libp2p / libp2p/js-libp2p

webrtc: react-native-webrtc as a regular dependency pulls react-native and metro into every Node.js install

Open Beginner friendly
#3,609 0 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
TypeScript
Stars
2.6k
Forks
546
Avg merge
8h 18m
Merged PRs (30d)
16

Description

### Description

`@libp2p/webrtc` declares `react-native-webrtc` in `dependencies` (range `^124.0.6` as of 6.0.24; our lockfile resolves 124.0.7). `react-native-webrtc` declares `react-native >=0.60.0` as a peer dependency, and npm and pnpm auto-install non-optional peers, so Node.js consumers install `react-native` and its `metro` toolchain. That includes projects that reach `@libp2p/webrtc` transitively through `helia` or `@helia/verified-fetch` and never import `react-native-webrtc`.

The runtime is already platform-split: Node resolves `dist/src/webrtc/index.js`, which uses `node-datachannel/polyfill`, and only `dist/src/webrtc/index.react-native.js` imports `react-native-webrtc`, selected through the existing `react-native` field in `package.json`. The install graph is what does not match the runtime graph.

### Impact

The subtree is large (react-native 0.85.3 plus metro 0.84.4 and their dependents), and metro pins `image-size` 1.x, which carries two advisories with no patched release (GHSA-5p2g-fcmc-qvqq, GHSA-w3rx-r6r6-pgpr). For Node consumers this is permanent audit noise from an unused install subtree, not a runtime vulnerability, on top of the install weight.

Reproduce from any Node project that depends on `helia` or `@helia/verified-fetch` (observed with pnpm 10; npm's peer auto-install behaves the same):

```bash
pnpm why react-native
pnpm why image-size
```

### Proposed next step

Move `react-native-webrtc` from `dependencies` to an optional peer:

```json
"peerDependencies": {
"react-native-webrtc": "^124.0.6"
},
"peerDependenciesMeta": {
"react-native-webrtc": {
"optional": true
}
}
```

React Native consumers install it explicitly alongside `@libp2p/webrtc`; Node consumers skip the subtree. `optionalDependencies` would not help here, since package managers still install those by default. Because the `react-native` field already isolates the import, no code change looks necessary beyond possibly a clearer error when the React Native entry runs without the peer installed.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with @libp2p/webrtc's package.json, then inspect its existing node and react-native entry points. Verify the dependency graph with pnpm why react-native and pnpm why image-size; done means Node consumers no longer install the React Native subtree while the React Native entry still resolves its peer explicitly.

Written by the indexing model from the issue text.

Assessment

Tech stack
node.js, react-native, typescript
Domain
developer-experience, networking
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
84/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.