build(deps): bump phpseclib/phpseclib from 3.0.55 to 4.0.1

[dependabot]

Bumps phpseclib/phpseclib from 3.0.55 to 4.0.1.

Release notes

Sourced from phpseclib/phpseclib's releases.

4.0.1

• Curve25519/448: improve timing attack resistance (CVE-2026-84308)

4.0.0

• split CSR / CRL / SPKAC out from X509
• add PFX / CMS support
• implement lazy loading for ASN1
• SSH2/SFTP: throw exceptions instead of returning false
• bump minimum required PHP version to 8.1.0
• namespace changed from \phpseclib3 to \phpseclib4 to facilitate a yet to be written phpseclib 3 shim (phpseclib3_compat)

3.0.57

• ASN1: fix tag matching for tagged CHOICE children (#2158)
• RSA: fix for openssl_verify calls that error out (#2161)
• RSA/PublicKey: implement salt length discovery for PSS verification (#2164)
• BigInteger/PHP: don't return the divisor as the common residue (#2165)
• Curve25519/448: improve timing attack resistance (CVE-2026-84308)

3.0.56

• RSA: don't use OpenSSL for PSS on OpenSSL < 3.1.0 (#2152)
• SFTP: throw TimeoutExceptions on timeout vs UnexpectedValueException (#2156)
• SFTP/Stream: use default context if one isn't explicitly provided (#2154)

Changelog

Sourced from phpseclib/phpseclib's changelog.

4.0.1 - 2026-08-26

• Curve25519/448: improve timing attack resistance (CVE-2026-84308)

4.0.0 - 2026-08-22

• split CSR / CRL / SPKAC out from X509
• add PFX / CMS support
• implement lazy loading for ASN1
• SSH2/SFTP: throw exceptions instead of returning false
• bump minimum required PHP version to 8.1.0
• namespace changed from \phpseclib3 to \phpseclib4 to facilitate a yet to be written phpseclib 3 shim (phpseclib3_compat)

3.0.57 - 2026-08-26

• ASN1: fix tag matching for tagged CHOICE children (#2158)
• RSA: fix for openssl_verify calls that error out (#2161)
• RSA/PublicKey: implement salt length discovery for PSS verification (#2164)
• BigInteger/PHP: don't return the divisor as the common residue (#2165)
• Curve25519/448: improve timing attack resistance (CVE-2026-84308)

3.0.56 - 2026-08-02

• RSA: don't use OpenSSL for PSS on OpenSSL < 3.1.0 (#2152)
• SFTP: throw TimeoutExceptions on timeout vs UnexpectedValueException (#2156)
• SFTP/Stream: use default context if one isn't explicitly provided (#2154)

Commits

• bb7b959 Merge branch '3.0' into 4.0
• d17e0dd CHANGELOG: add 3.0.57 release
• 99b8775 psalm fixes
• 6b887bb Merge branch '4.0' of github.com:phpseclib/phpseclib into 4.0
• a8bac78 Merge branch '3.0' into 4.0
• 3a43a75 EC: implement blinding for montgomery curve multiplication
• 6d4805f DH: add tests for all-zero shared secrets with Curve25519 / Curve448
• 86669f0 CHANGELOG: add 4.0.0 release
• fb56bc5 EC/Curve{25519,448} enhancements
• 95082b6 Merge branch '3.0' into 4.0
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)