SDK package too large for Lambda, contains frontend frameworks

[tmcpartlin]

Since the SDK includes React and React Native this SDK is very large.

The dependency on react-native-url-polyfill seems to be causing all the other dependencies. After removing this package, the SDK is much smaller.

Suggestion: have an optional package that can be just for the NodeJS server side that does not include these frontend frameworks and dependencies.

[andrewpuch]

I'm running into the same issue.

[yo1dog]

The problem is the react-native-url-polyfill which in turn includes the entire react-native library.

├─┬ pubnub@8.2.8
│ ├─┬ react-native-url-polyfill@2.0.0
│ │ ├── react-native@0.75.4

Upgrading to v8 adds 464 NPM packages, several of which are deprecated. It is quite ridiculous to pollute projects to such an extreme extent. I can't upgrade to v8 until this is fixed because it makes the project too large...

[yo1dog]

Here is my workaround. Prevent react-native-url-polyfill from being included (and thus react-native) by adding an NPM override to package.json:

  "overrides": {
    "pubnub": {
      "react-native-url-polyfill": "npm:pubnub@*"
    }
  }

I use pubnub@* because it is a package I know is already installed and thus will not add to the dependency tree, but you can specify any package.

[Kaspik]

2 years later, this has not been resolved. That dependency has even vulnerabilities reported.

react-native-url-polyfill@2.0.0
   └─ react-native@0.84.1 (peer)
      └─ babel-jest@29.7.0
         └─ babel-plugin-istanbul@6.1.1
            └─ @istanbuljs/load-nyc-config@1.1.0
               └─ js-yaml@3.14.2   (wants "^3.13.1")

@stephenlb - worth checking it finally?

[pubnub-release-bot]

@tmcpartlin this issue is addressed in v12.0.0

[valeporti]

This was closed as addressed in v12.0.0, but v12 does not remove react-native for pnpm users — I've opened #507 with the details.

Short version: making react-native-url-polyfill an optional peer doesn't stop pnpm from installing it, because pnpm has had auto-install-peers on by default since v8. On a plain Node service with pubnub@12.0.3 and pnpm 10.9, pnpm why image-size still shows the full chain:

pubnub 12.0.3
└─┬ react-native-url-polyfill 2.0.0 peer
  └─┬ react-native 0.84.0 peer
    └─┬ @react-native/community-cli-plugin 0.84.0
      └─┬ metro 0.83.7
        └── image-size 1.2.1

@Kaspik — the vulnerability angle you raised is now worse. image-size has two high-severity DoS advisories (GHSA-w3rx-r6r6-pgpr, GHSA-5p2g-fcmc-qvqq), both <=2.0.2, and 2.0.2 is the latest published version — so there is no patched release to move to. pnpm audit reports Patched versions: <0.0.0, which fails --audit-level=high on every CI run with no upgrade path.

@yo1dog — your overrides workaround has a pnpm equivalent, but it's fragile: aliasing the edge to a local empty package broke our multi-stage Docker build, since the stub has to exist at install time in every build context. ignoredOptionalDependencies and peerDependencyRules.ignoreMissing don't suppress it either on pnpm 10.9.

Worth reopening this or tracking it in #507.