DEPRECATE.md: drop old OpenSSL versions

Closes #18413

diff --git a/docs/DEPRECATE.md b/docs/DEPRECATE.md
index bc4c0fc6ab2f6ed7676851deb0bcead0161f8e5f..65c630cbeebe1e19835519514c9829b7bbf16755 100644 (file)
--- a/docs/DEPRECATE.md
+++ b/docs/DEPRECATE.md
@@ -48,6 +48,20 @@ Making the new minimum target Windows version Vista / Server 2008.
 
 In March 2026, we drop support for all c-ares versions before 1.16.0.
 
+## OpenSSL 1.0.2
+
+OpenSSL and others only ship fixes for this version to paying customers,
+meaning users of the free version risk being vulnerable.
+
+We remove support for this OpenSSL version from curl in December 2025.
+
+## OpenSSL 1.1.1
+
+OpenSSL and others only ship fixes to paying customers, meaning users of the
+free version risk being vulnerable.
+
+We remove support for this OpenSSL version from curl in June 2026.
+
 ## Past removals
 
  - axTLS (removed in 7.63.0)