pocoproject/poco poco-1.15.1-release

Release 1.15.1

on GitHub

Summary of Changes:

This is a bugfix and maintenance release that also introduces a few new features:

• PropertyFileConfiguration now supports an !include directive for composing
  configuration from multiple files, and preserves the original file layout
  (comments, blank lines, key order) when saving changes.
• ProcessRunner gained a PROCESS_KILL_TREE option for terminating entire
  process trees on supported platforms.
• clang-cl is now supported as a build compiler on Windows.
• LoggingConfigurator can now create fully configured loggers at runtime.

All bundled third-party libraries have been upgraded to their latest releases,
including security fixes for libexpat, libpng, zlib, and utf8proc.

Security Fixes:

• GH #5255 Upgrade bundled libexpat to release 2.7.5
  • CVE-2026-32776 (NULL function pointer dereference)
  • CVE-2026-32777 (infinite loop)
  • CVE-2026-32778 (NULL dereference on OOM retry)
• PR #5232 enh(deps): upgrade bundled zlib, utf8proc, double-conversion, and wepoll
  • zlib inflateCopy() OOB fix
  • utf8proc out-of-bounds memory access fix
• GH #5207 Upgrade bundled dependencies to latest versions
  • libpng CVE-2026-22801 (heap over-read)
  • libpng CVE-2026-25646 (heap buffer overflow)

Bundled Third-Party Library Upgrades:

• libpng 1.6.53 → 1.6.55
• SQLite 3.51.1 → 3.51.2 - deadlock fix, query optimizer bug fixes
• zlib 1.3.1 → 1.3.2
• utf8proc 2.11.0 → 2.11.3
• LZMA SDK 25.01 → 26.00 - format improvements, sparse file TAR fix
• double-conversion 3.3.1 → 3.4.0
• wepoll 1.5.4 → 1.5.8
• cpptrace ~0.6.x → 1.0.4
• libexpat 2.7.4 → 2.7.5

Features, Enhancements:

• GH #5260 Allow creation of loggers with configuration at runtime
• GH #5257 Preserve properties file on save
• GH #5253 Add !include directive support to PropertyFileConfiguration
• PR #5233 Extract tessil into dependencies/
• PR #5231 Add WinGet instructions to README
• PR #5229 feat(CppUnit): add ENABLE_INSTALL_CPPUNIT option to control installation
• PR #5219 Extract and upgrade cpptrace to dependencies/
• PR #5215 fix(MinGW): update ODBCVER to 0x0350 for SQL_GUID support
• GH #5201 ProcessRunner: add PROCESS_KILL_TREE option
• GH #5195 clang-cl support

Bug Fixes and Improvements:

• PR #5245 fix(ODBC): defensive UTF-16 length handling in makeUTF8 for Informix
  Note: some ODBC drivers (notably IBM Informix) report unreliable column sizes;
  string data exceeding maxFieldSize (default 1024 bytes) will be truncated.
  Use session.setProperty("maxFieldSize", Poco::Any(8192)) to increase the limit.
• GH #5237 Constify X509* usage where needed and use ASN1_STRING accessors
• GH #5236 ServerApplication: Windows SCM does not forward ImagePath arguments to ServiceMain
• GH #5228 deadlock when app exit if AsyncChannel is used in the logging system
• PR #5227 fix(Net): reactor-based HTTP server not responding to requests with body
• GH #5225 Building Data samples fails with CMake - SQLite support disabled but still required
• GH #5220 Poco::Data::Statement should not be in ST_DONE state after addBinding() call
• GH #5217 RedisStreamBuf: SIGSEGV when socket dies during std::getline()
• GH #5213 NotificationQueue::wakeUpAll() lost-wakeup race causes deadlock on shutdown
• GH #5210 File::getExecutablePath() returns directory instead of executable
• PR #5204 fix(MongoDB): Add timeout support and harden replica set connections
• GH #5200 1.15.0: linker errors with MSVC link-time-code-generation
• GH #5199 ProcessRunner::stop() termination signal lost on Windows due to NamedEvent race
• GH #5198 ServerApplication::hasConsole() returns false when stdout is closed (Windows)
• GH #5196 1.15.0 CMake build failure with -DENABLE_PDF:BOOL=FALSE
• GH #5176 Build error when cross-compiling for Win32 from Debian12
• GH #5157 Accessing array with JSONConfiguration