webrtc: react-native-webrtc as a regular dependency pulls react-native and metro into every Node.js install
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 2.6k
- Forks
- 546
- Avg merge
- 8h 18m
- Merged PRs (30d)
- 16
Description
### Description
`@libp2p/webrtc` declares `react-native-webrtc` in `dependencies` (range `^124.0.6` as of 6.0.24; our lockfile resolves 124.0.7). `react-native-webrtc` declares `react-native >=0.60.0` as a peer dependency, and npm and pnpm auto-install non-optional peers, so Node.js consumers install `react-native` and its `metro` toolchain. That includes projects that reach `@libp2p/webrtc` transitively through `helia` or `@helia/verified-fetch` and never import `react-native-webrtc`.
The runtime is already platform-split: Node resolves `dist/src/webrtc/index.js`, which uses `node-datachannel/polyfill`, and only `dist/src/webrtc/index.react-native.js` imports `react-native-webrtc`, selected through the existing `react-native` field in `package.json`. The install graph is what does not match the runtime graph.
### Impact
The subtree is large (react-native 0.85.3 plus metro 0.84.4 and their dependents), and metro pins `image-size` 1.x, which carries two advisories with no patched release (GHSA-5p2g-fcmc-qvqq, GHSA-w3rx-r6r6-pgpr). For Node consumers this is permanent audit noise from an unused install subtree, not a runtime vulnerability, on top of the install weight.
Reproduce from any Node project that depends on `helia` or `@helia/verified-fetch` (observed with pnpm 10; npm's peer auto-install behaves the same):
```bash
pnpm why react-native
pnpm why image-size
```
### Proposed next step
Move `react-native-webrtc` from `dependencies` to an optional peer:
```json
"peerDependencies": {
"react-native-webrtc": "^124.0.6"
},
"peerDependenciesMeta": {
"react-native-webrtc": {
"optional": true
}
}
```
React Native consumers install it explicitly alongside `@libp2p/webrtc`; Node consumers skip the subtree. `optionalDependencies` would not help here, since package managers still install those by default. Because the `react-native` field already isolates the import, no code change looks necessary beyond possibly a clearer error when the React Native entry runs without the peer installed.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with @libp2p/webrtc's package.json, then inspect its existing node and react-native entry points. Verify the dependency graph with pnpm why react-native and pnpm why image-size; done means Node consumers no longer install the React Native subtree while the React Native entry still resolves its peer explicitly.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- node.js, react-native, typescript
- Domain
- developer-experience, networking
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 84/100