Log message:
py-OpenSSL: updated to 26.4.0

26.4.0 (2026-08-01)

Changes:
- Maximum supported ``cryptography`` version is now 50.x.

Log message:
py-OpenSSL: update to 26.3.0.

Backward-incompatible changes:

    Dropped support for Python 3.8.

    The minimum cryptography version is now 49.0.0.

    Removed deprecated OpenSSL.crypto.X509Req, \ 
OpenSSL.crypto.dump_certificate_request, and \ 
OpenSSL.crypto.load_certificate_request. cryptography.x509 should be used \ 
instead.

    OpenSSL.SSL.Connection.set_session now raises ValueError if the Session was \ 
obtained from a Connection that was using a different Context than this one. \ 
OpenSSL requires (but does not verify) that sessions only be re-used with a \ 
compatible SSL_CTX, so this contract is now enforced.

Deprecations:

    Deprecated OpenSSL.crypto.PKey.generate_key and OpenSSL.crypto.PKey.check. \ 
The key generation and loading APIs in cryptography should be used instead.

    Deprecated OpenSSL.crypto.dump_privatekey. The serialization APIs on \ 
cryptography private key types should be used instead.

    Deprecated all the mutable APIs on OpenSSL.crypto.X509: set_version, \ 
set_pubkey, sign, set_serial_number, gmtime_adj_notAfter, gmtime_adj_notBefore, \ 
set_notBefore, set_notAfter, set_issuer, and set_subject. \ 
cryptography.x509.CertificateBuilder should be used instead.

    Deprecated OpenSSL.SSL.Context.set_passwd_cb. Users should decrypt and load \ 
their private keys themselves, with cryptography’s key loading APIs, and then \ 
call OpenSSL.SSL.Context.use_privatekey.

    Deprecated OpenSSL.crypto.X509Name, as well as the remaining APIs that \ 
consume or return it: OpenSSL.crypto.X509.get_issuer, \ 
OpenSSL.crypto.X509.get_subject, and OpenSSL.SSL.Context.set_client_ca_list. The \ 
APIs in cryptography.x509 should be used instead.

Changes:

    OpenSSL.SSL.Connection.get_client_ca_list now takes an as_cryptography \ 
keyword-argument. When True is passed then cryptography.x509.Name are returned, \ 
instead of OpenSSL.crypto.X509Name. In the future, passing False (the default) \ 
will be deprecated.

Log message:
py-OpenSSL: updated to 26.2.0

26.2.0 (2026-05-04)

Backward-incompatible changes:

- Removed deprecated ``OpenSSL.crypto.X509Extension``, \ 
``OpenSSL.crypto.X509Req.add_extension``, \ 
``OpenSSL.crypto.X509Req.get_extensions``, \ 
``OpenSSL.crypto.X509.add_extension``, ``OpenSSL.crypto.X509.get_extensions``. \ 
``cryptography.x509`` should be used instead.
- It is now an error to calling any mutating method on ``OpenSSL.SSL.Context`` \ 
after it has been used to create a ``Connection``. This was previously \ 
deprecated and has always been unsafe.

Changes:

- Maximum supported ``cryptography`` version is now 48.x.
- Added ``OpenSSL.SSL.Connection.set_options`` to set options on a \ 
per-connection basis.

Log message:
py-OpenSSL: updated to 26.1.0

26.1.0 (2026-04-24)

Changes:

- Maximum supported ``cryptography`` version is now 47.x.
- Fixed ``X509Name`` field setters to correctly pass the value length to \ 
OpenSSL. Previously, values containing NUL bytes would be silently truncated, \ 
causing a divergence between the stored ASN.1 value and the value visible from \ 
Python. Credit to **BudongJW** for reporting the issue. **CVE-2026-40475**

Log message:
py-OpenSSL: update to 26.0.0.

Security fix release.

26.0.0 (2026-03-15)
-------------------

Backward-incompatible changes:
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

- Dropped support for Python 3.7.
- The minimum ``cryptography`` version is now 46.0.0.

Deprecations:
^^^^^^^^^^^^^

Changes:
^^^^^^^^

- Added support for using aws-lc instead of OpenSSL.
- Properly raise an error if a DTLS cookie callback returned a cookie longer \ 
than ``DTLS1_COOKIE_LENGTH`` bytes. Previously this would result in a \ 
buffer-overflow. Credit to **dark_haxor** for reporting the issue. \ 
**CVE-2026-27459**
- Added ``OpenSSL.SSL.Connection.get_group_name`` to determine which group name \ 
was negotiated.
- ``Context.set_tlsext_servername_callback`` now handles exceptions raised in \ 
the callback by calling ``sys.excepthook`` and returning a fatal TLS alert. \ 
Previously, exceptions were silently swallowed and the handshake would proceed \ 
as if the callback had succeeded. Credit to **Leury Castillo** for reporting \ 
this issue. **CVE-2026-27448**

Log message:
py-OpenSSL: update to 25.3.0.

25.3.0 (2025-09-16)
-------------------

Changes:
^^^^^^^^

- Maximum supported ``cryptography`` version is now 46.x.

25.2.0 (2025-09-14)
-------------------

Backward-incompatible changes:
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

- The minimum ``cryptography`` version is now 45.0.7.

Changes:
^^^^^^^^

- pyOpenSSL now sets ``SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER`` on connections by \ 
default, matching CPython's behavior.
- Added ``OpenSSL.SSL.Context.clear_mode``.
- Added ``OpenSSL.SSL.Context.set_tls13_ciphersuites`` to set the allowed TLS \ 
1.3 ciphers.
- Added ``OpenSSL.SSL.Connection.set_info_callback``

Log message:
py-OpenSSL: update to 25.1.0.

25.1.0 (2025-05-17)
-------------------

Backward-incompatible changes:
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Deprecations:
^^^^^^^^^^^^^

- Attempting using any methods that mutate an ``OpenSSL.SSL.Context`` after it
  has been used to create an ``OpenSSL.SSL.Connection`` will emit a warning. In
  a future release, this will raise an exception.

Changes:
^^^^^^^^

* ``cryptography`` maximum version has been increased to 45.0.x.

Log message:
py-OpenSSL: fix for setuptools>=78