chore: upgrade selfsigned to v5 and remove node-forge dependency

[VeerRaj-007]

webpack-dev-server currently relies on [email protected], which pulls in node-forge@^1 transitively. This results in [email protected] being installed, which is flagged by security scanners as vulnerable, forcing downstream users to apply manual overrides.

While upgrading selfsigned within the 4.x range does not resolve this (it still depends on node-forge), [email protected] removes the node-forge dependency entirely and instead uses @peculiar/x509 / pkijs.

What this PR does

• Upgrades selfsigned to v5.x

• Migrates the HTTPS certificate generation logic to the new async generate() API

• Updates options to match the new SelfsignedOptions type

• Adjusts handling of returned PEM values (private / cert)

• Removes the transitive dependency on node-forge

This fully eliminates the vulnerable dependency without requiring downstream overrides.

Why this change is safe

• The generated certificate is still:

• SHA-256

• 2048-bit key

• Valid for 30 days

• Scoped to local development (localhost, loopback IPs, etc.)

• Existing behavior (auto-generation, caching, expiration cleanup) is preserved

• All tests pass locally (npm test)

Notes on compatibility

• selfsigned@5 introduces a breaking API change:

• generate() is async

• Some option names differ from previous versions

• This PR adapts webpack-dev-server’s internal usage accordingly

• No public API surface of webpack-dev-server is affected

Related

• Fixes / addresses: Dependency selfsigned old, creates transitive dependency on vulnerable node-forge #5617

• selfsigned@5 release notes: https://www.npmjs.com/package/selfsigned

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: VeerRaj-007 / name: VEER RAJ (c9c65c2)