Skip to content

Tracking issue for OpenSSL 4.0 migration #278366

Open
Open
Tracking issue for OpenSSL 4.0 migration#278366
Labels
help wantedTask(s) needing PRs from the community or maintainersopenssl-4-migrationRelated to switching to an OpenSSL 4 dependency
@p-linnane

Description

@p-linnane
p-linnane
opened on Apr 19, 2026

openssl@3 to openssl@4 migration tracking

Staging branch process

This migration is now being run through the openssl-4-migration-staging branch. New migration PRs should target that branch and use branches in Homebrew/homebrew-core rather than forks.

Work root-first, then trace down the dependent tree. This avoids the mixed openssl@3 / openssl@4 linkage seen when leaf formulae are migrated directly against main. Use brew deps --tree --include-build <formula> / brew deps --graph --dot --include-build <formula> to order follow-up work.

For staging PRs:

  • use the labels openssl-4-migration, staging-branch-pr, and CI-skip-recursive-dependents
  • skip routine local brew ops; staging CI is the validation path for this migration
  • keep independent formulae split for quick review/merge
  • group formulae only when they are small to build and tightly coupled
Current root pipeline PR map

Depth 0 roots / prerequisites

Depth 1 dependents

Depth 2 dependents

Depth 3 dependents

614 formulae depend on openssl@3 (including => :build / => :test deps).

Grouped by dependent count, then by build system. Migrate leaves first. If they break, blast radius is limited.

See OpenSSL 4.0 release notes for breaking changes. Common failure modes:

  • C/C++: ASN1_STRING is now opaque; X509 getters now return const pointers.
  • Rust: openssl-sys v0.10.78 (released 2026-04-19) is the first release supporting OpenSSL 4.
  • Some formulae declare depends_on "openssl@3" but do not actually link it. Verify if we can drop the dependency rather than migrate.
Leaves (0 dependents) (444)

Rust (98)

Go (5)

C/C++ (CMake) (104)

C/C++ (autotools) (147)

Other (90)

1 dependent (58)

Go (1)

  • gensio (1 dependents)

C/C++ (CMake) (23)

  • apt (1 dependents)
  • azure-storage-common-cpp (1 dependents)
  • dcmtk (1 dependents)
  • gdcm (1 dependents)
  • getdns (1 dependents)
  • libff (1 dependents) libff: migrate to openssl@4 and fix test #278901
  • libgit2@1.7 (1 dependents)
  • libmsquic (1 dependents)
  • libpaho-mqtt (1 dependents)
  • libre (1 dependents) libre: migrate to openssl@4 #282537
  • libvncserver (1 dependents) libvncserver x11vnc: migrate to OpenSSL 4 #282036
  • micromamba (1 dependents)
  • mysql (1 dependents)
  • mysql@8.0 (1 dependents)
  • mysql@8.4 (1 dependents)
  • nuraft (1 dependents)
  • pdal (1 dependents)
  • percona-server (1 dependents)
  • poco (1 dependents)
  • qpid-proton (1 dependents)
  • signalwire-client-c (1 dependents)
  • tiledb (1 dependents)
  • xrootd (1 dependents)

C/C++ (autotools) (23)

  • cups (1 dependents)
  • erlang@24 (1 dependents)
  • gwenhywfar (1 dependents)
  • httperf (1 dependents) httperf: use openssl@4 #279517
  • jimtcl (1 dependents)
  • liboauth (1 dependents) liboauth: use openssl@4 #279578
  • libslax (1 dependents)
  • libstrophe (1 dependents)
  • libtorrent-rakshasa (1 dependents)
  • md5sha1sum (1 dependents) md5sha1sum: use openssl@4 #279011
  • memcached (1 dependents) memcached: use openssl@4 #281660
  • nagios-plugins (1 dependents)
  • nginx (1 dependents)
  • node@18 (1 dependents)
  • node@20 (1 dependents)
  • oath-toolkit (1 dependents)
  • opensaml (1 dependents)
  • python@3.9 (1 dependents)
  • sleuthkit (1 dependents)
  • sofia-sip (1 dependents)
  • softhsm (1 dependents)
  • thrift (1 dependents)
  • yara (1 dependents)

Other (11)

  • apache-serf (1 dependents)
  • etcd-cpp-apiv3 (1 dependents)
  • karchive (1 dependents)
  • kmod (1 dependents)
  • libtpms (1 dependents)
  • llama.cpp (1 dependents)
  • mktorrent (1 dependents) mktorrent: use openssl@4 #279081
  • pixiewps (1 dependents)
  • redis (1 dependents)
  • spice-gtk (1 dependents)
  • zookeeper (1 dependents)
2–5 dependents (67)

Rust (1)

  • ruby@3.4 (2 dependents)

C/C++ (CMake) (18)

C/C++ (autotools) (34)

Other (14)

  • berkeley-db (3 dependents)
  • crystal (5 dependents)
  • fbthrift (3 dependents)
  • fizz (5 dependents)
  • mupdf (3 dependents)
  • mvfst (5 dependents)
  • node-build (2 dependents)
  • pipewire (2 dependents)
  • pyenv (4 dependents)
  • pypy (2 dependents)
  • rtmpdump (5 dependents) rtmpdump: migrate to openssl@4 #281398
  • ruby-build (2 dependents)
  • valkey (3 dependents)
  • wangle (3 dependents)
6+ dependents (45)

Rust (4)

C/C++ (CMake) (9)

C/C++ (autotools) (28)

Other (4)

Metadata

Metadata

Assignees

No one assigned

    Labels

    help wantedTask(s) needing PRs from the community or maintainersopenssl-4-migrationRelated to switching to an OpenSSL 4 dependency

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions