The new dependency PHPSecLib has a published CVE

Source: https://github.com/advisories/GHSA-hm7p-r324-hhf3

Ugh, and 3.0.19 introduced too a breaking change which is not BC compatible, that's annoying.

Will check what needs to be changed.

That's unfortunate. Is it possible to undo the change in commit https://git.drupalcode.org/project/activitypub/-/commit/010ca9deeb982af5... until this is being resolved? Otherwise, sites that have to use the dev release can't upgrade, not even for security updates.

So I was looking at a completely wrong error message the whole time, this should fix it and allow using the latest package of phpseclib.

Looks good, the bot used 3.0.19 - so will commit now.

- Locking phpseclib/phpseclib (3.0.19)

Committed and pushed!

Confirmed, this is looking good now. Thanks for fixing this @swentel

Automatically closed - issue fixed for 2 weeks with no activity.

jurgenhaas → closed merge request !21