From bfd4f7a4770fc90b9951fe3f3682cfd3591b5c07 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 13 Sep 2026 05:42:57 +0000 Subject: [PATCH 1/2] build(deps): bump phpseclib/phpseclib from 3.0.56 to 4.0.1 Bumps [phpseclib/phpseclib](https://github.com/phpseclib/phpseclib) from 3.0.56 to 4.0.1. - [Release notes](https://github.com/phpseclib/phpseclib/releases) - [Changelog](https://github.com/phpseclib/phpseclib/blob/master/CHANGELOG.md) - [Commits](https://github.com/phpseclib/phpseclib/compare/3.0.56...4.0.1) --- updated-dependencies: - dependency-name: phpseclib/phpseclib dependency-version: 4.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- composer.json | 2 +- composer.lock | 38 ++++++++++++++++++++++++-------------- 2 files changed, 25 insertions(+), 15 deletions(-) diff --git a/composer.json b/composer.json index 7687002b4..57c04e477 100644 --- a/composer.json +++ b/composer.json @@ -40,7 +40,7 @@ "php": "~8.4 || ~8.5", "defuse/php-encryption": "^2.1", "phpmailer/phpmailer": "^7.0", - "phpseclib/phpseclib": "^3.0", + "phpseclib/phpseclib": "^4.0", "php-di/php-di": "^7.1", "guzzlehttp/guzzle": "^8.0", "monolog/monolog": "^3.0", diff --git a/composer.lock b/composer.lock index 5557251dd..9124c2f85 100644 --- a/composer.lock +++ b/composer.lock @@ -4,7 +4,7 @@ "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies", "This file is @generated automatically" ], - "content-hash": "2ac53d9e682af0371201a2e861f34e63", + "content-hash": "2ad51454065ff57ce8ecda51bca87479", "packages": [ { "name": "aura/sqlquery", @@ -1242,31 +1242,35 @@ }, { "name": "phpseclib/phpseclib", - "version": "3.0.56", + "version": "4.0.1", "source": { "type": "git", "url": "https://github.com/phpseclib/phpseclib.git", - "reference": "7adbbe38cde25e2df2116dbf2673c407e24fa305" + "reference": "bb7b959c8159957edae6f5084ebbac765d310e16" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/phpseclib/phpseclib/zipball/7adbbe38cde25e2df2116dbf2673c407e24fa305", - "reference": "7adbbe38cde25e2df2116dbf2673c407e24fa305", + "url": "https://api.github.com/repos/phpseclib/phpseclib/zipball/bb7b959c8159957edae6f5084ebbac765d310e16", + "reference": "bb7b959c8159957edae6f5084ebbac765d310e16", "shasum": "" }, "require": { - "paragonie/constant_time_encoding": "^1|^2|^3", - "paragonie/random_compat": "^1.4|^2.0|^9.99.99", - "php": ">=5.6.1" + "paragonie/constant_time_encoding": "^2|^3", + "php": ">=8.1", + "symfony/polyfill-php82": "^1.26" }, "require-dev": { - "phpunit/phpunit": "*" + "brianium/paratest": "^7.22", + "ext-xml": "*", + "php-parallel-lint/php-parallel-lint": "^1.3", + "phpunit/phpunit": "^13", + "squizlabs/php_codesniffer": "^3.7", + "vimeo/psalm": "*" }, "suggest": { "ext-dom": "Install the DOM extension to load XML formatted public keys.", "ext-gmp": "Install the GMP (GNU Multiple Precision) extension in order to speed up arbitrary precision integer arithmetic operations.", "ext-libsodium": "SSH2/SFTP can make use of some algorithms provided by the libsodium-php extension.", - "ext-mcrypt": "Install the Mcrypt extension in order to speed up a few other cryptographic operations.", "ext-openssl": "Install the OpenSSL extension in order to speed up a wide variety of cryptographic operations." }, "type": "library", @@ -1275,7 +1279,7 @@ "phpseclib/bootstrap.php" ], "psr-4": { - "phpseclib3\\": "phpseclib/" + "phpseclib4\\": "phpseclib/" } }, "notification-url": "https://packagist.org/downloads/", @@ -1307,10 +1311,16 @@ "name": "Graham Campbell", "email": "graham@alt-three.com", "role": "Developer" + }, + { + "name": "Jack Worman", + "email": "jack.worman@gmail.com", + "homepage": "https://jackworman.com", + "role": "Developer" } ], "description": "PHP Secure Communications Library - Pure-PHP implementations of RSA, AES, SSH2, SFTP, X.509 etc.", - "homepage": "http://phpseclib.sourceforge.net", + "homepage": "https://phpseclib.com/", "keywords": [ "BigInteger", "aes", @@ -1332,7 +1342,7 @@ ], "support": { "issues": "https://github.com/phpseclib/phpseclib/issues", - "source": "https://github.com/phpseclib/phpseclib/tree/3.0.56" + "source": "https://github.com/phpseclib/phpseclib/tree/4.0.1" }, "funding": [ { @@ -1348,7 +1358,7 @@ "type": "tidelift" } ], - "time": "2026-08-03T04:36:50+00:00" + "time": "2026-08-26T12:15:13+00:00" }, { "name": "psr/container", From 6e68b42f949d03b8f1078f5708f0a9ec3b7725fb Mon Sep 17 00:00:00 2001 From: blaipr Date: Thu, 17 Sep 2026 02:46:07 +0200 Subject: [PATCH 2/2] fix: follow phpseclib 4's namespace in CryptPKI MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit phpseclib 4 moved its namespace from phpseclib3\ to phpseclib4\, so the import no longer resolved and PHPStan reported RSA, its PrivateKey and ENCRYPTION_PKCS1 all unknown — six of eight checks failed on the bump alone. The API is unchanged: createKey(), loadPrivateKey(), withPadding() and ENCRYPTION_PKCS1 are all still there, verified against the installed package. Everything in CryptPKI resolves through the one import, so the change is that line in the two files that name the library, plus a comment that said 'phpseclib3' about behaviour that was never version-specific. CryptPKI decrypts the password the browser encrypts with JSEncrypt, so a silent change in padding or key handling would not fail a unit test — it would fail sign-in. Checked directly against the new library: a PKCS#1 v1.5 round trip through createKey -> loadPublicKey/encrypt -> loadPrivateKey/decrypt returns the plaintext. --- src/Infrastructure/Crypt/CryptPKI.php | 4 ++-- tests/Unit/Infrastructure/Crypt/CryptPKITest.php | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/Infrastructure/Crypt/CryptPKI.php b/src/Infrastructure/Crypt/CryptPKI.php index c85fd277d..a2e048df4 100644 --- a/src/Infrastructure/Crypt/CryptPKI.php +++ b/src/Infrastructure/Crypt/CryptPKI.php @@ -26,7 +26,7 @@ namespace SP\Infrastructure\Crypt; -use phpseclib3\Crypt\RSA; +use phpseclib4\Crypt\RSA; use SP\Domain\Core\Crypt\CryptPKIHandler; use SP\Domain\Core\Exceptions\SPException; use SP\Domain\File\Ports\FileHandlerInterface; @@ -109,7 +109,7 @@ public function decryptRSA(string $data): ?string $privateKeyPem = $this->getPrivateKey(); // A valid RSA ciphertext is always exactly KEY_SIZE/8 bytes; anything else is - // invalid input — phpseclib3 returns binary garbage instead of throwing in that case. + // invalid input — phpseclib returns binary garbage instead of throwing in that case. if (strlen($data) !== self::KEY_SIZE / 8) { return null; } diff --git a/tests/Unit/Infrastructure/Crypt/CryptPKITest.php b/tests/Unit/Infrastructure/Crypt/CryptPKITest.php index 6701c8217..fbccc8b81 100644 --- a/tests/Unit/Infrastructure/Crypt/CryptPKITest.php +++ b/tests/Unit/Infrastructure/Crypt/CryptPKITest.php @@ -26,7 +26,7 @@ namespace SP\Tests\Unit\Infrastructure\Crypt; -use phpseclib3\Crypt\RSA; +use phpseclib4\Crypt\RSA; use PHPUnit\Framework\Attributes\AllowMockObjectsWithoutExpectations; use PHPUnit\Framework\Attributes\Group; use PHPUnit\Framework\MockObject\Exception;