Bump selfsigned from 4.0.0 to 5.2.0

[dependabot]

Bumps selfsigned from 4.0.0 to 5.2.0.

Changelog

Sourced from selfsigned's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[5.0.0] - 2025-11-26

🚀 Major Rewrite

Complete rewrite replacing node-forge with modern @peculiar/x509 and pkijs libraries.

✨ Added

• Native WebCrypto API support for better performance and security
• TypeScript examples in documentation
• Async/await support as the primary API
• Support for keyPair option to use existing keys
• Updated to use Node.js native crypto for all operations
• Separate selfsigned/pkcs7 module for tree-shakeable PKCS#7 support

💥 BREAKING CHANGES

1. Async-only API: The generate() function now returns a Promise. Synchronous generation has been removed.

   // Old (v4.x)
   const pems = selfsigned.generate(attrs, options);
   // New (v5.x)
   const pems = await selfsigned.generate(attrs, options);

2. No callback support: Callbacks have been completely removed in favor of Promises.

   // Old (v4.x)
   selfsigned.generate(attrs, options, function(err, pems) { ... });
   // New (v5.x)
   const pems = await selfsigned.generate(attrs, options);

3. Minimum Node.js version: Now requires Node.js >= 15.6.0 (was >= 10)

   • Required for native WebCrypto support

4. Dependencies changed:

   • ❌ Removed: node-forge (1.64 MB)
   • ✅ Added: @peculiar/x509 (551 KB) - 66% smaller!
   • ✅ Added: pkijs (1.94 MB, only for PKCS#7 support)
   • Bundle size reduced by 66% when not using PKCS#7

... (truncated)

Commits

• 80fc66c 5.2.0
• 41c3bed improve options for client certificate. closes #46
• 555bb16 5.1.0
• 8a1d51f add support for encrypting private key with passphrase. closes #23
• 5833206 5.0.0
• 34ff03c Merge branch 'remove_node_forge'
• bc942fa minor
• bb9a1b4 remove days in favor of notAfterDate
• e483662 allow to use private CA key pair to generate self signed. Closes #43
• dac8f6b add example
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)