Commit 9f8231027b for openssl.org

commit 9f8231027bcc9a895537fcab4e0a2e65afc9befc
Author: Viktor Dukhovni <viktor@openssl.org>
Date:   Thu Jul 16 05:36:42 2026 +1000

    CHANGES.md updates

    Reviewed-by: Bob Beck <beck@openssl.org>
    Reviewed-by: Norbert Pocs <norbertp@openssl.org>
    MergeDate: Tue Jul 21 14:12:07 2026
    (Merged from https://github.com/openssl/openssl/pull/31964)

diff --git a/CHANGES.md b/CHANGES.md
index 6fb71f7d9c..8d507e4f32 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -31,7 +31,17 @@ OpenSSL Releases

 ### Changes between 4.0 and 4.1 [xx XXX xxxx]

- * Added AVX512 optimized SHAKE x4 operations for ML-DSA on x86_64.
+ * Fixed TLS 1.3 external PSK connections being wrongly rejected when
+   the client sets a non-empty session ID context.
+
+   *Viktor Dukhovni*
+
+ * Fixed a TLS 1.3 server with no session ID context to accept external PSK
+   connections and to stop issuing unusable session tickets.
+
+   *Viktor Dukhovni*
+
+ * Added AVX512 optimized SHAKE x4 operations for ML-DSA on `x86_64`.

    *Marcel Cornu and Tomasz Kantecki*