From 56c3beecbeaa5acd6756271be9460fa7460c5602 Mon Sep 17 00:00:00 2001
From: Zachary Ware <zach@python.org>
Date: Tue, 25 Aug 2026 14:24:28 -0500
Subject: [PATCH] gh-156369: Update CI to use latest SSL library versions

---
 .github/workflows/build.yml           | 16 ++++++++--------
 .github/workflows/reusable-san.yml    |  2 +-
 .github/workflows/reusable-ubuntu.yml |  2 +-
 Tools/ssl/multissltests.py            | 12 ++++++------
 4 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index d6d61029b89d90..7fdc81ae0ade1d 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -268,13 +268,13 @@ jobs:
           # unsupported as it most resembles other 1.1.1-work-a-like ssl APIs
           # supported by important vendors such as AWS-LC.
           - { name: openssl, version: 1.1.1w }
-          - { name: openssl, version: 3.0.21 }
-          - { name: openssl, version: 3.4.6 }
-          - { name: openssl, version: 3.5.7 }
-          - { name: openssl, version: 3.6.3 }
-          - { name: openssl, version: 4.0.1 }
+          - { name: openssl, version: 3.0.22 }
+          - { name: openssl, version: 3.4.7 }
+          - { name: openssl, version: 3.5.8 }
+          - { name: openssl, version: 3.6.4 }
+          - { name: openssl, version: 4.0.2 }
           ## AWS-LC
-          - { name: aws-lc, version: 5.0.0 }
+          - { name: aws-lc, version: 5.5.0 }
     env:
       SSLLIB_VER: ${{ matrix.ssllib.version }}
       MULTISSL_DIR: ${{ github.workspace }}/multissl
@@ -379,7 +379,7 @@ jobs:
     needs: build-context
     if: needs.build-context.outputs.run-ubuntu == 'true'
     env:
-      OPENSSL_VER: 3.5.7
+      OPENSSL_VER: 3.5.8
       PYTHONSTRICTEXTENSIONBUILD: 1
     steps:
     - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -487,7 +487,7 @@ jobs:
       matrix:
         os: [ubuntu-26.04]
     env:
-      OPENSSL_VER: 3.5.7
+      OPENSSL_VER: 3.5.8
       PYTHONSTRICTEXTENSIONBUILD: 1
       ASAN_OPTIONS: detect_leaks=0:allocator_may_return_null=1:handle_segv=0
     steps:
diff --git a/.github/workflows/reusable-san.yml b/.github/workflows/reusable-san.yml
index 133b8ff8d7579b..449bddadf8b2c7 100644
--- a/.github/workflows/reusable-san.yml
+++ b/.github/workflows/reusable-san.yml
@@ -17,7 +17,7 @@ permissions:
 
 env:
   FORCE_COLOR: 1
-  OPENSSL_VER: 3.5.7
+  OPENSSL_VER: 3.5.8
 
 jobs:
   build-san-reusable:
diff --git a/.github/workflows/reusable-ubuntu.yml b/.github/workflows/reusable-ubuntu.yml
index 2129f2f6d6e926..97a0c22517e32c 100644
--- a/.github/workflows/reusable-ubuntu.yml
+++ b/.github/workflows/reusable-ubuntu.yml
@@ -35,7 +35,7 @@ jobs:
     runs-on: ${{ inputs.os }}
     timeout-minutes: 60
     env:
-      OPENSSL_VER: 3.5.7
+      OPENSSL_VER: 3.5.8
       PYTHONSTRICTEXTENSIONBUILD: 1
       TERM: linux
     steps:
diff --git a/Tools/ssl/multissltests.py b/Tools/ssl/multissltests.py
index d5e38993d971df..037f1852180b62 100755
--- a/Tools/ssl/multissltests.py
+++ b/Tools/ssl/multissltests.py
@@ -50,11 +50,11 @@
 ]
 
 OPENSSL_RECENT_VERSIONS = [
-    "3.0.21",
-    "3.4.6",
-    "3.5.7",
-    "3.6.3",
-    "4.0.1",
+    "3.0.22",
+    "3.4.7",
+    "3.5.8",
+    "3.6.4",
+    "4.0.2",
     # See make_ssl_data.py for notes on adding a new version.
 ]
 
@@ -65,7 +65,7 @@
 ]
 
 AWSLC_RECENT_VERSIONS = [
-    "5.0.0",
+    "5.5.0",
 ]
 
 # store files in ../multissl