Commit d711845efb for openssl.org

commit d711845efb2a2058a84dde75c41f272540f44fd1
Author: Matt Caswell <matt@openssl.foundation>
Date:   Thu Apr 2 09:01:00 2026 +0100

    Fix a CHANGES.md entry added to the wrong section

    This fixes the CHANGES.md entry added via #30225 which erroneously added
    the entry in the "Changes between 3.6 and 4.0" section instead of the
    "Changes between 4.0 and 4.1" section

    Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
    MergeDate: Fri Apr  3 15:48:20 2026
    (Merged from https://github.com/openssl/openssl/pull/30668)

diff --git a/CHANGES.md b/CHANGES.md
index 8672a909b6..045b2fc5a5 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -31,6 +31,11 @@ OpenSSL Releases

 ### Changes between 4.0 and 4.1 [xx XXX xxxx]

+ * Improved DTLS handshake robustness under UDP reordering by buffering and
+   replaying early ChangeCipherSpec (CCS) records at the expected state.
+
+   *Tong Li*
+
  * The `openssl pkeyutl` command now uses memory-mapped I/O when reading
    raw input from a file for oneshot sign/verify operations (such as Ed25519,
    Ed448, and ML-DSA) on platforms that support it (Unix-like). The
@@ -413,11 +418,6 @@ OpenSSL Releases

    *Bob Beck*

- * Improved DTLS handshake robustness under UDP reordering by buffering and
-   replaying early ChangeCipherSpec (CCS) records at the expected state.
-
-   *Tong Li*
-
  * Many functions accepting `X509 *` arguments, or returning values
    from a const `X509 *` have been changed to take/return const
    arguments. The most visible changes are places where pointer values