Skip to content

Tracking issue for OpenSSL 4.0 migration #278366

Open
Open
Tracking issue for OpenSSL 4.0 migration#278366
Labels
help wantedTask(s) needing PRs from the community or maintainersopenssl-4-migrationRelated to switching to an OpenSSL 4 dependency
@p-linnane

Description

@p-linnane
p-linnane
opened on Apr 19, 2026

openssl@3 to openssl@4 migration tracking

Staging branch process

This migration is now being run through the openssl-4-migration-staging branch. New migration PRs should target that branch and use branches in Homebrew/homebrew-core rather than forks.

Work root-first, then trace down the dependent tree. This avoids the mixed openssl@3 / openssl@4 linkage seen when leaf formulae are migrated directly against main. Use brew deps --tree --include-build <formula> / brew deps --graph --dot --include-build <formula> to order follow-up work.

For staging PRs:

  • use the labels openssl-4-migration, staging-branch-pr, and CI-skip-recursive-dependents
  • skip routine local brew ops; staging CI is the validation path for this migration
  • keep independent formulae split for quick review/merge
  • group formulae only when they are small to build and tightly coupled

Current root pipeline PR map

Depth 0 roots / prerequisites

Depth 1 dependents

Depth 2 dependents

Depth 3 dependents

614 formulae depend on openssl@3 (including => :build / => :test deps).

Grouped by dependent count, then by build system. Migrate leaves first. If they break, blast radius is limited.

See OpenSSL 4.0 release notes for breaking changes. Common failure modes:

  • C/C++: ASN1_STRING is now opaque; X509 getters now return const pointers.
  • Rust: openssl-sys v0.10.78 (released 2026-04-19) is the first release supporting OpenSSL 4.
  • Some formulae declare depends_on "openssl@3" but do not actually link it. Verify if we can drop the dependency rather than migrate.
Leaves (0 dependents) (444)

Rust (98)

  • anchor anchor: remove openssl@3 dependency #278367
  • ansible@10
  • ansible@9
  • aoe
  • azure-cli
  • bbot
  • btcli
  • c2patool
  • cargo-crev
  • cargo-geiger
  • cargo-instruments
  • cargo-udeps
  • clamav
  • codanna
  • code-cli
  • code2prompt
  • codeberg-cli
  • codex-acp
  • condure
  • cookcli cookcli: remove openssl dependency #280274
  • crunchy-cli
  • datadog-static-analyzer
  • dura uses openssl-sys 0.9.72
  • eureka
  • feluda
  • feroxbuster
  • findomain
  • forgejo-cli
  • fw
  • gerust
  • git-series
  • git-trim
  • git-workspace
  • git-xet
  • gitlogue
  • gitnr
  • gittype
  • gitui
  • gurk
  • icann-rdap
  • icp-cli
  • intelli-shell
  • ironclaw
  • keeper-commander
  • lakekeeper
  • leetcode-cli
  • legba
  • localstack
  • lychee
  • magika
  • mavsdk
  • meli
  • netdata
  • nushell
  • pay
  • pdfly
  • pdnsrec
  • pgrx
  • pkgx
  • projectable
  • prowler
  • proxelar
  • prr
  • pushpin
  • rattler-build
  • river
  • rojo
  • rover
  • ruby@3.2
  • ruby@3.3
  • sapling
  • scryer-prolog
  • sem-cli
  • sentry-cli
  • sequoia-chameleon-gnupg
  • sequoia-sq
  • sh4d0wup
  • sheldon
  • sigstore
  • sile
  • sniffnet
  • solana
  • sprocket
  • stellar-cli
  • tabiew
  • tectonic
  • teleport
  • termscp
  • termusic
  • text-embeddings-inference
  • toml-bombadil
  • trunk
  • wally
  • watchman watchman: migrate to openssl@4 #279297
  • weave
  • yek
  • yozefu
  • zellij

Go (5)

C/C++ (CMake) (104)

  • adios2
  • amqp-cpp
  • apib deprecated
  • awscurl
  • azure-storage-cpp
  • bareos-client
  • baresip
  • bibtexconv
  • brpc
  • caf
  • cassandra-cpp-driver
  • clickhouse-cpp
  • clickhouse-odbc
  • clipboard
  • cnats
  • colmap
  • cppcms
  • csound
  • dotnet@6
  • dwarfs
  • dxpy
  • ecflow-ui
  • emqx
  • encfs
  • et
  • ettercap
  • fastnetmon
  • fluent-bit
  • freerdp
  • h2o
  • halide
  • httping httping: use openssl@4 #279099
  • julia
  • kcov
  • lastpass-cli
  • libcouchbase
  • libdpp
  • libjwt
  • liboqs
  • libpulsar
  • libtins
  • luvit
  • manticoresearch
  • mapnik
  • mariadb
  • mariadb-connector-odbc
  • mariadb@10.11
  • mariadb@10.5
  • mariadb@10.6
  • mariadb@11.4
  • mariadb@11.8
  • monero
  • monetdb
  • mongo-c-driver@1
  • mosquitto
  • musikcube
  • mydumper
  • mysql-client@8.0
  • mysql-client@8.4
  • mysql-connector-c++
  • nemu
  • nmail
  • ntopng
  • nzbget
  • openiked
  • opentelemetry-cpp
  • ortp
  • osslsigncode
  • percona-server@8.0
  • percona-xtrabackup
  • percona-xtrabackup@8.0
  • pgbackrest
  • pistache
  • podofo
  • proxygen
  • qca
  • qxmpp
  • recc
  • retdec
  • rizin
  • root
  • rtags
  • rtl_433
  • sagittarius-scheme
  • sipp sipp: use openssl@4 #279100
  • snapcast snapcast: use openssl@4 #279107
  • snort
  • ssldump
  • stubby
  • swi-prolog
  • synergy-core
  • tarantool
  • tdlib
  • thors-anvil
  • trafficserver
  • unshield
  • uuu
  • wdc wdc: use openssl@4 #279102
  • weaviate-cli
  • wownero
  • xmrig
  • yubico-piv-tool
  • zeek
  • znc

C/C++ (autotools) (147)

  • activemq-cpp
  • alpine
  • aqbanking
  • aria2
  • axel
  • bacula-fd
  • bigloo
  • bitchx
  • btfs
  • btpd
  • burp
  • cadaver
  • cfengine
  • citus
  • conserver
  • coturn
  • couchdb
  • dillo
  • dnsdist
  • dnsperf
  • dovecot
  • duo_unix
  • dynomite
  • ejabberd
  • ekg2
  • epic5
  • erlang@25
  • erlang@27
  • fetchmail
  • ffmpeg@2.8
  • fossil
  • freeradius-server
  • freeswitch
  • gambit-scheme
  • gcli
  • gerbil-scheme
  • gloox
  • gnupg-pkcs11-scd
  • got
  • gsoap
  • gtmess
  • heimdal
  • httrack httrack: use openssl@4 #279547
  • hydra
  • icecast
  • ike-scan
  • iperf3 iperf3: use openssl@4 #279551
  • ipmitool
  • ircd-hybrid
  • ircii
  • isync
  • john-jumbo
  • lasso
  • ldapvi
  • lftp
  • libcoap
  • libdap
  • libexosip
  • libfreefare
  • libmowgli
  • libp11
  • libpq@16
  • libpq@17
  • libu2f-server
  • lighttpd
  • links links: use openssl@4 #279545
  • lynx lynx: use openssl@4 #279546
  • memtier_benchmark
  • mfterm
  • midnight-commander
  • minimal-racket
  • monit
  • monitoring-plugins
  • mutt
  • nagios nagios: use openssl@4 #279105
  • ncrack
  • neomutt
  • nghttp2
  • ngircd
  • nmh
  • nopoll
  • nrpe
  • nsd
  • ntp
  • nut
  • objfw
  • omniorb
  • openfortivpn openfortivpn: use openssl@4 #279549
  • opensc
  • openvpn
  • ophcrack
  • pam-u2f
  • passenger
  • pdns
  • pgbouncer
  • php@8.1
  • php@8.2
  • php@8.3
  • pjproject
  • pkcs11-tools
  • postgresql@12
  • postgresql@13
  • postgresql@14
  • postgresql@15
  • postgresql@16
  • pure-ftpd
  • pwsafe pwsafe: use openssl@4 #279003
  • python-freethreading
  • redwax-tool
  • rethinkdb
  • rpki-client
  • ruby@3.0
  • ruby@3.1
  • s3-backer
  • sblim-sfcc
  • scamper
  • scrypt
  • shairport-sync
  • shellinabox
  • shibboleth-sp
  • siege
  • silk
  • sipsak sipsak: use openssl@4 #279580
  • slowhttptest
  • slrn
  • sngrep
  • snobol4
  • snownews
  • spice-server
  • sqlcipher sqlcipher: use openssl@4 #279567
  • squid
  • sstp-client
  • strongswan
  • stunnel
  • sylpheed
  • syslog-ng
  • tcpdump
  • tcpflow tcpflow: use openssl@4 #279556
  • tinc
  • tomcat-native
  • urweb
  • varnish
  • virtuoso
  • x3270
  • xaric
  • yafc
  • zabbix

Other (90)

1 dependent (58)

Go (1)

  • gensio (1 dependents)

C/C++ (CMake) (23)

  • apt (1 dependents)
  • azure-storage-common-cpp (1 dependents)
  • dcmtk (1 dependents)
  • gdcm (1 dependents)
  • getdns (1 dependents)
  • libff (1 dependents) libff: migrate to openssl@4 and fix test #278901
  • libgit2@1.7 (1 dependents)
  • libmsquic (1 dependents)
  • libpaho-mqtt (1 dependents)
  • libre (1 dependents)
  • libvncserver (1 dependents)
  • micromamba (1 dependents)
  • mysql (1 dependents)
  • mysql@8.0 (1 dependents)
  • mysql@8.4 (1 dependents)
  • nuraft (1 dependents)
  • pdal (1 dependents)
  • percona-server (1 dependents)
  • poco (1 dependents)
  • qpid-proton (1 dependents)
  • signalwire-client-c (1 dependents)
  • tiledb (1 dependents)
  • xrootd (1 dependents)

C/C++ (autotools) (23)

  • cups (1 dependents)
  • erlang@24 (1 dependents)
  • gwenhywfar (1 dependents)
  • httperf (1 dependents) httperf: use openssl@4 #279517
  • jimtcl (1 dependents)
  • liboauth (1 dependents) liboauth: use openssl@4 #279578
  • libslax (1 dependents)
  • libstrophe (1 dependents)
  • libtorrent-rakshasa (1 dependents)
  • md5sha1sum (1 dependents) md5sha1sum: use openssl@4 #279011
  • memcached (1 dependents)
  • nagios-plugins (1 dependents)
  • nginx (1 dependents)
  • node@18 (1 dependents)
  • node@20 (1 dependents)
  • oath-toolkit (1 dependents)
  • opensaml (1 dependents)
  • python@3.9 (1 dependents)
  • sleuthkit (1 dependents)
  • sofia-sip (1 dependents)
  • softhsm (1 dependents)
  • thrift (1 dependents)
  • yara (1 dependents)

Other (11)

  • apache-serf (1 dependents)
  • etcd-cpp-apiv3 (1 dependents)
  • karchive (1 dependents)
  • kmod (1 dependents)
  • libtpms (1 dependents)
  • llama.cpp (1 dependents)
  • mktorrent (1 dependents) mktorrent: use openssl@4 #279081
  • pixiewps (1 dependents)
  • redis (1 dependents)
  • spice-gtk (1 dependents)
  • zookeeper (1 dependents)
2–5 dependents (67)

Rust (1)

  • ruby@3.4 (2 dependents)

C/C++ (CMake) (18)

  • awscli (3 dependents)
  • azure-core-cpp (2 dependents)
  • ccache (2 dependents)
  • cpp-httplib (2 dependents) cpp-httplib: migrate to openssl@4 #278380
  • cpprestsdk (3 dependents)
  • davix (2 dependents)
  • dotnet@8 (2 dependents)
  • dotnet@9 (5 dependents)
  • libks (2 dependents)
  • libtorrent-rasterbar (2 dependents)
  • libwebsockets (3 dependents)
  • mongo-c-driver (4 dependents)
  • mysql-client (3 dependents)
  • qpdf (5 dependents)
  • rabbitmq-c (2 dependents)
  • s2n (2 dependents) s2n: migrate to openssl@4 #280912
  • ttyd (2 dependents)
  • wabt (3 dependents)

C/C++ (autotools) (34)

  • afflib (2 dependents)
  • cyrus-sasl (2 dependents) cyrus-sasl: migrate to openssl@4 #280924
  • erlang@26 (2 dependents)
  • gpac (2 dependents)
  • ldns (4 dependents)
  • libewf (2 dependents)
  • libfixbuf (2 dependents)
  • libimobiledevice (3 dependents)
  • libngtcp2 (4 dependents)
  • libretls (3 dependents)
  • libshout (4 dependents)
  • libtrace (2 dependents)
  • libxmlsec1 (3 dependents)
  • neon (5 dependents)
  • net-snmp (5 dependents)
  • nmap (3 dependents)
  • node@22 (5 dependents)
  • node@24 (3 dependents)
  • openssh (2 dependents)
  • php@8.4 (2 dependents)
  • pkcs11-helper (4 dependents)
  • python@3.10 (2 dependents)
  • riemann-client (2 dependents)
  • rsync (4 dependents)
  • samba (2 dependents)
  • socat (5 dependents)
  • srtp (2 dependents)
  • tarsnap (2 dependents)
  • texlive (4 dependents)
  • tor (3 dependents)
  • w3m (5 dependents)
  • xml-security-c (3 dependents)
  • xml-tooling-c (2 dependents)
  • xmlrpc-c (2 dependents)

Other (14)

  • berkeley-db (3 dependents)
  • crystal (5 dependents)
  • fbthrift (3 dependents)
  • fizz (5 dependents)
  • mupdf (3 dependents)
  • mvfst (5 dependents)
  • node-build (2 dependents)
  • pipewire (2 dependents)
  • pyenv (4 dependents)
  • pypy (2 dependents)
  • rtmpdump (5 dependents)
  • ruby-build (2 dependents)
  • valkey (3 dependents)
  • wangle (3 dependents)
6+ dependents (45)

Rust (4)

  • cargo-c (10 dependents)
  • cryptography (110 dependents)
  • gstreamer (12 dependents)
  • ruby (37 dependents)

C/C++ (CMake) (9)

C/C++ (autotools) (28)

  • apr-util (15 dependents)
  • asio (11 dependents)
  • bind (11 dependents)
  • curl (25 dependents)
  • erlang (18 dependents)
  • ffmpeg (75 dependents)
  • freetds (7 dependents)
  • httpd (9 dependents)
  • krb5 (22 dependents)
  • libevent (56 dependents)
  • libpq (51 dependents)
  • librdkafka (6 dependents)
  • libssh2 (24 dependents)
  • node (337 dependents)
  • openldap (11 dependents)
  • opusfile (10 dependents)
  • php (22 dependents)
  • postgresql@17 (12 dependents)
  • postgresql@18 (22 dependents)
  • python@3.11 (6 dependents)
  • python@3.12 (22 dependents)
  • python@3.13 (38 dependents)
  • python@3.14 (806 dependents)
  • rust (941 dependents)
  • tcl-tk (19 dependents)
  • tcl-tk@8 (13 dependents)
  • unbound (7 dependents)
  • wget (12 dependents)

Other (4)

  • hiredis (7 dependents)
  • pulseaudio (31 dependents)
  • qtbase (108 dependents)
  • systemd (69 dependents)

Metadata

Metadata

Assignees

No one assigned

    Labels

    help wantedTask(s) needing PRs from the community or maintainersopenssl-4-migrationRelated to switching to an OpenSSL 4 dependency

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions