Dependabot opened #443 to bump phpseclib/phpseclib 3.0.56 → 4.0.0. It is not a routine bump.
Why it fails
phpseclib 4.0 ships under a new root namespace:
| version |
autoload psr-4 |
| 3.0.56 |
phpseclib3\\ |
| 4.0.0 |
phpseclib4\\ |
Every import in this app targets phpseclib3\\:
lib/Service/X509CertificateAssembler.php — Crypt\RSA, Crypt\RSA\PrivateKey, Crypt\RSA\PublicKey, File\X509lib/Support/PublicKeyLoaderAdapter.php — Crypt\Common\AsymmetricKey, Crypt\Common\PrivateKey, Crypt\PublicKeyLoader
So the bump removes every class the app resolves. That is why all 11 checks go red on #443 — PHPUnit, E2E, Newman and both static analysers — rather than only psalm/phpstan. It is a class-not-found failure, not API drift.
Why this is not merged now
- 4.0.0 was released 2026-08-23, two days before this triage.
- The affected code signs X.509 certificates. A namespace sweep here is a security-sensitive change that needs its own test pass, not a dependency auto-merge.
- 3.0.x remains maintained, and the parallel namespace is deliberate — 3 and 4 are designed to coexist, so there is no forced-upgrade pressure.
What a real migration needs
- Bump the constraint in
composer.json (^3.0 → ^4.0).
- Rewrite the 7 imports above to
phpseclib4\\.
- Diff phpseclib's 3→4 UPGRADING notes for behavioural changes in
File\X509 signing and PublicKeyLoader, especially the rsaEncryption OID / PSS default handling that X509CertificateAssembler already works around (see the comment at X509CertificateAssembler.php:99).
- Re-run
CertificateIssuanceServiceTest, X509CertificateAssemblerTest and CertificateAuthorityServiceTest — these already assert signature and DN-preservation behaviour.
Closing #443; this issue carries the work.
Dependabot opened #443 to bump
phpseclib/phpseclib3.0.56 → 4.0.0. It is not a routine bump.Why it fails
phpseclib 4.0 ships under a new root namespace:
phpseclib3\\phpseclib4\\Every import in this app targets
phpseclib3\\:lib/Service/X509CertificateAssembler.php—Crypt\RSA,Crypt\RSA\PrivateKey,Crypt\RSA\PublicKey,File\X509lib/Support/PublicKeyLoaderAdapter.php—Crypt\Common\AsymmetricKey,Crypt\Common\PrivateKey,Crypt\PublicKeyLoaderSo the bump removes every class the app resolves. That is why all 11 checks go red on #443 — PHPUnit, E2E, Newman and both static analysers — rather than only psalm/phpstan. It is a class-not-found failure, not API drift.
Why this is not merged now
What a real migration needs
composer.json(^3.0→^4.0).phpseclib4\\.File\X509signing andPublicKeyLoader, especially the rsaEncryption OID / PSS default handling thatX509CertificateAssembleralready works around (see the comment atX509CertificateAssembler.php:99).CertificateIssuanceServiceTest,X509CertificateAssemblerTestandCertificateAuthorityServiceTest— these already assert signature and DN-preservation behaviour.Closing #443; this issue carries the work.