tj-python · pull · Feb 13, 2026 · Feb 13, 2026 · Feb 13, 2026 · Feb 13, 2026
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -261,7 +261,7 @@ jobs:
         # Keep 1.1.1w in our list despite it being upstream EOL and otherwise
         # unsupported as it most resembles other 1.1.1-work-a-like ssl APIs
         # supported by important vendors such as AWS-LC.
-        openssl_ver: [1.1.1w, 3.0.18, 3.3.5, 3.4.3, 3.5.4, 3.6.0]
+        openssl_ver: [1.1.1w, 3.0.19, 3.3.6, 3.4.4, 3.5.5, 3.6.1]
         # See Tools/ssl/make_ssl_data.py for notes on adding a new version
     env:
       OPENSSL_VER: ${{ matrix.openssl_ver }}
@@ -428,7 +428,7 @@ jobs:
     needs: build-context
     if: needs.build-context.outputs.run-ubuntu == 'true'
     env:
-      OPENSSL_VER: 3.0.18
+      OPENSSL_VER: 3.5.5
       PYTHONSTRICTEXTENSIONBUILD: 1
     steps:
     - uses: actions/checkout@v6
@@ -539,7 +539,7 @@ jobs:
       matrix:
         os: [ubuntu-24.04]
     env:
-      OPENSSL_VER: 3.0.18
+      OPENSSL_VER: 3.5.5
       PYTHONSTRICTEXTENSIONBUILD: 1
       ASAN_OPTIONS: detect_leaks=0:allocator_may_return_null=1:handle_segv=0
     steps:
@@ -574,7 +574,7 @@ jobs:
       run: |
         echo "PATH=/usr/lib/ccache:$PATH" >> "$GITHUB_ENV"
     - name: Configure CPython
-      run: ./configure --config-cache --with-address-sanitizer --without-pymalloc
+      run: ./configure --config-cache --with-address-sanitizer --without-pymalloc --with-openssl="$OPENSSL_DIR"
     - name: Build CPython
       run: make -j4
     - name: Display build info

diff --git a/.github/workflows/reusable-macos.yml b/.github/workflows/reusable-macos.yml
@@ -35,7 +35,7 @@ jobs:
       run: echo "IMAGE_OS_VERSION=${ImageOS}-${ImageVersion}" >> "$GITHUB_ENV"
     - name: Install Homebrew dependencies
       run: |
-        brew install pkg-config openssl@3.0 xz gdbm tcl-tk@9 make
+        brew install pkg-config openssl@3.5 xz gdbm tcl-tk@9 make
         # Because alternate versions are not symlinked into place by default:
         brew link --overwrite tcl-tk@9
     - name: Configure CPython
@@ -50,7 +50,7 @@ jobs:
           --enable-safety \
           ${{ inputs.free-threading && '--disable-gil' || '' }} \
           --prefix=/opt/python-dev \
-          --with-openssl="$(brew --prefix openssl@3.0)"
+          --with-openssl="$(brew --prefix openssl@3.5)"
     - name: Build CPython
       if : ${{ inputs.free-threading || inputs.os != 'macos-15-intel' }}
       run: gmake -j8

diff --git a/.github/workflows/reusable-ubuntu.yml b/.github/workflows/reusable-ubuntu.yml
@@ -27,7 +27,7 @@ jobs:
     runs-on: ${{ inputs.os }}
     timeout-minutes: 60
     env:
-      OPENSSL_VER: 3.0.18
+      OPENSSL_VER: 3.5.5
       PYTHONSTRICTEXTENSIONBUILD: 1
       TERM: linux
     steps:

diff --git a/Doc/howto/enum.rst b/Doc/howto/enum.rst
@@ -965,75 +965,16 @@ want one of them to be the value::
 
 
 Finer Points
-^^^^^^^^^^^^
-
-Supported ``__dunder__`` names
-""""""""""""""""""""""""""""""
-
-:attr:`~enum.EnumType.__members__` is a read-only ordered mapping of ``member_name``:``member``
-items.  It is only available on the class.
-
-:meth:`~object.__new__`, if specified, must create and return the enum members; it is
-also a very good idea to set the member's :attr:`~Enum._value_` appropriately.  Once
-all the members are created it is no longer used.
-
-
-Supported ``_sunder_`` names
-""""""""""""""""""""""""""""
+------------
 
-- :attr:`~Enum._name_` -- name of the member
-- :attr:`~Enum._value_` -- value of the member; can be set in ``__new__``
-- :meth:`~Enum._missing_` -- a lookup function used when a value is not found;
-  may be overridden
-- :attr:`~Enum._ignore_` -- a list of names, either as a :class:`list` or a
-  :class:`str`, that will not be transformed into members, and will be removed
-  from the final class
-- :meth:`~Enum._generate_next_value_` -- used to get an appropriate value for
-  an enum member; may be overridden
-- :meth:`~Enum._add_alias_` -- adds a new name as an alias to an existing
-  member.
-- :meth:`~Enum._add_value_alias_` -- adds a new value as an alias to an
-  existing member.  See `MultiValueEnum`_ for an example.
+Supported ``__dunder__`` and ``_sunder_`` names
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
-  .. note::
-
-     For standard :class:`Enum` classes the next value chosen is the highest
-     value seen incremented by one.
-
-     For :class:`Flag` classes the next value chosen will be the next highest
-     power-of-two.
-
-  .. versionchanged:: 3.13
-     Prior versions would use the last seen value instead of the highest value.
-
-.. versionadded:: 3.6 ``_missing_``, ``_order_``, ``_generate_next_value_``
-.. versionadded:: 3.7 ``_ignore_``
-.. versionadded:: 3.13 ``_add_alias_``, ``_add_value_alias_``
-
-To help keep Python 2 / Python 3 code in sync an :attr:`~Enum._order_` attribute can
-be provided.  It will be checked against the actual order of the enumeration
-and raise an error if the two do not match::
-
-    >>> class Color(Enum):
-    ...     _order_ = 'RED GREEN BLUE'
-    ...     RED = 1
-    ...     BLUE = 3
-    ...     GREEN = 2
-    ...
-    Traceback (most recent call last):
-    ...
-    TypeError: member order does not match _order_:
-      ['RED', 'BLUE', 'GREEN']
-      ['RED', 'GREEN', 'BLUE']
-
-.. note::
-
-    In Python 2 code the :attr:`~Enum._order_` attribute is necessary as definition
-    order is lost before it can be recorded.
+The supported ``__dunder__`` and ``_sunder_`` names can be found in the :ref:`Enum API documentation <enum-dunder-sunder>`.
 
 
 _Private__names
-"""""""""""""""
+^^^^^^^^^^^^^^^
 
 :ref:`Private names <private-name-mangling>` are not converted to enum members,
 but remain normal attributes.
@@ -1042,7 +983,7 @@ but remain normal attributes.
 
 
 ``Enum`` member type
-""""""""""""""""""""
+^^^^^^^^^^^^^^^^^^^^
 
 Enum members are instances of their enum class, and are normally accessed as
 ``EnumClass.member``.  In certain situations, such as writing custom enum
@@ -1055,7 +996,7 @@ recommended.
 
 
 Creating members that are mixed with other data types
-"""""""""""""""""""""""""""""""""""""""""""""""""""""
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
 When subclassing other data types, such as :class:`int` or :class:`str`, with
 an :class:`Enum`, all values after the ``=`` are passed to that data type's
@@ -1069,7 +1010,7 @@ constructor.  For example::
 
 
 Boolean value of ``Enum`` classes and members
-"""""""""""""""""""""""""""""""""""""""""""""
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
 Enum classes that are mixed with non-:class:`Enum` types (such as
 :class:`int`, :class:`str`, etc.) are evaluated according to the mixed-in
@@ -1084,7 +1025,7 @@ Plain :class:`Enum` classes always evaluate as :data:`True`.
 
 
 ``Enum`` classes with methods
-"""""""""""""""""""""""""""""
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
 If you give your enum subclass extra methods, like the `Planet`_
 class below, those methods will show up in a :func:`dir` of the member,
@@ -1097,7 +1038,7 @@ but not of the class::
 
 
 Combining members of ``Flag``
-"""""""""""""""""""""""""""""
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
 Iterating over a combination of :class:`Flag` members will only return the members that
 are comprised of a single bit::
@@ -1117,7 +1058,7 @@ are comprised of a single bit::
 
 
 ``Flag`` and ``IntFlag`` minutia
-""""""""""""""""""""""""""""""""
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
 Using the following snippet for our examples::
 
@@ -1478,6 +1419,7 @@ alias::
     behaviors as well as disallowing aliases.  If the only desired change is
     disallowing aliases, the :func:`unique` decorator can be used instead.
 
+.. _multi-value-enum:
 
 MultiValueEnum
 ^^^^^^^^^^^^^^^^^

diff --git a/Doc/library/enum.rst b/Doc/library/enum.rst
@@ -307,6 +307,28 @@ Data Types
       No longer used, kept for backward compatibility.
       (class attribute, removed during class creation).
 
+      The :attr:`~Enum._order_` attribute can be provided to help keep Python 2 / Python 3 code in sync.
+      It will be checked against the actual order of the enumeration and raise an error if the two do not match::
+
+         >>> class Color(Enum):
+         ...     _order_ = 'RED GREEN BLUE'
+         ...     RED = 1
+         ...     BLUE = 3
+         ...     GREEN = 2
+         ...
+         Traceback (most recent call last):
+         ...
+         TypeError: member order does not match _order_:
+            ['RED', 'BLUE', 'GREEN']
+            ['RED', 'GREEN', 'BLUE']
+
+      .. note::
+
+         In Python 2 code the :attr:`~Enum._order_` attribute is necessary as definition
+         order is lost before it can be recorded.
+
+      .. versionadded:: 3.6
+
    .. attribute:: Enum._ignore_
 
       ``_ignore_`` is only used during creation and is removed from the
@@ -316,6 +338,8 @@ Data Types
       names will also be removed from the completed enumeration.  See
       :ref:`TimePeriod <enum-time-period>` for an example.
 
+      .. versionadded:: 3.7
+
    .. method:: Enum.__dir__(self)
 
       Returns ``['__class__', '__doc__', '__module__', 'name', 'value']`` and
@@ -346,7 +370,16 @@ Data Types
          :last_values: A list of the previous values.
 
       A *staticmethod* that is used to determine the next value returned by
-      :class:`auto`::
+      :class:`auto`.
+
+      .. note::
+         For standard :class:`Enum` classes the next value chosen is the highest
+         value seen incremented by one.
+
+         For :class:`Flag` classes the next value chosen will be the next highest
+         power-of-two.
+
+      This method may be overridden, e.g.::
 
          >>> from enum import auto, Enum
          >>> class PowersOfThree(Enum):
@@ -359,6 +392,10 @@ Data Types
          >>> PowersOfThree.SECOND.value
          9
 
+      .. versionadded:: 3.6
+      .. versionchanged:: 3.13
+         Prior versions would use the last seen value instead of the highest value.
+
    .. method:: Enum.__init__(self, *args, **kwds)
 
       By default, does nothing.  If multiple values are given in the member
@@ -397,6 +434,8 @@ Data Types
          >>> Build('deBUG')
          <Build.DEBUG: 'debug'>
 
+      .. versionadded:: 3.6
+
    .. method:: Enum.__new__(cls, *args, **kwds)
 
       By default, doesn't exist.  If specified, either in the enum class
@@ -490,7 +529,8 @@ Data Types
          >>> Color(42)
          <Color.RED: 1>
 
-      Raises a :exc:`ValueError` if the value is already linked with a different member.
+      | Raises a :exc:`ValueError` if the value is already linked with a different member.
+      | See :ref:`multi-value-enum` for an example.
 
       .. versionadded:: 3.13
 
@@ -889,14 +929,16 @@ Data Types
 
 ---------------
 
+.. _enum-dunder-sunder:
+
 Supported ``__dunder__`` names
 """"""""""""""""""""""""""""""
 
 :attr:`~EnumType.__members__` is a read-only ordered mapping of ``member_name``:``member``
 items.  It is only available on the class.
 
 :meth:`~Enum.__new__`, if specified, must create and return the enum members;
-it is also a very good idea to set the member's :attr:`!_value_` appropriately.
+it is also a very good idea to set the member's :attr:`~Enum._value_` appropriately.
 Once all the members are created it is no longer used.
 
 
@@ -912,17 +954,10 @@ Supported ``_sunder_`` names
   from the final class
 - :attr:`~Enum._order_` -- no longer used, kept for backward
   compatibility (class attribute, removed during class creation)
+
 - :meth:`~Enum._generate_next_value_` -- used to get an appropriate value for
   an enum member; may be overridden
 
-  .. note::
-
-     For standard :class:`Enum` classes the next value chosen is the highest
-     value seen incremented by one.
-
-     For :class:`Flag` classes the next value chosen will be the next highest
-     power-of-two.
-
 - :meth:`~Enum._add_alias_` -- adds a new name as an alias to an existing
   member.
 - :meth:`~Enum._add_value_alias_` -- adds a new value as an alias to an

diff --git a/Mac/BuildScript/README.rst b/Mac/BuildScript/README.rst
@@ -73,7 +73,7 @@ download them.
 
     - builds the following third-party libraries
 
-        * OpenSSL 3.0.x
+        * OpenSSL 3.5.x
         * Tcl/Tk 8.6.x
         * NCurses
         * SQLite

diff --git a/Mac/BuildScript/resources/ReadMe.rtf b/Mac/BuildScript/resources/ReadMe.rtf
@@ -19,7 +19,7 @@
 \f1\b \cf0 \ul \ulc0 Certificate verification and OpenSSL\
 
 \f0\b0 \ulnone \
-This package includes its own private copy of OpenSSL 3.0.   The trust certificates in system and user keychains managed by the 
+This package includes its own private copy of OpenSSL 3.5.   The trust certificates in system and user keychains managed by the 
 \f2\i Keychain Access 
 \f0\i0 application and the 
 \f2\i security

diff --git a/Misc/NEWS.d/next/Windows/2026-02-13-11-07-51.gh-issue-144551.ENtMYD.rst b/Misc/NEWS.d/next/Windows/2026-02-13-11-07-51.gh-issue-144551.ENtMYD.rst
@@ -0,0 +1 @@
+Updated bundled version of OpenSSL to 3.5.5.
diff --git a/Misc/externals.spdx.json b/Misc/externals.spdx.json
@@ -70,21 +70,21 @@
       "checksums": [
         {
           "algorithm": "SHA256",
-          "checksumValue": "9b07560b6c1afa666bd78b8d3aa5c83fdda02149afdf048596d5b0e0dac1ee55"
+          "checksumValue": "619b30acf7d9b13c9d0ba90d17349e8b524c380cd23d39334b143f74dc4e5ec9"
         }
       ],
-      "downloadLocation": "https://github.com/python/cpython-source-deps/archive/refs/tags/openssl-3.0.18.tar.gz",
+      "downloadLocation": "https://github.com/python/cpython-source-deps/archive/refs/tags/openssl-3.5.5.tar.gz",
       "externalRefs": [
         {
           "referenceCategory": "SECURITY",
-          "referenceLocator": "cpe:2.3:a:openssl:openssl:3.0.18:*:*:*:*:*:*:*",
+          "referenceLocator": "cpe:2.3:a:openssl:openssl:3.5.5:*:*:*:*:*:*:*",
           "referenceType": "cpe23Type"
         }
       ],
       "licenseConcluded": "NOASSERTION",
       "name": "openssl",
       "primaryPackagePurpose": "SOURCE",
-      "versionInfo": "3.0.18"
+      "versionInfo": "3.5.5"
     },
     {
       "SPDXID": "SPDXRef-PACKAGE-sqlite",

diff --git a/Modules/_ssl_data_36.h b/Modules/_ssl_data_36.h
@@ -1,6 +1,6 @@
 /* File generated by Tools/ssl/make_ssl_data.py */
-/* Generated on 2026-01-17T13:03:49.335767+00:00 */
-/* Generated from Git commit openssl-3.6.0-0-g7b371d80d9 */
+/* Generated on 2026-02-13T18:19:19.227109+00:00 */
+/* Generated from Git commit openssl-3.6.1-0-gc9a9e5b10 */
 
 /* generated from args.lib2errnum */
 static struct py_ssl_library_code library_codes[] = {
@@ -1668,6 +1668,11 @@ static struct py_ssl_error_code error_codes[] = {
   #else
     {"CERTIFICATE_VERIFY_ERROR", 46, 100},
   #endif
+  #ifdef CMS_R_CIPHER_AEAD_IN_ENVELOPED_DATA
+    {"CIPHER_AEAD_IN_ENVELOPED_DATA", ERR_LIB_CMS, CMS_R_CIPHER_AEAD_IN_ENVELOPED_DATA},
+  #else
+    {"CIPHER_AEAD_IN_ENVELOPED_DATA", 46, 200},
+  #endif
   #ifdef CMS_R_CIPHER_AEAD_SET_TAG_ERROR
     {"CIPHER_AEAD_SET_TAG_ERROR", ERR_LIB_CMS, CMS_R_CIPHER_AEAD_SET_TAG_ERROR},
   #else