webrtc: react-native-webrtc as a regular dependency pulls react-native and metro into every Node.js install

[SgtPooki]

Description

@libp2p/webrtc declares react-native-webrtc in dependencies (range ^124.0.6 as of 6.0.24; our lockfile resolves 124.0.7). react-native-webrtc declares react-native >=0.60.0 as a peer dependency, and npm and pnpm auto-install non-optional peers, so Node.js consumers install react-native and its metro toolchain. That includes projects that reach @libp2p/webrtc transitively through helia or @helia/verified-fetch and never import react-native-webrtc.

The runtime is already platform-split: Node resolves dist/src/webrtc/index.js, which uses node-datachannel/polyfill, and only dist/src/webrtc/index.react-native.js imports react-native-webrtc, selected through the existing react-native field in package.json. The install graph is what does not match the runtime graph.

Impact

The subtree is large (react-native 0.85.3 plus metro 0.84.4 and their dependents), and metro pins image-size 1.x, which carries two advisories with no patched release (GHSA-5p2g-fcmc-qvqq, GHSA-w3rx-r6r6-pgpr). For Node consumers this is permanent audit noise from an unused install subtree, not a runtime vulnerability, on top of the install weight.

Reproduce from any Node project that depends on helia or @helia/verified-fetch (observed with pnpm 10; npm's peer auto-install behaves the same):

pnpm why react-native
pnpm why image-size

Proposed next step

Move react-native-webrtc from dependencies to an optional peer:

"peerDependencies": {
  "react-native-webrtc": "^124.0.6"
},
"peerDependenciesMeta": {
  "react-native-webrtc": {
    "optional": true
  }
}

React Native consumers install it explicitly alongside @libp2p/webrtc; Node consumers skip the subtree. optionalDependencies would not help here, since package managers still install those by default. Because the react-native field already isolates the import, no code change looks necessary beyond possibly a clearer error when the React Native entry runs without the peer installed.