Do cffi, docutils & pycparser depend on openssl@1.1?

[xyzzy-plugh-plover]

Output of brew config

HOMEBREW_VERSION: 4.1.11-2-geacdf7a
ORIGIN: https://github.com/Homebrew/brew.git
HEAD: eacdf7aa60a1a8a64acc71853ec5559cfd2329c3
Last commit: 9 hours ago
Core tap origin: https://github.com/Homebrew/homebrew-core
Core tap HEAD: fe20814d11c50c95df0bb6fb67f1f9ead05f7be6
Core tap last commit: 81 minutes ago
Core tap branch: master
Core tap JSON: 12 Sep 12:31 UTC
HOMEBREW_PREFIX: /usr/local
HOMEBREW_CASK_OPTS: []
HOMEBREW_DISPLAY: /private/tmp/com.apple.launchd.Rz7KNDZeqP/org.xquartz:0
HOMEBREW_GITHUB_API_TOKEN: set
HOMEBREW_MAKE_JOBS: 4
HOMEBREW_NO_ANALYTICS: set
HOMEBREW_SORBET_RUNTIME: set
Homebrew Ruby: 2.6.10 => /System/Library/Frameworks/Ruby.framework/Versions/2.6/usr/bin/ruby
CPU: quad-core 64-bit haswell
Clang: 14.0.0 build 1400
Git: 2.42.0 => /usr/local/bin/git
Curl: 8.1.2 => /usr/bin/curl
macOS: 12.6.9-x86_64
CLT: 14.2.0.0.1.1668646533
Xcode: 14.2

Output of brew doctor

Please note that these warnings are just used to help the Homebrew maintainers
with debugging if you file an issue. If everything you use Homebrew for is
working fine: please don't worry or file an issue; just ignore this. Thanks!

Warning: You have unlinked kegs in your Cellar.
Leaving kegs unlinked can lead to build-trouble and cause formulae that depend on
those kegs to fail to run properly once built. Run `brew link` on these:
  cffi

Description of issue

brew uses --installed openssl@1.1 returns cffi, docutils & pycparser, but openssl is not output by brew info --verbose for those casks, nor is it in their respective formulae.

Is brew uses returning incorrect info? If so, why, and how can I fix it? If it's correct, where are these openssl@1.1 dependencies specified?

All of my formulae & casks are current.

[SMillerDev]

What does brew outdated say? Because AFAIK uses analyses your current install and info outputs general information.

[gromgit]

Yeah, that openssl@1.1 dependency is definitely not right, but I've no idea how that got there. Perhaps @SMillerDev could shed further light on this?

UPDATE: Never mind, just noticed that python@3.11 was depending on openssl@1.1 until 3.11.4, which postdates your pycparser installation. That's where it picked up that old dependency from.

[xyzzy-plugh-plover]

brew deps & brew uses shouldn't obtain recursive dependencies from installation receipts, as the recursive dependencies that they contain might be out of date; they should recursively request each formula's current direct dependencies. If the brew commands are using installation receipts for recursive dependencies (instead of solely for direct dependencies), then they are broken.

If any direct dependency is not installed, then it should be listed with an asterisk (or similar notation) to indicate that it is missing. The recursive dependencies from its direct parent's install receipt that aren't already listed in the output can be appended, but should have two asterisks (or similar notation) to indicate that they are recursive dependencies that are assumed to have been required by the missing direct dependency or its recursive dependencies.

[xyzzy-plugh-plover]

I've reinstalled the 3 formulae; the install receipts now include openssl@3, and both brew deps & brew uses show that the formulae use openssl@3. It is likely that the commands use the install receipts.

[xyzzy-plugh-plover]

Is the above the intended behavior?

If so, then the documentation should be updated to note that brew deps & brew uses use outdated information from installation receipts. (even if this is the intended behavior, it seems a poor choice of behavior)

If not, then the code should be fixed.

[cho-m]

Sounds similar to a known issue in brew (e.g. Homebrew/brew#13717) where dependency information is based on formulae/versions at original install time.

It is probably not intended, but the behavior will remain until someone has time to work on a fix. Main workaround is to refresh the tab by brew reinstall.