HarperFast / HarperFast/harper
alasql's optional react-native-fs dep pulls ~140M of react-native/hermes/metro into installs and published Docker images
- Dominant language
- JavaScript
- Stars
- 89
- Forks
- 10
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 200
Description
## Summary
`alasql` (4.17.x) declares `optionalDependencies: { "react-native-fs": "^2.20.0" }`. `react-native-fs` itself is 828K and unused in Node (alasql only requires it behind a guard for RN environments), but it has a **peer dependency on `react-native`** — and npm 7+ auto-installs peer deps. So every plain `npm install harper` pulls in `react-native@0.82`, `react@19`, hermes, metro, and react-devtools.
## Confirmed in published Docker images
`harperfast/harper:latest` (5.1.23) ships:
| package | size |
|---|---|
| `hermes-compiler` | 47M |
| `react-native` | 37M |
| `@react-native/*` | 25M |
| `react-devtools-core` | 17M |
| `metro*` | ~9M |
| `react-native-fs`, `react`, `hermes-parser`, misc | ~4M |
**~140M of the 373M node_modules (~38%) is the react-native tree.** The Dockerfile installs the packed tarball with plain `npm install --ignore-scripts --global`, which includes optional deps and auto-installed peers.
Not Docker-specific: every npm install of harper 5.x gets the same ~140M. (The legacy `harperdb/harperdb` 4.x images are unaffected only because they ship alasql 4.6.6, which predates the optional dep.)
Beyond size, this puts metro/hermes/react-devtools in a production database image — pure CVE-scanner noise and supply-chain surface for code that can never execute.
## Fix
**Do not** use `--omit=optional` in the Dockerfile — harper's own tree relies on optionalDependencies for the `@harperfast/rocksdb-js-*` platform prebuilds, cbor/msgpackr extractors, `bufferutil`, `utf-8-validate`, etc.
Recommended: add an npm override in `package.json`, next to the existing `alasql → xlsx` override, stubbing `react-native-fs` out with a tiny empty package (e.g. `noop2` or an internal empty stub):
```json
"overrides": {
"alasql": {
"xlsx": "0.18.5",
"react-native-fs": "npm:noop2@^2.0.0"
}
}
```
This kills the chain at the root for Docker, npm, and dev installs alike.
Longer term: upstream a `peerDependenciesMeta: { "react-native": { "optional": true } }` fix to react-native-fs, and/or ask alasql to drop the optional dep.
Contributor guide
Assessment
This issue has not been assessed yet.