v3.6.0

Fixed

• Evaluation dependency security patches. The unpublished test harness now aligns Jackson 2.x to 2.21.7 and updates Commons Compress to 1.28.0, Commons Lang to 3.21.0, Plexus Utils to 3.6.1, and embedded Tomcat to 11.0.27. A fresh Trivy scan confirms removal of 22 CVE findings from its test dependency closure. The published Java runtime dependency closure has no findings. Unpatched development/test findings remain in braces and the HTTP libraries embedded in Docker Java's shaded transport.
• Field matcher parity. MongoDocumentAssert.hasField(field, expected) and MongoDocumentMatchers.hasField(field, expected) now execute a Hamcrest matcher when passed as the expected value, with the same results and diagnostics as hasFieldMatching. hasField is the preferred spelling for both values and matchers; the explicit alias remains supported. Existing method signatures are retained, including calls compiled against older versions. Literal null still asserts equality; hasFieldMatching(field, null) still rejects a missing matcher. For date matchers, supply the zone to the matcher factory rather than the three-argument literal-equality form of hasField.