POCO Files

Summary of Changes:

This is a bugfix and maintenance release that also introduces a few new features:

• PropertyFileConfiguration now supports an !include directive for composing configuration from multiple files, and preserves the original file layout (comments, blank lines, key order) when saving changes.
• ProcessRunner gained a PROCESS_KILL_TREE option for terminating entire process trees on supported platforms.
• clang-cl is now supported as a build compiler on Windows.
• LoggingConfigurator can now create fully configured loggers at runtime.

All bundled third-party libraries have been upgraded to their latest releases, including security fixes for libexpat, libpng, zlib, and utf8proc.

Security Fixes:

• GH [#5255] Upgrade bundled libexpat to release 2.7.5
• CVE-2026-32776 (NULL function pointer dereference)
• CVE-2026-32777 (infinite loop)
• CVE-2026-32778 (NULL dereference on OOM retry)
• PR [#5232] enh(deps): upgrade bundled zlib, utf8proc, double-conversion, and wepoll
• zlib inflateCopy() OOB fix
• utf8proc out-of-bounds memory access fix
• GH [#5207] Upgrade bundled dependencies to latest versions
• libpng CVE-2026-22801 (heap over-read)
• libpng CVE-2026-25646 (heap buffer overflow)

Bundled Third-Party Library Upgrades:

• libpng 1.6.53 → 1.6.55
• SQLite 3.51.1 → 3.51.2 - deadlock fix, query optimizer bug fixes
• zlib 1.3.1 → 1.3.2
• utf8proc 2.11.0 → 2.11.3
• LZMA SDK 25.01 → 26.00 - format improvements, sparse file TAR fix
• double-conversion 3.3.1 → 3.4.0
• wepoll 1.5.4 → 1.5.8
• cpptrace ~0.6.x → 1.0.4
• libexpat 2.7.4 → 2.7.5

Features, Enhancements:

• GH [#5260] Allow creation of loggers with configuration at runtime
• GH [#5257] Preserve properties file on save
• GH [#5253] Add !include directive support to PropertyFileConfiguration
• PR [#5233] Extract tessil into dependencies/
• PR [#5231] Add WinGet instructions to README
• PR [#5229] feat(CppUnit): add ENABLE_INSTALL_CPPUNIT option to control installation
• PR [#5219] Extract and upgrade cpptrace to dependencies/
• PR [#5215] fix(MinGW): update ODBCVER to 0x0350 for SQL_GUID support
• GH [#5201] ProcessRunner: add PROCESS_KILL_TREE option
• GH [#5195] clang-cl support

Bug Fixes and Improvements:

• PR [#5245] fix(ODBC): defensive UTF-16 length handling in makeUTF8 for Informix Note: some ODBC drivers (notably IBM Informix) report unreliable column sizes; string data exceeding maxFieldSize (default 1024 bytes) will be truncated. Use session.setProperty("maxFieldSize", Poco::Any(8192)) to increase the limit.
• GH [#5237] Constify X509* usage where needed and use ASN1_STRING accessors
• GH [#5236] ServerApplication: Windows SCM does not forward ImagePath arguments to ServiceMain
• GH [#5228] deadlock when app exit if AsyncChannel is used in the logging system
• PR [#5227] fix(Net): reactor-based HTTP server not responding to requests with body
• GH [#5225] Building Data samples fails with CMake - SQLite support disabled but still required
• GH [#5220] Poco::Data::Statement should not be in ST_DONE state after addBinding() call
• GH [#5217] RedisStreamBuf: SIGSEGV when socket dies during std::getline()
• GH [#5213] NotificationQueue::wakeUpAll() lost-wakeup race causes deadlock on shutdown
• GH [#5210] File::getExecutablePath() returns directory instead of executable
• PR [#5204] fix(MongoDB): Add timeout support and harden replica set connections
• GH [#5200] 1.15.0: linker errors with MSVC link-time-code-generation
• GH [#5199] ProcessRunner::stop() termination signal lost on Windows due to NamedEvent race
• GH [#5198] ServerApplication::hasConsole() returns false when stdout is closed (Windows)
• GH [#5196] 1.15.0 CMake build failure with -DENABLE_PDF:BOOL=FALSE
• GH [#5176] Build error when cross-compiling for Win32 from Debian12
• GH [#5157] Accessing array with JSONConfiguration