OpenSSL 4.1.0 is a feature release adding significant new functionality
to OpenSSL.

This release incorporates the following potentially significant or incompatible
changes:

• Added VC-WIN32-MSVC2013 and VC-WIN64A-MSVC2013 build targets to provide
  internal functions for bridging the gaps in C99 standard support
  that are present in MSVC 2013.

• Added optimized ML-DSA and ML-KEM NTT operations on ppc64le;
  optimized ML-DSA operations on x86_64;
  AVX-512-optimized SHAKE x4 operations for ML-DSA on x86_64;
  AVX-512 and VAES optimizations for AES-CBC decryption on x86_64.

• Changed tsget utility to use Net::Curl::Easy (from the Net-Curl CPAN
  distribution) instead of the abandoned WWW::Curl::Easy. Users who rely
  on tsget should install Net::Curl::Easy before upgrading.

• Dropped Windows-on-Itanium (VC-WIN64I) and Windows CE (VC-CE) targets
  from Configurations.

• Dropped no-ecdsa and no-ecdh options from Configure, as these options
  did not really disable the implementations. Use no-ec to disable
  the elliptic curve support.

This release adds the following new features:

• Support for DTLS 1.3 (RFC 9147).
  Refer to the ossl-guide-dtlsv13(7) manual page for details.

• Support for RFC 8701 GREASE (Generate Random Extensions And Sustain
  Extensibility).

• DTLS support in the SSL listener API.

• Support for IKEV2 KDF.

• Initial support for the Elbrus2000 (e2k) architecture.

Known issues in 4.1.0:

• #32878
  When a DTLS 1.3 KeyUpdate is received, all other outstanding
  post-handshake records are dropped from the retransmission buffer.
  This means post-handshake records still awaiting an ACK (such as a
  NewSessionTicket) will no longer be retransmitted if the original
  transmission is lost. A fix is in progress and planned for a future
  release.

• #33277
  A permanent receive failure on a DTLS listener can be reported as
  SSL_ERROR_WANT_READ on an accepted connection. Polling and subsequent
  accept calls may also fail to report the error, causing applications
  to continue waiting after a permanent failure.

• #33278
  A retryable write failure on a nonblocking connection accepted from a
  DTLS listener can be reported as SSL_ERROR_SYSCALL instead of
  SSL_ERROR_WANT_WRITE. Applications treating this result as fatal may
  close a connection that is still usable.

• #33242
  DTLS 1.3 servers may abort handshakes with an unexpected_message alert
  when a client acknowledges part or all of the server's first flight
  before sending its response. This can occur after packet loss or while
  the client is preparing its authentication response.