pocoproject/poco poco-1.15.0-release

Release 1.15.0

on GitHub

Summary of Changes:

This is a major feature release with C++20 as the default standard, comprehensive
MongoDB replica set support, a new reactor-based HTTP server implementation, ULID
support, C++17 modernization of core classes, and significant third-party library
upgrades.

Contributors:

Matej Kenda, Aleksandar Fabijanic, siren186, Günter Obiltschnig, nyashbox,
Lara Dzivdzanovic, Gleb Popov, Andrew Auclair, Mikhail Khachayants, Alexander Bychuk,
solarobot, Tomislav Petrović, Andrew Slabko, sky92zwq, Duncan Cunningham,
Marian Krivoš, Miko (Toyosatomimi no Miko), Ben Wolsieffer, Luis Caro Campos, Jonas Bülow,
Friedrich Wilckens, Austin Beer, Rajendra Singh, Miracle-1996, Nathan Jensen,
Peter Zmanovsky, nitram96, Nino Belušić, Matthew Stoltenberg, Katalin Rebhan,
Eric Engels, Milan Tepic, David Roman, Mert Övün, lanthora, Jouke Witteveen,
Jeremy Rifkin, Dan Rosser, Étienne Dupuis, Thomas Beutlich, Sergei Trofimovich, Kacper Piwiński,
Peter Klotz, Kari Argillander, Hussein Ismail, Mias du Plessis, Wei Liguo,
Arthur Chan, Olivier Smeesters, Karthik Bhat A

Notable Features:

Poco::MongoDB:

• Full replica set support: automatic server discovery, topology monitoring, failover
  handling, read preference-based server selection, connection pooling, and URI parsing.
• Note: Legacy wire protocol (pre-MongoDB 5.1) has been removed. Use OP_MSG-based
  interface for all MongoDB operations.

Poco::Net:

• New reactor-based HTTP server implementation (HTTPReactorServer) for high-performance
  scenarios using the SocketReactor pattern instead of thread-per-connection model.
• HTTP cookies updated to RFC 6265 specification.

Poco::Redis:

• Event notifications support for pub/sub integration.

Poco::Foundation:

• ULID (Universally Unique Lexicographically Sortable Identifier) support with
  ULIDGenerator class, similar to existing UUID support.
• C++17 modernization of Tuple, TypeList, ScopedLock and other core classes with
  significant code reduction. Full backward API compatibility maintained.
• New AsyncNotificationCenter for asynchronous notification dispatch with auto-configured
  worker threads.
• FastLogger (Quill wrapper, fully compatible with Poco Logging system)
• Single/Multiple Producer, Single Consumer lock-free notification queues.
• DataNotification class for carrying typed payloads in notifications.
• NativeThreadInfo support for including native thread ID and name in log messages.
• Thread interrupt feature added for cooperative thread cancellation.
• LogFileImpl::createFile() now creates parent directories if they don't exist.
• Poco::format() now supports %g and %G format specifiers like printf().
• Windows: Missing DLL names now reported in SharedLibrary load errors.
• Poco::Observer is now deprecated; use Poco::NObserver instead.

Poco::NetSSL_Win:

• Find certificates from Windows store using SHA-1 thumbprint for easier certificate
  selection in enterprise environments.

Poco::Data:

• PostgreSQL: UUID field type (UUIDOID) now correctly mapped to Poco::UUID instead
  of BLOB, enabling direct UUID value extraction from RecordSet.
• ODBC: Improved Oracle database integer type handling.
• ODBC: Fixed UUID handling in Preparator for SQL Server.

Build System:

• C++20 is now the default standard (use POCO_ENABLE_CPP20 CMake option).
• C++20 modules support added (ENABLE_MODULES). Modules match namespace names
  (Poco.Foundation, Poco.Net, etc.) with a unified Poco module for importing all.
• External dependencies reorganised into separate 'dependencies' subdirectory.
• New POCO_UNBUNDLED_SQLITE option for fine-grained unbundled control.
• New POCO_MINIMAL_BUILD option builds only the libraries explicitly enabled via
  ENABLE_* options, useful for reducing build times and binary size.
• CMake uninstall target renamed to 'uninstall-poco' to avoid conflicts.

Bundled Third-Party Library Upgrades:

• expat 2.7.1 → 2.7.4 - fixes CVE-2026-24515 (NULL pointer dereference), CVE-2026-25210 (integer overflow),
  CVE-2025-59375 (DoS via memory allocation), CVE-2024-8176 (stack overflow)
• PCRE2 10.44 → 10.47 - skips 10.45 which had CVE-2025-58050 (heap-buffer-overflow)
• SQLite 3.49.1 → 3.51.1 - fixes CVE-2025-6965 (memory corruption)
• libpng 1.6.43 → 1.6.53 - fixes CVE-2025-64720, CVE-2025-65018 (buffer overflows), 5 security fixes total
• libharu 2.3.0RC2 → 2.4.5 (first stable release since RC)
• utf8proc 2.9.0 → 2.11.0 - adds Unicode 16 and 17 support
• LZMA SDK 9.22 → 25.01 (major upgrade from 2011 version)
• Quill 11.0.2 (new)

Breaking Changes and Migration Notes:

• GH #5030 Foundation: DateTimeParser rejects trailing garbage. Review any code that
  relies on specific parsing behavior for non-standard date/time formats.

• GH #4844 AbstractConfiguration::createView() and createLocalView() return
  AbstractConfiguration::Ptr (AutoPtr) since version 1.11. Code that assigns the
  return value to a raw pointer (AbstractConfiguration*) will compile but cause
  use-after-free crashes. Always use AbstractConfiguration::Ptr or auto for the
  return value.

• GH #4781 Poco::MongoDB legacy wire protocol (OP_INSERT, OP_UPDATE, OP_DELETE,
  OP_QUERY, OP_GET_MORE) has been removed. These were deprecated in MongoDB 5.0
  and removed in MongoDB 5.1. All code must use the OP_MSG-based interface
  (OpMsgMessage, OpMsgCursor). MongoDB 3.6+ is required.

• GH #4460 Remove VS projects from release. Use CMake to generate Visual Studio
  solutions.

• GH #3739 Drop support for OpenSSL < 1.1.1. Systems with older OpenSSL versions
  must upgrade before using this release.

Security Fixes:

• GH #5177 Upgrade bundled expat to 2.7.4 [fixes CVE-2026-24515, CVE-2026-25210]
• PR #5096 enh(deps): Upgrade bundled SQLite from 3.49.1 to 3.51.1
• PR #5093 enh(PDF): Upgrade bundled libpng from 1.6.43 to 1.6.53 (security fixes)
• GH #5028 Upgrade bundled libexpat to 2.7.3 [fixes CVE]
• GH #4912 Upgrade bundled PCRE2 to 10.47
• GH #4623 Poco::Zip library now checks archive consistency before extracting to
  prevent path traversal and zip bomb attacks

Features:

• GH #5163 Foundation: Add demangleDot function for type name formatting
• GH #5162 Add IOLock
• GH #5134 Lock-free queues
• GH #5133 Add Channel::log(message&&)
• GH #5132 Make SpinlockMutex adaptive
• PR #5129 Foundation: Add ULID support
• GH #5083 CppUnit: Improve test name display and selection
• PR #5081 Foundation: Add benchmark infrastructure and FastLogger
• GH #5069 Missing DLLs not reported on Windows
• PR #5068 MongoDB: Add replica set support with automatic failover
• GH #5060 Auto-configure AsyncNotificationCenter number of workers
• GH #5058 Add event notifications to Redis
• GH #5047 Foundation: Add DataNotification for typed payload
• PR #4999 Modules: Add C++20 modules component
• PR #4946 Net: Add reactor-based HTTP server
• GH #4932 Windows: Better Poco::Environment::osDisplayName
• GH #4851 Foundation: AsyncNotificationCenter should dispatch asynchronously
• GH #4731 Foundation: Allow specifying SharedLibrary flags in ClassLoader
• GH #4518 Net: Update HTTP cookies to RFC 6265
• GH #3333 Foundation: Add NativeThreadInfo and blend in Message

Enhancements and Third-Party Updates:

• PR #5186 Foundation: Proper implementation of File::getExecutablePath
• GH #5178 XML: Use vanilla Expat sources instead of POCO-patched version
• PR #5166 Update readme with Windows and Arch Linux instructions
• PR #5154 MongoDB: Document performance header cleanup
• PR #5153 Util: Modernize Poco::Util and clean up code duplications
• GH #5150 Net: SocketReactor socket removal
• PR #5149 Build: Add unit testing build to oss-fuzz build script
• GH #5146 CMake: Use platform-specific cppignore files
• GH #5144 ODBC: Add nix shells for mssql and oracle
• PR #5136 Data: C++17 modernization of TypeHandler with variadic templates
• PR #5130 fix: Resolve compiler warnings and fix potential bugs
• PR #5119 Util: Add [[nodiscard]] to createView/createLocalView
• GH #5115 Data/SQLite: Remove redundant error messages
• PR #5103 fix: Resolve compiler warnings across multiple modules
• PR #5100 fix(Net): Use MessageHeader::quote() for boundary in HTMLForm
• PR #5099 enh(expat): Add patch system for POCO-specific xmlparse modifications
• PR #5098 enh(deps): Upgrade bundled libharu from 2.3.0RC2 to 2.4.5
• PR #5097 enh(deps): Upgrade bundled utf8proc from 2.9.0 to 2.11.0
• PR #5094 enh(SevenZip): Upgrade bundled LZMA SDK from 9.22 to 25.01
• PR #5092 fix: Resolve compiler warnings in Net, Zip, and Foundation modules
• PR #5086 Foundation: Simplify Tuple, TypeList, FunctionPriorityDelegate and other with C++17
• GH #5084 Add C++20 support and make it default
• GH #5078 Foundation: Improve logging system performance
• GH #5033 Build: Improve Linux debug build flags
• PR #5031 enh(MongoDB): Improve stability of the OpMsgCursor
• PR #5029 JSON: Eliminate extra copies in Object
• PR #5023 Find certificate from Windows store using its thumbprint
• PR #5013 CMake minimal build and dependencies
• PR #5005 enh(ScopedLock): Add std::adopt_lock, try_to_lock, defer_lock support
• GH #5002 Data/ODBC: Oracle integer types fail with v23 driver
• PR #4995 Foundation: Add deprecation reasons to APIs
• PR #4993 Enable Avahi support on FreeBSD
• PR #4991 Enable building Poco::Trace on FreeBSD
• PR #4990 Teach FindApache2.cmake to locate Apache on FreeBSD
• PR #4987 Poco Zip: link ZLIB::ZLIB when unbundled
• PR #4983 New SQLite Only Unbundled Option
• PR #4972 Add ENABLE_CPPUNIT to enable CppUnit without building the tests
• PR #4971 enh(CMake): FindOpenSSL.cmake with modifications for ARM Windows
• GH #4962 Add bool Application::exists()
• GH #4958 Poco::Observer is obsolete in favour of Poco::NObserver
• PR #4956 enh(cmake): Add option POCO_ENABLE_CPP20
• PR #4942 fix(Thread): fix Thread reuse error, add thread interrupt feature
• PR #4879 CMake: Include pcre2 source files to unbundled build based on pcre2 library type
• PR #4867 enh(Foundation): modernised header files (override, using, nullptr, ...)
• PR #4841 enh(Poco::Dynamic): Modernised code to use C++17 features
• GH #4789 Build: Provide zlib as shared dependency for Foundation and PDF
• GH #4651 Incorporate wdx_ziptype changes (fix for Poco::Zlib: Unexpected exceptions)
• GH #4348 0 (or NULL) for null pointer shall be replaced with nullptr
• GH #4202 Foundation: LogFileImpl::createFile() fails if path does not exist
• GH #2731 Poco::format() supports %g and %G format specifiers

Bug Fixes:

• GH #5191 Process/Win: Fix PROCESS_CLOSE_STD* flags closing parent's handles
  instead of child's
• GH #5187 Foundation: Use setenv instead of putenv in Environment
• PR #5183 MongoDB: Fix Document::toString() to produce valid JSON by quoting
  all string-like values
• GH #5182 Data: SQLChannel does not create directory for absolute paths
• GH #5180 Foundation: Fix ProcessRunner::start() to handle Windows executables
  without .exe extension
• GH #5175 Foundation: Fix format specifiers in DateTimeFormatter and
  PatternFormatter
• GH #5174 Foundation: Fix bad casing in include
• GH #5172 Foundation: Fix DateTimeParser tests with day 0
• GH #5168 Foundation: Lock-Order-Inversion Deadlock in NObserver/Observer
• PR #5165 fix(Foundation): VS2022 clang-cl compatibility
• GH #5161 Pipe is not thread-safe
• GH #5159 Lock-order-inversion deadlock in NotificationCenter
• GH #5158 Foundation: Change lock type to ScopedWriteLock in NotificationCenter
• GH #5147 Net: Fix TSAN warnings in SocketImpl
• GH #5142 VarHolderImpl: Implement isDate/isTime diagnostics
• PR #5140 Data: Refactor ODBC tests and fix testReconnect TypeInfo caching
• PR #5137 fix(Foundation): Replace timing-dependent tests with condition-based waiting
• GH #5131 Build: Fix PCRE compile with clang/c++20 and GNU make
• PR #5114 fix(Foundation): Fix deadlock in NotificationCenter removeObserver
• PR #5107 fix(Zip): Improve parsing of non-standard ZIP archives
• GH #5090 UBSan: Integer overflow errors in VarHolder.h
• GH #5087 Net: Fix dll attribute position in pocoNetworkInitializer to support
  MinGW-GCC/Clang
• GH #5085 CMake build not stripping release binaries
• GH #5083 CppUnit: Improve test name display and selection
• GH #5070 CMake does not produce proper binary names
• GH #5064 Net: Build fails when POCO_HAS_UNIX_SOCKET is not defined
• GH #5059 Foundation: AsyncNotificationCenter hangs on stop()
• GH #5055 Make Socket::select() deprecation conditional
• GH #5054 Foundation: ProcessRunner termination detection unreliable
• GH #5048 Adapt makefiles for external dependencies
• GH #5044 Build: Missing bundled dependencies
• PR #5038 Prevent hostname being replaced with IP during handshake
• GH #5032 HTTPChunkedInputStream does not raise an error when stream ends prematurely
• GH #5025 PostgreSQL reconnect() doesn't restore session state correctly
• PR #5020 Poco::Path("C:") throws if path is disk-letter only
• GH #5018 Data/ODBC: Wrong UUID handling in Preparator
• GH #5017 Poco::Data ODBC recordset is reading previous row value
• GH #5011 Foundation: File crashes with Windows long path prefix (\?)
• GH #5010 Build failure with ODBC due to PREFIX macro conflict
• GH #5004 Bugcheck::poco_unexpected trailing semicolon
• PR #4994 chore(CI): Fix installation of Microsoft ODBC connector
• PR #4992 Fix building of FileStreamTest.cpp on FreeBSD
• PR #4986 Fix Thread_POSIX not compiling with Emscripten
• GH #4980 Zip component build error with CMake + POCO_UNBUNDLED
• GH #4978 ODBC MSSQL bulk insert UNIQUEIDENTIFIER type does not work
• GH #4977 Possible flaky tests when building for nixpkgs
• GH #4976 Net: SocketReactor dispatches ErrorNotification to all observers
• GH #4973 MSVC 2017 Build error: Cannot open include file 'version'
• GH #4970 Net: Deadlock in SocketReactor when removing handler from callback
• GH #4969 MongoDB::Database::authSCRAM() fails due to protocol typographic error
• PR #4966 Foundation: Resolve Poco::format ambiguity with std::format in C++23
• GH #4949 Foundation: TaskManager memory leak
• GH #4947 Build: ENABLE_SEVENZIP and ENABLE_ZIP still require ENABLE_XML
• GH #4924 Data/PostgreSQL: RecordSet does not recognize UUID field
• GH #4908 CI: UBSan errors in GitHub CI
• GH #4900 Data/ODBC: Binder hides AbstractBinder::bind()
• GH #4881 Conflicting 'uninstall' targets with CMake
• GH #4877 NetSSL: Context throws on unimplemented DH group
• GH #4871 CMake: static build with POCO_UNBUNDLED fails with static external pcre2
• GH #4870 Foundation: Incorrect bitwise check for newline mode in RegularExpression
• GH #4854 Poco::Data::Session constructor freezes when opening non-SQLite file
• GH #4848 Foundation: FileChannel purge race condition with compression (#2439)
• GH #4801 publish_release.yml should also update documentation website
• GH #4800 QA: packages-qa.yml should check result of mkdoc job
• GH #4756 Net: WebSocket sendFrame delay due to missing TCP_NODELAY
• GH #4639 Cannot run Crypto sample code
• GH #4627 Loading passphrase-protected key should not prompt cin
• GH #4549 ClassLoader crash when DLL and EXE use different runtime library
• GH #4537 Net: Socket::available causes connection reset on Windows UDP sockets
• GH #4439 Enable CodeQL fail if error found
• GH #4358 Reorganise source code of external libraries
• GH #4122 Util: ServerApplication compile error with C++20
• GH #3907 NetSSL_Win certificate verification failure with intermediate certificates
• GH #3694 Poco::Zip::Compress::addFile with MemoryInputStream broken since 1.12.0