chore(deps): bump phpseclib/phpseclib from 3.0.56 to 4.0.1

[dependabot]

Bumps phpseclib/phpseclib from 3.0.56 to 4.0.1.

Release notes

Sourced from phpseclib/phpseclib's releases.

4.0.1

• Curve25519/448: improve timing attack resistance

4.0.0

• split CSR / CRL / SPKAC out from X509
• add PFX / CMS support
• implement lazy loading for ASN1
• SSH2/SFTP: throw exceptions instead of returning false
• bump minimum required PHP version to 8.1.0
• namespace changed from \phpseclib3 to \phpseclib4 to facilitate a yet to be written phpseclib 3 shim (phpseclib3_compat)

3.0.57

• ASN1: fix tag matching for tagged CHOICE children (#2158)
• RSA: fix for openssl_verify calls that error out (#2161)
• RSA/PublicKey: implement salt length discovery for PSS verification (#2164)
• BigInteger/PHP: don't return the divisor as the common residue (#2165)
• Curve25519/448: improve timing attack resistance

Changelog

Sourced from phpseclib/phpseclib's changelog.

4.0.1 - 2026-08-26

• Curve25519/448: improve timing attack resistance

4.0.0 - 2026-08-22

• split CSR / CRL / SPKAC out from X509
• add PFX / CMS support
• implement lazy loading for ASN1
• SSH2/SFTP: throw exceptions instead of returning false
• bump minimum required PHP version to 8.1.0
• namespace changed from \phpseclib3 to \phpseclib4 to facilitate a yet to be written phpseclib 3 shim (phpseclib3_compat)

3.0.57 - 2026-08-26

• ASN1: fix tag matching for tagged CHOICE children (#2158)
• RSA: fix for openssl_verify calls that error out (#2161)
• RSA/PublicKey: implement salt length discovery for PSS verification (#2164)
• BigInteger/PHP: don't return the divisor as the common residue (#2165)
• Curve25519/448: improve timing attack resistance

Commits

• bb7b959 Merge branch '3.0' into 4.0
• d17e0dd CHANGELOG: add 3.0.57 release
• 99b8775 psalm fixes
• 6b887bb Merge branch '4.0' of github.com:phpseclib/phpseclib into 4.0
• a8bac78 Merge branch '3.0' into 4.0
• 3a43a75 EC: implement blinding for montgomery curve multiplication
• 6d4805f DH: add tests for all-zero shared secrets with Curve25519 / Curve448
• 86669f0 CHANGELOG: add 4.0.0 release
• fb56bc5 EC/Curve{25519,448} enhancements
• 95082b6 Merge branch '3.0' into 4.0
• Additional commits viewable in compare view

[update-docs]

Thanks for opening this pull request! The maintainers of this repository would appreciate it if you would create a changelog item based on your changes.

[DeepDiver1975]

Holding: CI is failing (not a rebase conflict). phpseclib 4.0.1 renamed the root namespace, so Class "phpseclib3\File\X509" not found in lib/kernel.php:537 — Install Server fails, taking PHP Code Style (8.3) and all three PHP Unit (8.3) legs with it. A rebase won't fix this — the phpseclib3\ references in lib/kernel.php (and any other call sites) need porting to the v4 namespace first.

[phil-davis]

@dependabot rebase

[phil-davis]

Added a commit changing phpseclib3 to phpseclib4.
There is more to do.

[DeepDiver1975]

Holding: CI is failing (not a rebase conflict) — root-cause refinement, supersedes my earlier comment on this PR.

The namespace rename itself is no longer the blocker (the tree now references phpseclib4\File\X509). The current failure is an API removal in phpseclib 4.0.1:

• CI / PHP Unit (8.3, *) — all 5 DB legs fail at step Run PHPUnit: Error: Call to undefined method phpseclib4\File\X509::loadCA(), which then surfaces as OC\IntegrityCheck\Exceptions\CrlUnavailableException: No valid CRL available (fetch and bundled both failed or invalid). loadCA() no longer exists in phpseclib 4.
• CI / API Acceptance Tests and CI / CLI Acceptance Tests fail at Check status of ... (downstream of the above).
• Lint and Code Style / PHP Code Style (8.3) fails at Run PHP Phan for an unrelated reason: phan composer.lock is not up to date — a second, independent blocker on this PR.

A rebase won't fix either. Needs a source migration off loadCA() plus a composer bin phan update.

[DeepDiver1975]

Holding: CI is failing (not a rebase conflict) — root-cause refinement, supersedes my earlier comments on this PR. Re-derived from the live logs this run (still within retention).

This is now ONE cause, not two. My previous note claimed a second, independent red from a stale composer.lock in the phan/code-style job. That is disproven: the owncloud-codestyle/php_codesniffer/phan/phpstan/behat composer.lock is not up to date lines are benign bamarni-bin vendor-bin chatter, every one of those steps succeeded, and the only failing step in the style job is step 8 "Run PHP Phan". Both reds are the same API break with two different reporters.

Cause: phpseclib 4 removed/renamed the File\X509 loader API — loadCA(), loadX509(), loadCRL() and getRevoked() no longer exist, and validateDate() is now private — which breaks lib/private/IntegrityCheck/Verifier/*.

• PHP Unit (job 99416694446, run 33369355540): Error: Call to undefined method phpseclib4\File\X509::loadCA() x13 → Tests: 11052, Errors: 13, Failures: 18
• PHP Code Style (job 99416691521, run 33369354851): phan PhanUndeclaredMethod at ChainValidator.php:87,89,103,108,112,194,197,201,234, CrlValidator.php:46,52,56, ParsedCrl.php:33, plus Verifier.php:145 PhanAccessMethodPrivate Cannot access private method \phpseclib4\File\X509::validateDate → make: *** [Makefile:232: test-php-phan] Error 1

The API Acceptance Tests / CLI Acceptance Tests reds are pure cascade, not a third cause: ci.yml:48 gives acceptance-api-smoke needs: [semantic-git-messages, php-unit, calens], so php-unit failing skipped them and the if: always() aggregator (ci.yml:162-168) exits 1 with "All the API Acceptance jobs were skipped".

Needs a source migration in the IntegrityCheck verifiers. A rebase will not fix this. (run_attempt=1; not a rerun candidate — deterministic.)