BSON: For React Native please polyfill crypto.getRandomValues

[cristianoccazinsp]

Goals

Regular use.

Expected Results

Regular use.

Actual Results

A warning started appearing after upgrading to Realm 10.4.0.

JSWarning
BSON: For React Native please polyfill crypto.getRandomValues, e.g. using: https://www.npmjs.com/package/react-native-get-random-values.

    src/conf.js:594:34 
    node_modules/bson/dist/bson.browser.umd.js:2617:18 insecureRandomBytes
    node_modules/bson/dist/bson.browser.umd.js:5182:40 
    node_modules/bson/dist/bson.browser.umd.js:14:9 createCommonjsModule
    node_modules/bson/dist/bson.browser.umd.js:5175:37 
    node_modules/bson/dist/bson.browser.umd.js:2:72 
    node_modules/bson/dist/bson.browser.umd.js:5:2 
    node_modules/metro/src/lib/polyfills/require.js:322:6 loadModuleImplementation
    node_modules/realm/lib/extensions.js:54:35 
    node_modules/realm/lib/index.js:64:24 
    node_modules/metro/src/lib/polyfills/require.js:322:6 loadModuleImplementation
    src/db/index.js:8 

Steps to Reproduce

Just use Realm (offline)

Code Sample

Version of Realm and Tooling

• Realm JS SDK Version: 10.4.0
• Node or React Native: React Native
• Client OS & Version: All
• Which debugger for React Native: None

[cristianoccazinsp]

Looks like this started to happen after BSON upgraded from "4.2.3" to "4.3.0" (dependency of Realm) which is odd since Realm locks the version to "^4.2.0"

[steffenagger]

@cristianoccazinsp very sorry for the confusion - it's an oversight on my part in the latest changes to the BSON package.
This warning was only suppose to trigger, if/when generating a new ObjectId (or other random ids, which was the main focus of the update), without a propper polyfill.

A PR has been dispatched and will hopefully be out soon: mongodb/js-bson#435

[cristianoccazinsp]

@steffenagger thank you! Looking forward to the update.

Do you happen to know if we should still install the recommended dependency when using Realm? It would be great for warnings to only happen in DEV also.

[steffenagger]

@cristianoccazinsp If you're generating ObjectId (or the upcoming UUID, part of #3605) on the device, then yes this would be the recommended (this will also be mentioned in the docs soon).

The reason being that a part of ObjectId, and most of UUID is random, and React Native does not (yet) expose any cryptographically strong random value generation. (as Node and newer browsers currently do).

[steffenagger]

@cristianoccazinsp in regards to your comment here: mongodb/js-bson#435 (comment) the warning should disappear if you install https://www.npmjs.com/package/react-native-get-random-values (and follow the instructions - it has to be loaded).

This is not a solution, by any means, but could perhaps be better than having false error reporting, for the time being?
Just a suggestion.

[cristianoccazinsp]

@steffenagger thanks for the suggestion! I would rather wait than adding a dependency that will be pretty much unused.

Would it break Realm if I downgrade bson to 4.2.x directly in the lock file?

[steffenagger]

@cristianoccazinsp for 10.4.0... No actually I don't believe it would.

[mednche]

@steffenagger, I'm using RealmJS 10.10.1 and I still get this warning message when I use new ObjectID() from bson. I've tried to install the suggested react-native-get-random-values and load it in my index.js but the warning was still occurring so I've now uninstalled it. What's the current situation on this issue?

[kneth]

@mednche

Which version of the bson package do you use?

Can you provide a small code snippet which can reproduce the issue?