rstackjs · chenjiahan · Mar 5, 2026 · Mar 5, 2026 · Mar 5, 2026 · Mar 5, 2026
diff --git a/docs/migrate-v1-to-v2.md b/docs/migrate-v1-to-v2.md
@@ -55,7 +55,7 @@ The minimum supported Node.js version is now `^20.19.0 || >=22.12.0`.
 
 ### Upgraded Express to v5
 
-`express`` has been updated to v5, see [Introducing Express v5: A New Era for the Node.js Framework](https://expressjs.com/2024/10/15/v5-release.html) for details.
+`express` has been updated to v5, see [Introducing Express v5: A New Era for the Node.js Framework](https://expressjs.com/2024/10/15/v5-release.html) for details.
 
 ### Removed `spdy` support
 
@@ -88,6 +88,23 @@ export default {
 };
 ```
 
+### Optional `selfsigned` peer dependency
+
+`selfsigned` is no longer bundled as a direct dependency of `@rspack/dev-server`.
+
+If you use `server.type: "https"` or `"http2"` without providing your own
+`server.options.key` and `server.options.cert`, the dev server needs
+`selfsigned` to generate a local certificate.
+
+Install it in your project when needed:
+
+```bash
+npm i -D selfsigned@^5.0.0
+# or pnpm add -D selfsigned@^5.0.0
+# or yarn add -D selfsigned@^5.0.0
+# or bun add -D selfsigned@^5.0.0
+```
+
 ### Removed SockJS support (`ws` only)
 
 In v2, the following SockJS options are no longer available:

diff --git a/package.json b/package.json
@@ -83,6 +83,7 @@
     "puppeteer": "^24.37.5",
     "react-refresh": "0.18.0",
     "require-from-string": "^2.0.2",
+    "selfsigned": "^5.5.0",
     "simple-git-hooks": "^2.13.1",
     "style-loader": "^4.0.0",
     "typescript": "^5.9.3",
@@ -104,12 +105,17 @@
     "launch-editor": "^2.13.1",
     "open": "^11.0.0",
     "p-retry": "^7.1.1",
-    "selfsigned": "^5.5.0",
     "serve-index": "^1.9.2",
     "webpack-dev-middleware": "^7.4.5",
     "ws": "^8.19.0"
   },
   "peerDependencies": {
-    "@rspack/core": "^2.0.0-0"
+    "@rspack/core": "^2.0.0-0",
+    "selfsigned": "^5.0.0"
+  },
+  "peerDependenciesMeta": {
+    "selfsigned": {
+      "optional": true
+    }
   }
 }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
diff --git a/src/server.ts b/src/server.ts
@@ -926,7 +926,23 @@ class Server<
         if (!certificateExists) {
           this.logger.info('Generating SSL certificate...');
 
-          const selfsigned = require('selfsigned');
+          let selfsigned: typeof import('selfsigned');
+
+          try {
+            selfsigned = require('selfsigned');
+          } catch (error) {
+            if (
+              error instanceof Error &&
+              (error as NodeJS.ErrnoException).code === 'MODULE_NOT_FOUND'
+            ) {
+              throw new Error(
+                'Cannot generate a self-signed certificate because optional peer dependency `selfsigned@^5.0.0` is not installed. Please install it and try again.',
+              );
+            }
+
+            throw error;
+          }
+
           const attributes = [{ name: 'commonName', value: 'localhost' }];
           const notBeforeDate = new Date();
           const notAfterDate = new Date(notBeforeDate);