Release 1.15.3

[matejk]

Summary of Changes:

Bug fixes, expat CVE updates in bundled deps, MongoDB 6.0/7.0/8.0 compatibility, PostgreSQL URI connection strings, and a corrected %c date/time format specifier (breaking).

Breaking Changes:

• GH Poco::DateTimeFormatter %c does not format to centisecond but decisecond #3949 Poco::DateTimeFormatter %c does not format to centisecond but decisecond (PR fix(Foundation): %c format specifier emits centiseconds (#3949) #5350)

API Changes:

• MongoDB::Database::authenticate() default is now SCRAM-SHA-256; pass AUTH_SCRAM_SHA1 for the previous default. ASCII passwords only. (PR enh(MongoDB): MongoDB 6.0/7.0/8.0 compat -- partial indexes, Decimal128, SCRAM-SHA-256 #5359)
• MongoDB::Database::count() now uses {$count: "n"} aggregation; signature unchanged, accurate on sharded clusters, transaction-safe. (PR enh(MongoDB): MongoDB 6.0/7.0/8.0 compat -- partial indexes, Decimal128, SCRAM-SHA-256 #5359)
• MongoDB::Database::INDEX_BACKGROUND and MongoDB::OpMsgMessage::CMD_MAP_REDUCE are POCO_DEPRECATED (deprecated server-side in 4.2 and 5.0). (PR enh(MongoDB): MongoDB 6.0/7.0/8.0 compat -- partial indexes, Decimal128, SCRAM-SHA-256 #5359)
• GH Circular reference in Application::loadConfiguration() #5322 Circular reference in Application::loadConfiguration() -- PropertyFileConfiguration parent parameter is now AbstractConfiguration* (was Ptr); caller owns lifetime. Ptr overloads retained as deprecated. Constructors are now explicit.

Security Fixes:

• PR chore(deps): bundled third-party library updates for 1.15.3 #5351 chore(deps): bundled third-party library updates for 1.15.3
• GH CodeQL: Net: Comparison result is always the same #5050 CodeQL: Net: Comparison result is always the same (PR fix(Net): IPv6AddressImpl::isLoopback IPv4-mapped check (#5050) #5349)

Bundled Third-Party Library Upgrades:

• expat 2.7.5 -> 2.8.1 (CVE-2026-41080, CVE-2026-45186)
• SQLite 3.53.0 -> 3.53.1 (WAL-reset corruption fix)
• libpng 1.6.57 -> 1.6.58 (png_get_PLTE regression fix)
• 7zip (LZMA SDK) 26.00 -> 26.01

Features, Enhancements and Third Party Updates:

• PR enh(MongoDB): MongoDB 6.0/7.0/8.0 compat -- partial indexes, Decimal128, SCRAM-SHA-256 #5359 enh(MongoDB): MongoDB 6.0/7.0/8.0 compat -- partial indexes, Decimal128, SCRAM-SHA-256
• GH CppUnit terminate handler #5354 CppUnit terminate handler (PR feat(CppUnit): terminate handler #5354 #5355)
• PR Support quoted parameters and URI syntax in PostgreSQL connection strings #5346 Support quoted parameters and URI syntax in PostgreSQL connection strings
• GH POCO::JWT issue with OPENSSL_NO_DEPRECATED #5344 POCO::JWT issue with OPENSSL_NO_DEPRECATED (PR chore(Crypto): silence OpenSSL 3.x deprecation warnings for legacy key accessors #5332)
• PR enh(MongoDB): add wire version constants for MongoDB 6.1-8.0 #5334 enh(MongoDB): add wire version constants for MongoDB 6.1-8.0
• GH ProcessRunner error message format #5337 ProcessRunner error message format (PR chore(ProcessRunner): error message format #5337 #5338)

Bug Fixes and Improvements:

• PR fix(AbstractEvent): operator-= holds the event mutex across Delegate:… #5358 fix(AbstractEvent): operator-= holds the event mutex across Delegate destructor
• PR [fix] Only allow use atomic when C++20 is properly configured #5356 [fix] Only allow use atomic when C++20 is properly configured
• GH C++ 20 does not guarantee atomic_flag.test #5352 C++ 20 does not guarantee atomic_flag.test (PR fix(Mutex): C++ 20 does not guarantee atomic_flag.test #5352 #5353)
• GH PDF does not build with make #5347 PDF does not build with make
• GH Oracle ODBC CI fail #5342 Oracle ODBC CI fail (PR Oracle ODBC CI Fail #5343)
• GH PropertyFileConfiguration does not persist deletion of last key from included property files #5340 PropertyFileConfiguration does not persist deletion of last key from included property files (PR fix: remove deleted properties from property files #5340 #5341)
• GH POCO_UNBUNDLED=ON build fails when ZLIB is a transitive dependency of another found package #5330 POCO_UNBUNDLED=ON build fails when ZLIB is a transitive dependency of another found package
• GH UnbufferedStreamBuf::xsgetn silently swallows decoder errors after partial read (regression from #5290) #5327 UnbufferedStreamBuf::xsgetn silently swallows decoder errors after partial read (regression from enh(Net,Foundation): multipart parsing performance and stream bulk-read optimization #5290)
• GH Logger::shutdown() use-after-free #5324 Logger::shutdown() use-after-free
• GH ThreadTest::testTrySleep flaky on macOS, causes segfault #5316 ThreadTest::testTrySleep flaky on macOS, causes segfault
• PR fix(cmake): replace obsolete -s with -Wl,-x on Apple linker #5345 fix(cmake): replace obsolete -s with -Wl,-x on Apple linker
• PR Fix C1021 fatal error when building DataSQLite with POCO_SQLITE_UNBUNDLED on MSVC #5336 Fix C1021 fatal error when building DataSQLite with POCO_SQLITE_UNBUNDLED on MSVC
• PR fix(Foundation): handle INTERFACE_LIBRARY Pcre2::Pcre2 from CONFIG-mode packages #5333 fix(Foundation): handle INTERFACE_LIBRARY Pcre2::Pcre2 from CONFIG-mode packages
• PR Fix: DateTimeParser trailing timezone designators & Timezone UTC offset cache invalidation #5318 Fix: DateTimeParser trailing timezone designators & Timezone UTC offset cache invalidation

---

This discussion was created from the release Release 1.15.3.