There's a closed pull request on the void-packages repository

tectonic: remove hardcoded versions
https://github.com/void-linux/void-packages/pull/14463

Description:
This way, we don’t need to change theses numbers at each breaking change from libressl,
because cargo will pick the latest openssl and openssl-sys.