build(deps): bump phpseclib/phpseclib from 3.0.56 to 4.0.0

[dependabot]

Bumps phpseclib/phpseclib from 3.0.56 to 4.0.0.

Release notes

Sourced from phpseclib/phpseclib's releases.

4.0.0

• split CSR / CRL / SPKAC out from X509
• add PFX / CMS support
• implement lazy loading for ASN1
• SSH2/SFTP: throw exceptions instead of returning false
• bump minimum required PHP version to 8.1.0
• namespace changed from \phpseclib3 to \phpseclib4 to facilitate a yet to be written phpseclib 3 shim (phpseclib3_compat)

Changelog

Sourced from phpseclib/phpseclib's changelog.

4.0.0 - 2026-08-22

• split CSR / CRL / SPKAC out from X509
• add PFX / CMS support
• implement lazy loading for ASN1
• SSH2/SFTP: throw exceptions instead of returning false
• bump minimum required PHP version to 8.1.0
• namespace changed from \phpseclib3 to \phpseclib4 to facilitate a yet to be written phpseclib 3 shim (phpseclib3_compat)

Commits

• 86669f0 CHANGELOG: add 4.0.0 release
• 95082b6 Merge branch '3.0' into 4.0
• 54fd28d BigInteger/Engines/PHP: adjust visibility of subtratHelper()
• c992e13 Merge branch '3.0' into 4.0
• ebe334e CHANGELOG: issue ID's were swapped
• 505be62 Merge branch '3.0' into 4.0
• 70e0ef9 CS adjustment
• 1d578ee PFX: loading a newly generated "passwordless" PFX gave an error
• 3dad37a Merge branch '3.0' into 4.0
• d187ac0 Merge pull request #2168 from dngr2/backport-4.0/php-engine-negative-exact-di...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Quality Report — ConductionNL/keepiq @ 8a088d8

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	❌
phpstan	❌
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
test-l10n		✅
format		✅
check-l10n-js		✅
check-schema-l10n		✅
composer			✅	✅ 111/111
npm			✅	✅ 550/550
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					❌
Newman					❌
Playwright					❌
Hydra gates					✅

---

Quality workflow — 2026-08-25 13:30 UTC

Download the full PDF report from the workflow artifacts.

[rubenvdlinde]

Not merging: phpseclib 4.0 moves to a phpseclib4\\ root namespace, so this bump deletes every class the certificate-issuance code imports — that is why all 11 checks fail, not just psalm/phpstan. 4.0.0 is two days old and 3.0.x stays maintained. Tracked as #444 with the migration steps.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.