Skip to content

chore(deps): Bump phpseclib/phpseclib from 3.0.56 to 4.0.1 - #6040

Merged
elzody merged 2 commits into
mainfrom
dependabot/composer/phpseclib/phpseclib-4.0.0
Sep 8, 2026
Merged

chore(deps): Bump phpseclib/phpseclib from 3.0.56 to 4.0.1#6040
elzody merged 2 commits into
mainfrom
dependabot/composer/phpseclib/phpseclib-4.0.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 5, 2026

Copy link
Copy Markdown
Contributor

Bumps phpseclib/phpseclib from 3.0.56 to 4.0.1.

Release notes

Sourced from phpseclib/phpseclib's releases.

4.0.1

4.0.0

  • split CSR / CRL / SPKAC out from X509
  • add PFX / CMS support
  • implement lazy loading for ASN1
  • SSH2/SFTP: throw exceptions instead of returning false
  • bump minimum required PHP version to 8.1.0
  • namespace changed from \phpseclib3 to \phpseclib4 to facilitate a yet to be written phpseclib 3 shim (phpseclib3_compat)

3.0.57

  • ASN1: fix tag matching for tagged CHOICE children (#2158)
  • RSA: fix for openssl_verify calls that error out (#2161)
  • RSA/PublicKey: implement salt length discovery for PSS verification (#2164)
  • BigInteger/PHP: don't return the divisor as the common residue (#2165)
  • Curve25519/448: improve timing attack resistance (CVE-2026-84308)
Changelog

Sourced from phpseclib/phpseclib's changelog.

4.0.1 - 2026-08-26

4.0.0 - 2026-08-22

  • split CSR / CRL / SPKAC out from X509
  • add PFX / CMS support
  • implement lazy loading for ASN1
  • SSH2/SFTP: throw exceptions instead of returning false
  • bump minimum required PHP version to 8.1.0
  • namespace changed from \phpseclib3 to \phpseclib4 to facilitate a yet to be written phpseclib 3 shim (phpseclib3_compat)

3.0.57 - 2026-08-26

  • ASN1: fix tag matching for tagged CHOICE children (#2158)
  • RSA: fix for openssl_verify calls that error out (#2161)
  • RSA/PublicKey: implement salt length discovery for PSS verification (#2164)
  • BigInteger/PHP: don't return the divisor as the common residue (#2165)
  • Curve25519/448: improve timing attack resistance (CVE-2026-84308)
Commits
  • bb7b959 Merge branch '3.0' into 4.0
  • d17e0dd CHANGELOG: add 3.0.57 release
  • 99b8775 psalm fixes
  • 6b887bb Merge branch '4.0' of github.com:phpseclib/phpseclib into 4.0
  • a8bac78 Merge branch '3.0' into 4.0
  • 3a43a75 EC: implement blinding for montgomery curve multiplication
  • 6d4805f DH: add tests for all-zero shared secrets with Curve25519 / Curve448
  • 86669f0 CHANGELOG: add 4.0.0 release
  • fb56bc5 EC/Curve{25519,448} enhancements
  • 95082b6 Merge branch '3.0' into 4.0
  • Additional commits viewable in compare view

@dependabot dependabot Bot added 3. to review Ready to be reviewed dependencies Pull requests that update a dependency file labels Sep 5, 2026
@dependabot dependabot Bot added 3. to review Ready to be reviewed dependencies Pull requests that update a dependency file labels Sep 5, 2026
@github-actions
github-actions Bot enabled auto-merge September 5, 2026 01:03
@elzody

elzody commented Sep 8, 2026

Copy link
Copy Markdown
Collaborator

@dependabot rebase

Bumps [phpseclib/phpseclib](https://github.com/phpseclib/phpseclib) from 3.0.56 to 4.0.1.
- [Release notes](https://github.com/phpseclib/phpseclib/releases)
- [Changelog](https://github.com/phpseclib/phpseclib/blob/master/CHANGELOG.md)
- [Commits](phpseclib/phpseclib@3.0.56...4.0.1)

---
updated-dependencies:
- dependency-name: phpseclib/phpseclib
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore(deps): Bump phpseclib/phpseclib from 3.0.56 to 4.0.0 chore(deps): Bump phpseclib/phpseclib from 3.0.56 to 4.0.1 Sep 8, 2026
@dependabot
dependabot Bot force-pushed the dependabot/composer/phpseclib/phpseclib-4.0.0 branch from dfaabac to 4919903 Compare September 8, 2026 22:39
In phpseclib 4 the namespace changed from phpseclib3 to phpseclib4 so
that had to be changed as it couldn't find the classes. Then, a
redundant string cast was removed as __toString() already returns a
string - no need to cast it.

Signed-off-by: Elizabeth Danzberger <elizabeth@elzody.dev>
@elzody

elzody commented Sep 8, 2026

Copy link
Copy Markdown
Collaborator

The remaining failing Cypress test is unrelated to these changes and is the result of a change in the files_pdfviewer app. Nothing we did wrong here - the original problems are fixed and this can be merged.

@elzody
elzody disabled auto-merge September 8, 2026 23:03
@elzody
elzody merged commit a4058f9 into main Sep 8, 2026
62 of 64 checks passed
@elzody
elzody deleted the dependabot/composer/phpseclib/phpseclib-4.0.0 branch September 8, 2026 23:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

3. to review Ready to be reviewed dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant