Update dependency phpseclib/phpseclib to v4

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
phpseclib/phpseclib (source)	^3.0 → ^4.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

phpseclib/phpseclib (phpseclib/phpseclib)

v4.0.1

Compare Source

• Curve25519/448: improve timing attack resistance

v4.0.0

Compare Source

• split CSR / CRL / SPKAC out from X509
• add PFX / CMS support
• implement lazy loading for ASN1
• SSH2/SFTP: throw exceptions instead of returning false
• bump minimum required PHP version to 8.1.0
• namespace changed from \phpseclib3 to \phpseclib4 to facilitate a yet to be written phpseclib 3 shim (phpseclib3_compat)

v3.0.57

Compare Source

• ASN1: fix tag matching for tagged CHOICE children (#​2158)
• RSA: fix for openssl_verify calls that error out (#​2161)
• RSA/PublicKey: implement salt length discovery for PSS verification (#​2164)
• BigInteger/PHP: don't return the divisor as the common residue (#​2165)
• Curve25519/448: improve timing attack resistance (CVE-2026-84308)

v3.0.56

Compare Source

• RSA: don't use OpenSSL for PSS on OpenSSL < 3.1.0 (#​2156)
• SFTP: throw TimeoutExceptions on timeout vs UnexpectedValueException (#​2152)
• SFTP/Stream: use default context if one isn't explicitly provided (#​2154)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[deepsource-io]

DeepSource Code Review

We reviewed changes in 1274960...776fc30 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
PHP		Aug 30, 2026 12:35p.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.