiles.

MongoDB Migration

  • Added MongoDB-to-MongoDB collection migration through the existing Migration module.
  • Added MongoDB migration discovery for databases, collections, sampled BSON field paths, BSON data types, and document counts.
  • Added MongoDB migration preview with MongoDB-aware labels and target collection preview.
  • Added collection copy support with batch reads, batch inserts, _id preservation, nested BSON preservation, and document-level progress tracking.
  • Added append, clear target collection, and drop-and-recreate target collection options.
  • Added MongoDB tokenization and detokenization for configured protected BSON string fields.
  • Added tokenization lineage tracking, allowing detokenization to resolve the original completed tokenization configuration without depending on current Field Settings.

MongoDB Views

  • Added MongoDB View-aware Field Settings lifecycle support.
  • Added default View Field Settings creation from protected source collection fields when a MongoDB View is created.
  • Added independent View Field Settings management without changing source collection policies.
  • Added automatic View Field Settings cleanup when a MongoDB View is dropped.
  • Added persisted View policy enforcement so removed View policies are not recreated automatically at runtime.

MongoDB Read Protection Rules

  • Added MongoDB Read Protection Rules through the existing Security Policy module.
  • Added controls for Collection Full Scan, Broad Document Result, and Large Result Set detection.
  • Added Block and Monitor enforcement modes before supported MongoDB requests are forwarded.
  • Added protection for unfiltered collection reads and broad document-returning queries.
  • Added metadata aggregate exclusions for operational aggregate commands such as $count, $group-only pipelines, and $collStats.

Enhancements

  • Added fail-closed protection handling when configured MongoDB protected values cannot be safely processed.
  • Added safe tokenization fallback handling for supported separators including spaces, _, /, ., -, and @, while preserving separator positions for reversible tokenization.
  • Added MongoDB-aware Query Audit records, rule details, notification support, cache reload handling, and diagnostics.
  • Added protection event email cooldown handling to reduce duplicate notifications for repeated equivalent blocked or monitored requests.
  • Added notification deduplication support across MongoDB, Oracle, Microsoft SQL Server, PostgreSQL, and MySQL.

Bug Fixes

  • Fixed MongoDB Query Whitelist copy-and-paste handling from Query Audit.
  • Fixed MongoDB whitelist canonicalization to ignore client transport metadata while preserving the required command structure.
  • Fixed MongoDB Query Whitelist evaluation when listener primary connections differ from effective allowed connection profiles.
  • Fixed MongoDB masking-template handling for supported BSON string fields.
  • Improved MongoDB Query Whitelist diagnostics for canonical matching, effective connection resolution, and rule rejection reasons.

Security Updates

  • MongoDB response protection fails closed when protected BSON values, response shapes, or protocol structures cannot be safely processed.
  • MongoDB Query Whitelist matching uses literal-free canonical command shapes and deterministic hashing.
  • MongoDB Read Protection Rules can block or monitor risky read patterns before requests are sent to the backend database.
  • Protection Event notifications retain audit visibility while reducing repetitive duplicate email alerts.

Known Limitations

  • MongoDB support currently focuses on authenticated OP_MSG traffic and required legacy OP_QUERY handshake compatibility.
  • MongoDB response protection currently supports BSON string values only.
  • MongoDB Browser is read-only in v3.0.0.
  • MongoDB Query Whitelist currently supports find and aggregate; supported getMore operations inherit the originating cursor decision.
  • MongoDB NoSQL Injection Protection is not included in this release.
  • Cross-database migration between MongoDB and relational databases is not included in this release.
  • MongoDB indexes, validators, views, GridFS migration, and migration scheduling are not included in this release.
  • MongoDB compressed traffic (OP_COMPRESSED) is not supported where protection is active.