Bump openssl from 2.2.2 to 3.0.0 in /app

[dependabot]

Bumps openssl from 2.2.2 to 3.0.0.

Release notes

Sourced from openssl's releases.

v2.2.3

What's Changed

• pkey/ec: fix multiple ossl_raise() calls using cEC_POINT instead of eEC_POINT by @​bannable in ruby/openssl#570
• raise when EC_POINT_cmp or EC_GROUP_cmp error instead of returning true by @​bannable in ruby/openssl#564
• maint-2.2 Actions - update workflow to use OpenSSL 1.1.1, actions/checkout@v3 by @​MSP-Greg in ruby/openssl#572
• Ruby/OpenSSL 2.2.3 by @​rhenium in ruby/openssl#581

New Contributors

• @​bannable made their first contribution in ruby/openssl#570

Full Changelog: ruby/openssl@v2.2.2...v2.2.3

Changelog

Sourced from openssl's changelog.

Version 3.0.0

Compatibility notes

• OpenSSL 1.0.1 and Ruby 2.3-2.5 are no longer supported. [[GitHub #396]](ruby/openssl#396) [[GitHub #466]](ruby/openssl#466)

• OpenSSL 3.0 support is added. It is the first major version bump from OpenSSL 1.1 and contains incompatible changes that affect Ruby/OpenSSL. Note that OpenSSL 3.0 support is preliminary and not all features are currently available: [[GitHub #369]](ruby/openssl#369)

  • Deprecate the ability to modify OpenSSL::PKey::PKey instances. OpenSSL 3.0 made EVP_PKEY structure immutable, and hence the following methods are not available when Ruby/OpenSSL is linked against OpenSSL 3.0. [[GitHub #480]](ruby/openssl#480)

    • OpenSSL::PKey::RSA#set_key, #set_factors, #set_crt_params
    • OpenSSL::PKey::DSA#set_pqg, #set_key
    • OpenSSL::PKey::DH#set_pqg, #set_key, #generate_key!
    • OpenSSL::PKey::EC#private_key=, #public_key=, #group=, #generate_key!

  • Deprecate OpenSSL::Engine. The ENGINE API has been deprecated in OpenSSL 3.0 in favor of the new "provider" concept and will be removed in a future version. [[GitHub #481]](ruby/openssl#481)

• OpenSSL::SSL::SSLContext#tmp_ecdh_callback has been removed. It has been deprecated since v2.0.0 because it is incompatible with modern OpenSSL versions. [[GitHub #394]](ruby/openssl#394)

• OpenSSL::SSL::SSLSocket#read and #write now raise OpenSSL::SSL::SSLError if called before a TLS connection is established. Historically, they read/wrote unencrypted data to the underlying socket directly in that case. [[GitHub #9]](ruby/openssl#9) [[GitHub #469]](ruby/openssl#469)

Notable changes

• Enhance OpenSSL::PKey's common interface. [[GitHub #370]](ruby/openssl#370)

  • Key deserialization: Enhance OpenSSL::PKey.read to handle PEM encoding of

... (truncated)

Commits

• bff4080 Ruby/OpenSSL 3.0.0
• 3bab2ef remove docker-compose files
• 21d611f test/openssl/test_ssl: adjust certificate expiry date
• 8be6b85 Merge pull request #457 from unasuke/ossl_bn_ractor
• 7541a66 Add tast cases to OpenSSL::BN using ractor
• 4beb383 Merge pull request #481 from rhenium/ky/openssl-3.0.0-part2
• fd4dd6d .github/workflows: test against OpenSSL 3.0
• d6535d1 pkey: use EVP_PKEY_CTX_new_from_name() on OpenSSL 3.0
• ccdb6f7 pkey: assume a pkey always has public key components on OpenSSL 3.0
• e168df0 ssl: update test_options_disable_versions
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.