Merge branch 'maint-3.3'

* maint-3.3:
  Ruby/OpenSSL 3.3.1
  Ruby/OpenSSL 3.2.2
  Ruby/OpenSSL 3.1.2
  ssl: remove OpenSSL::X509::V_FLAG_CRL_CHECK_ALL from the default store

Author: rhenium

History.md

@@ -1,3 +1,9 @@
+Version 3.3.1
+=============
+
+Merged changes in 3.1.2 and 3.2.2.
+
+
 Version 3.3.0
 =============
 
@@ -74,6 +80,12 @@ And various non-user-visible changes and bug fixes. Please see the commit
 history for more details.
 
 
+Version 3.2.2
+=============
+
+Merged changes in 3.1.2.
+
+
 Version 3.2.1
 =============
 
@@ -120,6 +132,23 @@ Notable changes
   [[GitHub #141]](https://github.com/ruby/openssl/pull/141)
 
 
+Version 3.1.2
+=============
+
+Bug fixes
+---------
+
+* Fix crash when attempting to export an incomplete `OpenSSL::PKey::DSA` key.
+  [[GitHub #845]](https://github.com/ruby/openssl/issues/845)
+  [[GitHub #847]](https://github.com/ruby/openssl/pull/847)
+* Remove the `OpenSSL::X509::V_FLAG_CRL_CHECK_ALL` flag from the default store
+  used by `OpenSSL::SSL::SSLContext#set_params`. It causes certificate
+  verification to fail with OpenSSL 3.6.0. It has no effect with any other
+  OpenSSL versions.
+  [[GitHub #949]](https://github.com/ruby/openssl/issues/949)
+  [[GitHub #950]](https://github.com/ruby/openssl/pull/950)
+
+
 Version 3.1.1
 =============
 

lib/openssl/ssl.rb

@@ -91,7 +91,6 @@ class SSLContext
 
       DEFAULT_CERT_STORE = OpenSSL::X509::Store.new # :nodoc:
       DEFAULT_CERT_STORE.set_default_paths
-      DEFAULT_CERT_STORE.flags = OpenSSL::X509::V_FLAG_CRL_CHECK_ALL
 
       # A callback invoked when DH parameters are required for ephemeral DH key
       # exchange.

lib/openssl/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module OpenSSL
-  VERSION = "3.3.0"
+  VERSION = "3.3.1"
 end

openssl.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |spec|
   spec.name          = "openssl"
-  spec.version       = "3.3.0"
+  spec.version       = "3.3.1"
   spec.authors       = ["Martin Bosslet", "SHIBATA Hiroshi", "Zachary Scott", "Kazuki Yamaguchi"]
   spec.email         = ["[email protected]"]
   spec.summary       = %q{SSL/TLS and general-purpose cryptography for Ruby}