From bae9991dcde8059541a499dfb9f85b308cc76082 Mon Sep 17 00:00:00 2001
From: Andrea Bueide <abueide@twilio.com>
Date: Tue, 25 Aug 2026 11:30:38 -0500
Subject: [PATCH] fix(deps): make react-native-get-random-values optional

crypto.getRandomValues can already be polyfilled by other packages
(e.g. react-native-quick-crypto), so requiring
react-native-get-random-values unconditionally forces an unnecessary
install on apps that already have a polyfill in place.

Marks it optional in both core and sovran's peerDependenciesMeta, and
loads it defensively at module scope the same way this codebase
already handles the optional async-storage peer dependency
(packages/sovran/src/persistor/async-storage-persistor.ts). getUUID()
now surfaces a clear error only if crypto.getRandomValues genuinely
isn't available.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 packages/core/package.json   |  3 +++
 packages/core/src/uuid.ts    | 24 +++++++++++++++++++++---
 packages/sovran/package.json |  3 +++
 yarn.lock                    |  4 ++++
 4 files changed, 31 insertions(+), 3 deletions(-)

diff --git a/packages/core/package.json b/packages/core/package.json
index d5cad93d6..f2b531527 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -68,6 +68,9 @@
   "peerDependenciesMeta": {
     "@react-native-async-storage/async-storage": {
       "optional": true
+    },
+    "react-native-get-random-values": {
+      "optional": true
     }
   },
   "engines": {
diff --git a/packages/core/src/uuid.ts b/packages/core/src/uuid.ts
index 64d2d7648..1e52873aa 100644
--- a/packages/core/src/uuid.ts
+++ b/packages/core/src/uuid.ts
@@ -1,7 +1,25 @@
-import 'react-native-get-random-values';
 import { v4 as uuidv4 } from 'uuid';
 
+// `uuid` relies on a `crypto.getRandomValues` implementation, which React
+// Native does not provide out of the box. `react-native-get-random-values` is
+// the canonical polyfill, but it's an optional peer dependency: consumers may
+// already polyfill `crypto.getRandomValues` themselves (e.g. via
+// react-native-quick-crypto), so we don't want to force it on everyone.
+try {
+  require('react-native-get-random-values');
+} catch {
+  // No-op: a `crypto.getRandomValues` polyfill may already be installed globally.
+}
+
 export const getUUID = (): string => {
-  const UUID = uuidv4().toString();
-  return UUID;
+  try {
+    return uuidv4().toString();
+  } catch {
+    throw new Error(
+      "@segment/analytics-react-native requires a 'crypto.getRandomValues' " +
+        "polyfill, which doesn't appear to be installed. Install " +
+        "'react-native-get-random-values' and import before " +
+        'initializing the analytics client.'
+    );
+  }
 };
diff --git a/packages/sovran/package.json b/packages/sovran/package.json
index 8d1c58806..35ca36e34 100644
--- a/packages/sovran/package.json
+++ b/packages/sovran/package.json
@@ -74,6 +74,9 @@
   "peerDependenciesMeta": {
     "@react-native-async-storage/async-storage": {
       "optional": true
+    },
+    "react-native-get-random-values": {
+      "optional": true
     }
   },
   "dependencies": {
diff --git a/yarn.lock b/yarn.lock
index 7e7c426aa..4c58c5013 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -4559,6 +4559,8 @@ __metadata:
   peerDependenciesMeta:
     "@react-native-async-storage/async-storage":
       optional: true
+    react-native-get-random-values:
+      optional: true
   languageName: unknown
   linkType: soft
 
@@ -4595,6 +4597,8 @@ __metadata:
   peerDependenciesMeta:
     "@react-native-async-storage/async-storage":
       optional: true
+    react-native-get-random-values:
+      optional: true
   languageName: unknown
   linkType: soft