From 85da05177570bf3b60617f4c4eda2528a9aeb7a2 Mon Sep 17 00:00:00 2001 From: Zachary Ware Date: Sat, 26 Sep 2026 20:56:41 -0500 Subject: [PATCH] gh-158010: Avoid recommending out-of-date OpenSSL in configure doc --- Doc/using/configure.rst | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/Doc/using/configure.rst b/Doc/using/configure.rst index 88b5f35a796796..690d70794f9a8c 100644 --- a/Doc/using/configure.rst +++ b/Doc/using/configure.rst @@ -95,8 +95,7 @@ Dependencies to build optional modules are: - - :mod:`curses` * - `OpenSSL `_ - - | 3.0.18 recommended - | (1.1.1 minimum) + - [8]_ - :mod:`ssl`, :mod:`hashlib` [6]_ * - `SQLite `_ - 3.15.2 @@ -131,6 +130,14 @@ Dependencies to build optional modules are: See :option:`--with-builtin-hashlib-hashes` for *forcing* usage of OpenSSL. .. [7] See :option:`--with-zlib` for choosing the backend for the :mod:`zlib` module. +.. [8] OpenSSL 1.1.1 is the minimum possible version to build against, + but the latest public release of the series has known vulnerabilities. + For best compatibility and security it is recommended to always use + the latest patch release of a current LTS release series (see the + `OpenSSL Roadmap `_), + or the package provided by your operating system if available. Other + libraries that offer an API compatible with OpenSSL 1.1.1 or later may + also be usable, but are not officially supported. Note that the table does not include all optional modules; in particular, platform-specific modules like :mod:`winreg` are not listed here.