chore(deps): update dependency pyopenssl to v26 [security]

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
pyOpenSSL (source)	==25.0.0 → ==26.0.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2026-27448

If a user provided callback to set_tlsext_servername_callback raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for any security-sensitive behavior, this could allow bypassing it.

Unhandled exceptions now result in rejecting the connection.

Credit to Leury Castillo for reporting this issue.

CVE-2026-27459

If a user provided callback to set_cookie_generate_callback returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer.

Cookie values that are too long are now rejected.

---

Release Notes

pyca/pyopenssl (pyOpenSSL)

v26.0.0

Compare Source

Backward-incompatible changes:
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Dropped support for Python 3.7.
• The minimum cryptography version is now 46.0.0.

Deprecations:
^^^^^^^^^^^^^

Changes:
^^^^^^^^

• Added support for using aws-lc instead of OpenSSL.
• Properly raise an error if a DTLS cookie callback returned a cookie longer than DTLS1_COOKIE_LENGTH bytes. Previously this would result in a buffer-overflow. Credit to dark_haxor for reporting the issue. CVE-2026-27459
• Added OpenSSL.SSL.Connection.get_group_name to determine which group name was negotiated.
• Context.set_tlsext_servername_callback now handles exceptions raised in the callback by calling sys.excepthook and returning a fatal TLS alert. Previously, exceptions were silently swallowed and the handshake would proceed as if the callback had succeeded. Credit to Leury Castillo for reporting this issue. CVE-2026-27448

v25.3.0

Compare Source

Backward-incompatible changes:
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Deprecations:
^^^^^^^^^^^^^

Changes:
^^^^^^^^

• Maximum supported cryptography version is now 46.x.

v25.2.0

Compare Source

Backward-incompatible changes:
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• The minimum cryptography version is now 45.0.7.

Deprecations:
^^^^^^^^^^^^^

Changes:
^^^^^^^^

• pyOpenSSL now sets SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER on connections by default, matching CPython's behavior.
• Added OpenSSL.SSL.Context.clear_mode.
• Added OpenSSL.SSL.Context.set_tls13_ciphersuites to set the allowed TLS 1.3 ciphers.
• Added OpenSSL.SSL.Connection.set_info_callback

v25.1.0

Compare Source

Backward-incompatible changes:
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Deprecations:
^^^^^^^^^^^^^

• Attempting using any methods that mutate an OpenSSL.SSL.Context after it
  has been used to create an OpenSSL.SSL.Connection will emit a warning. In
  a future release, this will raise an exception.

Changes:
^^^^^^^^

• cryptography maximum version has been increased to 45.0.x.

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[gemini-code-assist]

Code Review

This pull request updates the pyOpenSSL dependency to version 26.0.0. The review feedback recommends explicitly pinning the cryptography library to version 46.0.0 or higher to ensure security fixes are applied and to avoid dependency resolution issues, as pyOpenSSL 26.0.0 requires this version.

[gemini-code-assist]

Updating pyOpenSSL to version 26.0.0 introduces a strict requirement for cryptography >= 46.0.0. Since this is a security-focused update addressing multiple CVEs (CVE-2026-27448, CVE-2026-27459), it is highly recommended to explicitly pin cryptography in your requirements.txt as well. This ensures that the security fixes in the underlying library are consistently applied and helps avoid potential dependency resolution issues with other packages like signxml which also depend on cryptography. Additionally, note that this version of pyOpenSSL drops support for Python 3.7, though the presence of Werkzeug 3.0.6 suggests the project is already using Python 3.8+.