Make BSON an optional dependency

[takameyer]

What, How & Why?

• Users trying out the release candidates of v12 reported errors being thrown for the bson dependency
• In v11 and earlier, bson was a dependency of realm and not a peerDependency.
• In v12 bson was added as a peerDependency, causing the issue.

This PR reverts the changes to v12 regarding bson, but also adds bson as an optional dependency, freezing it to a v4 if it's installed locally, since v5 is not directly compatible with react-native

☑️ ToDos

• 📝 Changelog entry
• 📝 Compatibility label is updated or copied from previous entry
• 📝 Update COMPATIBILITY.md
• 🚦 Tests
• 🔀 Executed flexible sync tests locally if modifying flexible sync
• 📦 Updated internal package version in consuming package.jsons (if updating internal packages)
• 📱 Check the React Native/other sample apps work if necessary
• 📝 Public documentation PR created or is not necessary
• 💥 Breaking label has been applied or is not necessary

If this PR adds or changes public API's:

• typescript definitions file is updated
• jsdoc files updated

[kraenhansen]

I don't think this is the intended use of optionalDependencies as per this description:

If a dependency can be used, but you would like npm to proceed if it cannot be found or fails to install, then you may put it in the optionalDependencies object.

I don't see a valid case where the installation of the bson package would fail, as this happens mostly if it fails to download or build a binary for an unsupported target OS or similar failure during a postinstall scripts execution.

[kraenhansen]

What you might be looking for is the peerDependenciesMeta which can mark a peer dependency as optional, but I don't think that's what we want, since the internals of our SDK relies on it being installed and available at runtime.

[takameyer]

I've been experimenting with this, and have also found that the peerDependency is the correct way of going about this. I was under the assumption that npm wouldn't install bson on npm install, but it does.

I think in it's current form on main the package.json is fine. We should stay on v4 for now, as the react-native tests fail using v5

[kraenhansen]

Yeah - a missing peer dependency is automatically installed since NPM v7.

[kraenhansen]

In v12 bson was added as a peerDependency, causing the issue.

What issue is this causing? A link would be great 👍

since v5 is not directly compatible with react-native

The peer dependency is declaring a dependency on bson@^4, so how is this related to bson@5?

[takameyer]

After trying out peerDependencies and optionalDependencies, it seems going optional is not the correct path. It appears the issue described here has already been solved by other methods. My main concern was that users would be forced to npm install bson in their projects, which would lead them to installing v5, which has some compatibility issues with react native.
see https://github.com/realm/realm-js/actions/runs/5711929450/job/15474655575