Releasing Ruby OpenSSL 4.1.0 and/or 4.0.2 supporting OpenSSL 4.x

[junaruga]

OpenSSL 4.0.0 final version was released on 14th April 2026.

https://openssl-library.org/post/2026-04-14-openssl-40-final-release/

Seeing Ruby OpenSSL's compatibility and maintenance policy table, I want to see Ruby OpenSSL's new version releases which support OpenSSL 4.x, including the commits in #1019. The new release versions can be version 4.1.0 and/or 4.0.2, and the updated table can be like this, by replacing OpenSSL ...-3.x with OpenSSL ...-4.x.

Version	Minimum Ruby	OpenSSL compatibility	Bundled with	Maintenance
4.1.x	Ruby 3.2?	OpenSSL 1.1.1-4.x, LibreSSL 4.1+?, AWS-LC	Ruby 4.1	bug fixes
4.0.x	Ruby 2.7	OpenSSL 1.1.1-4.x, LibreSSL 3.9+, AWS-LC	Ruby 4.0	bug fixes

@rhenium What do you think?

[rhenium]

I wonder if we should try to backport patches to older branches too so that maintained Ruby branches can import them as a default gem. Fortunately, the diff shouldn't be as massive as the previous major releases, which required updating more than 1000 lines.

[junaruga]

I wonder if we should try to backport patches to older branches too so that maintained Ruby branches can import them as a default gem. Fortunately, the diff shouldn't be as massive as the previous major releases, which required updating more than 1000 lines.

For your wondering if we should try to backport patches to older branches like maint-3.3, maint-3.2, I can provide you some information about Fedora, RHEL and MacOS brew

In Fedora Linux, OpenSSL RPM maintainer plans to upgrade OpenSSL RPM version to 4.0.0 for Fedora Linux version 45 (rawhide) in April.[1] So, as I am involved in Ruby RPM, someone or I need to apply the patch #1019 to Ruby (version 4.0) RPM in Fedora Linux 45 (rawhide). So, if we release Ruby OpenSSL 4.0.2 supporting OpenSSL 4.0.0, eventually ruby/ruby version 4.0.x bundles Ruby OpenSSL 4.0.2, Ruby RPM in Fedora Linux 45 can drop the patch. Fedora Linux 45 is only the version affected by Ruby OpenSSL 4.0.x. Fedora Linux is not affected by older branches for Ruby OpenSSL 3.3.x, 3.2.x and etc.

In RHEL 10 and RHEL 9, OpenSSL RPM will not be upgraded from the current version OpenSSL 3.x to 4.x. RHEL is not affected by OpenSSL 4.x.

For MacOS brew openssl package, in my understanding, it is a rolling release using the latest version.[2] So, I assume that brew openssl package will ship openssl@4 package as an alias of the openssl package soon or later. I think users still can use OpenSSL 3 by installing openssl@3. However, for example, mysql2 checks brew openssl package by default installation.[3] So, if we can backport patches to older branches that can be bundled in older Rubies later, I think that's nice in that case.

• [1] Fedora project mail thread about OpensSSL 4.0: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/VX2IJAK6HSGCWCEP473YUIXVLW47C6LG/
• [2] brew openssl (openssl@3) package: https://formulae.brew.sh/formula/openssl@3 - openssl is alias of openssl@3 right now.
• [3] mysql2 gem using brew openssl package to build: https://github.com/brianmario/mysql2/blob/b009d7e114729cbae5bef069a1033dd78acf7745/ext/mysql2/extconf.rb#L65

[rhenium]

I've backported OpenSSL 4.0 support in #1051 and released v3.2.4, v3.3.3, and v4.0.2.

[junaruga]

That's great! I am also seeing your backport request ticket in ruby/ruby. Thank you for you work.