build(deps): bump phpseclib/phpseclib from 3.0.56 to 4.0.1

[dependabot]

Bumps phpseclib/phpseclib from 3.0.56 to 4.0.1.

Release notes

Sourced from phpseclib/phpseclib's releases.

4.0.1

• Curve25519/448: improve timing attack resistance (CVE-2026-84308)

4.0.0

• split CSR / CRL / SPKAC out from X509
• add PFX / CMS support
• implement lazy loading for ASN1
• SSH2/SFTP: throw exceptions instead of returning false
• bump minimum required PHP version to 8.1.0
• namespace changed from \phpseclib3 to \phpseclib4 to facilitate a yet to be written phpseclib 3 shim (phpseclib3_compat)

3.0.57

• ASN1: fix tag matching for tagged CHOICE children (#2158)
• RSA: fix for openssl_verify calls that error out (#2161)
• RSA/PublicKey: implement salt length discovery for PSS verification (#2164)
• BigInteger/PHP: don't return the divisor as the common residue (#2165)
• Curve25519/448: improve timing attack resistance (CVE-2026-84308)

Changelog

Sourced from phpseclib/phpseclib's changelog.

4.0.1 - 2026-08-26

• Curve25519/448: improve timing attack resistance (CVE-2026-84308)

4.0.0 - 2026-08-22

• split CSR / CRL / SPKAC out from X509
• add PFX / CMS support
• implement lazy loading for ASN1
• SSH2/SFTP: throw exceptions instead of returning false
• bump minimum required PHP version to 8.1.0
• namespace changed from \phpseclib3 to \phpseclib4 to facilitate a yet to be written phpseclib 3 shim (phpseclib3_compat)

3.0.57 - 2026-08-26

• ASN1: fix tag matching for tagged CHOICE children (#2158)
• RSA: fix for openssl_verify calls that error out (#2161)
• RSA/PublicKey: implement salt length discovery for PSS verification (#2164)
• BigInteger/PHP: don't return the divisor as the common residue (#2165)
• Curve25519/448: improve timing attack resistance (CVE-2026-84308)

Commits

• bb7b959 Merge branch '3.0' into 4.0
• d17e0dd CHANGELOG: add 3.0.57 release
• 99b8775 psalm fixes
• 6b887bb Merge branch '4.0' of github.com:phpseclib/phpseclib into 4.0
• a8bac78 Merge branch '3.0' into 4.0
• 3a43a75 EC: implement blinding for montgomery curve multiplication
• 6d4805f DH: add tests for all-zero shared secrets with Curve25519 / Curve448
• 86669f0 CHANGELOG: add 4.0.0 release
• fb56bc5 EC/Curve{25519,448} enhancements
• 95082b6 Merge branch '3.0' into 4.0
• Additional commits viewable in compare view

[github-actions]

Quality Report — ConductionNL/keepiq @ 7ec8bbc

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	❌
phpstan	❌
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
test-l10n		✅
format		✅
check-l10n-js		✅
check-schema-l10n		✅
composer			✅	✅ 111/111
npm			✅	✅ 536/536
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					❌
Newman					❌
Playwright					⏭️ deferred — runs on the promotion into beta/main, not on a pull request into development
Hydra gates					✅

---

Quality workflow — 2026-09-01 13:30 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/keepiq @ 60532df

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	❌
phpstan	❌
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
test-l10n		✅
format		✅
check-l10n-js		✅
check-schema-l10n		✅
composer			✅	✅ 111/111
npm			✅	✅ 536/536
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					❌
Newman					❌
Playwright					⏭️ deferred — runs on the promotion into beta/main, not on a pull request into development
Hydra gates					✅

---

Quality workflow — 2026-09-04 09:51 UTC

Download the full PDF report from the workflow artifacts.