docs(changelog): record #5354/#5355, #5356, #5358, #5359 for 1.15.3

Four PRs merged on main after the release commit and cherry-picked
into poco-1.15.3:

- #5358 fix(AbstractEvent): operator-= holds the event mutex across
  Delegate destructor
- #5359 enh(MongoDB): MongoDB 6.0/7.0/8.0 compat (carries its own
  API Changes block for SCRAM-SHA-256 default, count() via $count,
  deprecated INDEX_BACKGROUND / CMD_MAP_REDUCE)
- #5355 (GH #5354) feat(CppUnit): terminate handler
- #5356 fix(Foundation): gate atomic_flag::test on C++20 atomic_wait

Also tighten the Summary paragraph to call out the MongoDB compat
work and add the MongoDB API Changes to doc/99100-ReleaseNotes.page
to match CHANGELOG. CONTRIBUTORS unchanged -- all four PR authors
(aleks-f, uilianries, matejk) are already listed.

Author: matejk

CHANGELOG

@@ -7,10 +7,12 @@ Release 1.15.3 (2026-05-13)
 Summary of Changes:
 
 A patch release focused on bug fixes, security updates in bundled
-third-party libraries (including two expat CVEs), and a small set of
+third-party libraries (including two expat CVEs), and a set of
 enhancements. Notable changes include PostgreSQL connection-string
-URI syntax support, a fix for the WAL-reset database corruption in
-SQLite, and a behaviour correction to the %c date/time format
+URI syntax support, MongoDB 6.0/7.0/8.0 compatibility (Decimal128
+BSON, SCRAM-SHA-256 auth, partial/wildcard/collation index options,
+count() via aggregation), a fix for the WAL-reset database corruption
+in SQLite, and a behaviour correction to the %c date/time format
 specifier so it actually emits centiseconds as documented (this is a
 breaking change for code that relied on the previous single-digit
 decisecond output).
@@ -46,7 +48,6 @@ API Changes:
 - Poco::MongoDB::OpMsgMessage::CMD_MAP_REDUCE is now marked
   POCO_DEPRECATED (mapReduce deprecated by MongoDB in 5.0); use the
   aggregation pipeline.
-
 - GH #5322 PropertyFileConfiguration: the optional parent-configuration
   parameter (added in 1.15.1 via #5253) is now an AbstractConfiguration*
   raw non-owning pointer instead of AbstractConfiguration::Ptr. Callers
@@ -77,13 +78,17 @@ Bundled Third-Party Library Upgrades:
 
 Features, Enhancements and Third Party Updates:
 
+- PR #5359 enh(MongoDB): MongoDB 6.0/7.0/8.0 compat -- Decimal128/MinKey/MaxKey BSON types, SCRAM-SHA-256, partial/wildcard/collation index options, count() via $count aggregation
+- GH #5354 CppUnit terminate handler -- orderly stack-trace dump on uncaught exception (PR #5355)
 - PR #5346 enh(PostgreSQL): let libpq parse the connection string itself, support URI syntax
 - GH #5344 POCO::JWT issue with OPENSSL_NO_DEPRECATED -- addressed by silencing OpenSSL 3.x deprecation warnings on legacy key accessors (PR #5332)
 - PR #5334 enh(MongoDB): add wire version constants for MongoDB 6.1-8.0
 - GH #5337 ProcessRunner error message format
 
 Bug Fixes and Improvements:
 
+- PR #5358 fix(AbstractEvent): operator-= holds the event mutex across Delegate destructor
+- PR #5356 fix(Foundation): gate Mutex on std::atomic_flag::test only when C++20 atomic_wait is available
 - GH #5352 C++20 does not guarantee atomic_flag::test (PR #5353)
 - GH #5347 PDF does not build with make
 - GH #5342 Oracle ODBC CI fail

doc/99100-ReleaseNotes.page

@@ -6,10 +6,12 @@ AAAIntroduction
 !!Summary of Changes
 
 A patch release focused on bug fixes, security updates in bundled
-third-party libraries (including two expat CVEs), and a small set of
+third-party libraries (including two expat CVEs), and a set of
 enhancements. Notable changes include PostgreSQL connection-string
-URI syntax support, a fix for the WAL-reset database corruption in
-SQLite, and a behaviour correction to the %c date/time format
+URI syntax support, MongoDB 6.0/7.0/8.0 compatibility (Decimal128
+BSON, SCRAM-SHA-256 auth, partial/wildcard/collation index options,
+count() via aggregation), a fix for the WAL-reset database corruption
+in SQLite, and a behaviour correction to the %c date/time format
 specifier so it actually emits centiseconds as documented (this is a
 breaking change for code that relied on the previous single-digit
 decisecond output).
@@ -20,6 +22,9 @@ decisecond output).
 
 !!API Changes
 
+  - Poco::MongoDB::Database::authenticate() default mechanism changed from SCRAM-SHA-1 to SCRAM-SHA-256, matching the MongoDB server default for new users since 4.0. Existing callers relying on SCRAM-SHA-1 should pass Database::AUTH_SCRAM_SHA1 explicitly. SCRAM-SHA-256 currently requires ASCII passwords. (PR #5359)
+  - Poco::MongoDB::Database::count() now uses aggregation [{$count: "n"}] instead of the legacy count command. Signature unchanged; results are accurate on sharded clusters and the call is permitted in multi-document transactions. (PR #5359)
+  - Poco::MongoDB::Database::INDEX_BACKGROUND and Poco::MongoDB::OpMsgMessage::CMD_MAP_REDUCE are now marked POCO_DEPRECATED (deprecated by MongoDB in 4.2 and 5.0 respectively). (PR #5359)
   - GH #5322 PropertyFileConfiguration optional parent-configuration parameter is now an AbstractConfiguration* raw non-owning pointer instead of AbstractConfiguration::Ptr. Callers must keep the parent alive for the child's lifetime. Ptr-taking overloads retained as deprecated forwarders. Constructors are now explicit. See CHANGELOG for details.
 
 !!Security Fixes
@@ -35,13 +40,17 @@ Bundled Third-Party Library Upgrades:
 
 !!Features, Enhancements and Third Party Updates
 
+  - PR #5359 enh(MongoDB): MongoDB 6.0/7.0/8.0 compat -- Decimal128/MinKey/MaxKey BSON types, SCRAM-SHA-256, partial/wildcard/collation index options, count() via $count aggregation
+  - GH #5354 CppUnit terminate handler -- orderly stack-trace dump on uncaught exception (PR #5355)
   - PR #5346 enh(PostgreSQL): let libpq parse the connection string itself, support URI syntax
   - GH #5344 POCO::JWT issue with OPENSSL_NO_DEPRECATED -- addressed via PR #5332 (silence OpenSSL 3.x deprecation warnings on legacy key accessors)
   - PR #5334 enh(MongoDB): add wire version constants for MongoDB 6.1-8.0
   - GH #5337 ProcessRunner error message format
 
 !!Bug Fixes and Improvements
 
+  - PR #5358 fix(AbstractEvent): operator-= holds the event mutex across Delegate destructor
+  - PR #5356 fix(Foundation): gate Mutex on std::atomic_flag::test only when C++20 atomic_wait is available
   - GH #5352 C++20 does not guarantee atomic_flag::test (PR #5353)
   - GH #5347 PDF does not build with make
   - GH #5342 Oracle ODBC CI fail