diff --git a/README.md b/README.md
index 2b72313..3206e9c 100644
--- a/README.md
+++ b/README.md
@@ -257,9 +257,10 @@ but it does matter.
 
 # ChangeLog:
 
-* v1.9.0
+* v1.9
   * consistently handle key generation across node crypto, ursa, and forge
   * move all other operations to rasha.js and rsa-csr.js
+  * move dependencies to optional
 * v1.4.0
   * remove ursa as dependency (just causes confusion), but note in docs
   * drop node < v6 support
diff --git a/package.json b/package.json
index cc6d787..20ccce2 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "rsa-compat",
-  "version": "1.9.1",
+  "version": "1.9.2",
   "description": "RSA utils that work on Windows, Mac, and Linux with or without C compiler",
   "main": "index.js",
   "bin": {
@@ -33,10 +33,8 @@
     "url": "https://git.coolaj86.com/coolaj86/rsa-compat.js/issues"
   },
   "homepage": "https://git.coolaj86.com/coolaj86/rsa-compat.js#readme",
-  "dependencies": {
-    "node-forge": "^0.7.6"
-  },
   "optionalDependencies": {
+    "node-forge": "^0.7.6",
     "ursa-optional": "^0.9.10"
   },
   "trulyOptionalDependencies": {