Skip to content

chore(deps): bump phpseclib/phpseclib from 3.0.56 to 4.0.1 #41798

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 4 commits into
base: master
Choose a base branch
from
Open

chore(deps): bump phpseclib/phpseclib from 3.0.56 to 4.0.1 #41798

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
2683d64
chore(deps): bump phpseclib/phpseclib from 3.0.56 to 4.0.1
dependabot[bot] Aug 30, 2026
df4436e
fix: update phpseclib3 to phpseclib4
phil-davis Aug 31, 2026
3953ad3
fix: remove X509::disableURLFetch()
phil-davis Aug 31, 2026
9facff8
chore: add changleof for phpseclib 4.0.1
phil-davis Aug 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions apps/files_external/appinfo/Migrations/Version20220329110116.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,8 +11,8 @@
use OCP\Files\External\IStorageConfig;
use OCP\ILogger;
use OCP\IConfig;
use phpseclib3\Crypt\RSA as RSACrypt;
use phpseclib3\Crypt\RSA\PrivateKey;
use phpseclib4\Crypt\RSA as RSACrypt;
use phpseclib4\Crypt\RSA\PrivateKey;

class Version20220329110116 implements ISimpleMigration {
/** @var IGlobalStoragesService */
Expand Down Expand Up @@ -59,7 +59,7 @@ public function run(IOutput $out) {
try {
/** @phan-suppress-next-line PhanUndeclaredMethod */
$rsaKey = RSACrypt::load($privKey, $pass)->withHash('sha1');
} catch (\phpseclib3\Exception\NoKeyLoadedException $e) {
} catch (\phpseclib4\Exception\NoKeyLoadedException $e) {
$out->warning("Storage configuration with id = {$configId}: Cannot load private key, skipping");
continue;
}
Expand Down
2 changes: 1 addition & 1 deletion apps/files_external/lib/Lib/Auth/PublicKey/RSA.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@
use OCP\Files\External\DefinitionParameter;
use OCP\IL10N;
use OCA\Files_External\Lib\RSAStore;
use phpseclib3\Crypt\RSA as RSACrypt;
use phpseclib4\Crypt\RSA as RSACrypt;

/**
* RSA public key authentication
Expand Down
6 changes: 3 additions & 3 deletions apps/files_external/lib/Lib/RSAStore.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,11 +23,11 @@

use OCP\Security\ICredentialsManager;
use OCP\IConfig;
use phpseclib3\Crypt\RSA;
use phpseclib3\Crypt\RSA\PrivateKey;
use phpseclib4\Crypt\RSA;
use phpseclib4\Crypt\RSA\PrivateKey;

/**
* Store and retrieve phpseclib3 RSA private keys
* Store and retrieve phpseclib4 RSA private keys
*/
class RSAStore {
private static $rsaStore = null;
Expand Down
8 changes: 4 additions & 4 deletions apps/files_external/lib/Lib/Storage/SFTP.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@
namespace OCA\Files_External\Lib\Storage;
use Icewind\Streams\IteratorDirectory;
use Icewind\Streams\RetryWrapper;
use phpseclib3\Net\SFTP\Stream;
use phpseclib4\Net\SFTP\Stream;
use OCA\Files_External\Lib\RSAStore;

/**
Expand All @@ -50,7 +50,7 @@ class SFTP extends \OCP\Files\Storage\StorageAdapter {
private $auth;

/**
* @var \phpseclib3\Net\SFTP
* @var \phpseclib4\Net\SFTP
*/
protected $client;

Expand Down Expand Up @@ -118,7 +118,7 @@ public function __construct($params) {
/**
* Returns the connection.
*
* @return \phpseclib3\Net\SFTP connected client instance
* @return \phpseclib4\Net\SFTP connected client instance
* @throws \Exception when the connection failed
*/
public function getConnection() {
Expand All @@ -127,7 +127,7 @@ public function getConnection() {
}

$hostKeys = $this->readHostKeys();
$this->client = new \phpseclib3\Net\SFTP($this->host, $this->port);
$this->client = new \phpseclib4\Net\SFTP($this->host, $this->port);

// The SSH Host Key MUST be verified before login().
$currentHostKey = $this->client->getServerPublicHostKey();
Expand Down
2 changes: 1 addition & 1 deletion apps/files_external/tests/RSAStoreTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@
use OCP\Security\ICredentialsManager;
use OCP\IConfig;
use OCA\Files_External\Lib\RSAStore;
use phpseclib3\Crypt\RSA;
use phpseclib4\Crypt\RSA;

class RSAStoreTest extends \Test\TestCase {
/** @var ICredentialsManager */
Expand Down
3 changes: 2 additions & 1 deletion changelog/unreleased/PHPdependencies202608onward
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ The following have been updated:

* pear/archive_tar (1.6.0 to 1.6.1)

* phpseclib/phpseclib (3.0.55 to 3.0.56)
* phpseclib/phpseclib (3.0.55 to 4.0.1)

* sabre/event (5.1.8 to 5.1.9)

Expand All @@ -35,3 +35,4 @@ The following have been updated:
https://github.com/owncloud/core/pull/41775
https://github.com/owncloud/core/pull/41791
https://github.com/owncloud/core/pull/41797
https://github.com/owncloud/core/pull/41798
2 changes: 1 addition & 1 deletion composer.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,7 +88,7 @@
"owncloud/tarstreamer": "v2.1.0",
"pear/archive_tar": "1.6.1",
"pear/pear-core-minimal": "^v1.10",
"phpseclib/phpseclib": "^3.0",
"phpseclib/phpseclib": "^4.0",
"pimple/pimple": "^3.6",
"punic/punic": "^3.8",
"rhukster/dom-sanitizer": "^1.0.10",
Expand Down
168 changes: 104 additions & 64 deletions composer.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

12 changes: 4 additions & 8 deletions lib/kernel.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -527,14 +527,10 @@ public static function init() {
\spl_autoload_register([self::$loader, 'load']);
$loaderEnd = \microtime(true);

// SECURITY: Disable phpseclib's automatic URL fetching process-wide.
// phpseclib's X509 will otherwise follow AIA caIssuers / CRL distribution
// point URLs found inside a certificate, which is an SSRF vector when
// validating attacker-supplied certificates (e.g. the IntegrityCheck
// code-signing verifier). ownCloud never relies on phpseclib fetching
// remote URLs, so this is disabled once here at boot rather than toggled
// per validation call — a single, greppable, non-hidden global default.
\phpseclib3\File\X509::disableURLFetch();
// SECURITY: phpseclib v4 disables automatic URL fetching process-wide by default.
// ownCloud never relies on phpseclib fetching remote URLs, so this default
// behavior is what is needed. The old code to call disableURLFetch() for
// phpseclib v3 is no long needed.

try {
self::initPaths();
Expand Down
2 changes: 1 addition & 1 deletion lib/private/Files/External/LegacyUtil.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@

namespace OC\Files\External;

use phpseclib3\Crypt\AES;
use phpseclib4\Crypt\AES;
use \OCP\Files\External\IStorageConfig;
use \OCP\Files\StorageNotAvailableException;

Expand Down
2 changes: 1 addition & 1 deletion lib/private/IntegrityCheck/Verifier/ChainResult.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@

namespace OC\IntegrityCheck\Verifier;

use phpseclib3\File\X509;
use phpseclib4\File\X509;

/**
* ChainResult - Immutable holder for successful X.509 chain validation result.
Expand Down
Loading
Loading