HarperFast / HarperFast/harper

alasql's optional react-native-fs dep pulls ~140M of react-native/hermes/metro into installs and published Docker images

Open
#1,937 2 comments 0 reactions 1 assignee Claimed by @heskew View on GitHub
Dominant language
JavaScript
Stars
89
Forks
10
Avg merge
2d 6h
Merged PRs (30d)
200

Description

## Summary

`alasql` (4.17.x) declares `optionalDependencies: { "react-native-fs": "^2.20.0" }`. `react-native-fs` itself is 828K and unused in Node (alasql only requires it behind a guard for RN environments), but it has a **peer dependency on `react-native`** — and npm 7+ auto-installs peer deps. So every plain `npm install harper` pulls in `react-native@0.82`, `react@19`, hermes, metro, and react-devtools.

## Confirmed in published Docker images

`harperfast/harper:latest` (5.1.23) ships:

| package | size |
|---|---|
| `hermes-compiler` | 47M |
| `react-native` | 37M |
| `@react-native/*` | 25M |
| `react-devtools-core` | 17M |
| `metro*` | ~9M |
| `react-native-fs`, `react`, `hermes-parser`, misc | ~4M |

**~140M of the 373M node_modules (~38%) is the react-native tree.** The Dockerfile installs the packed tarball with plain `npm install --ignore-scripts --global`, which includes optional deps and auto-installed peers.

Not Docker-specific: every npm install of harper 5.x gets the same ~140M. (The legacy `harperdb/harperdb` 4.x images are unaffected only because they ship alasql 4.6.6, which predates the optional dep.)

Beyond size, this puts metro/hermes/react-devtools in a production database image — pure CVE-scanner noise and supply-chain surface for code that can never execute.

## Fix

**Do not** use `--omit=optional` in the Dockerfile — harper's own tree relies on optionalDependencies for the `@harperfast/rocksdb-js-*` platform prebuilds, cbor/msgpackr extractors, `bufferutil`, `utf-8-validate`, etc.

Recommended: add an npm override in `package.json`, next to the existing `alasql → xlsx` override, stubbing `react-native-fs` out with a tiny empty package (e.g. `noop2` or an internal empty stub):

```json
"overrides": {
"alasql": {
"xlsx": "0.18.5",
"react-native-fs": "npm:noop2@^2.0.0"
}
}
```

This kills the chain at the root for Docker, npm, and dev installs alike.

Longer term: upstream a `peerDependenciesMeta: { "react-native": { "optional": true } }` fix to react-native-fs, and/or ask alasql to drop the optional dep.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.