--- title: "Security" publication: "Node Weekly" issue: 417 published_at: "2021-12-09" canonical_url: "https://nodeweekly.com/issues/417" --- Plus what you should know about Node's memory limits. | #​417 — December 9, 2021 [Read on the Web](https://nodeweekly.com/issues/417) Node Weekly [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60/f2jffhszv9r1n44wzxx8.jpg)](https://github.blog/2021-12-07-enrolling-npm-publishers-enhanced-login-verification-two-factor-authentication-enforcement/) [GitHub Rolling Out Enforced 2FA and More for npm Registry](https://github.blog/2021-12-07-enrolling-npm-publishers-enhanced-login-verification-two-factor-authentication-enforcement/) — Many public code package registries have suffered issues with user security in recent years, and a single compromised package can cause havoc in the npm ecosystem in particular. GitHub are, therefore, moving forward with plans for ‘enhanced login verification’ including enforced 2FA _for publishers of high impact packages_ in early 2022. If you want to check your npm account and improve its security, now is the time! Myles Borins [Why You Should Check-In Your Node Dependencies](https://www.jackfranklin.co.uk/blog/check-in-your-node-dependencies/) — _“I currently work at Google on the Chrome DevTools team and we check our node_modules folder into source control. At first this struck me as unusual, but I’ve come to believe that there are some major benefits to this approach that I think more people should consider.”_ Jack Franklin [![\](https://copm.s3.amazonaws.com/1830a3cb.jpg)](https://bridgecrew.io/resource/the-devsecguide-to-iac-1/?utm_medium=sponsorednewsletter&utm_source=nodeweekly&utm_campaign=nw211209&utm_content=dsgiac) [The DevSecGuide to Infrastructure as Code](https://bridgecrew.io/resource/the-devsecguide-to-iac-1/?utm_medium=sponsorednewsletter&utm_source=nodeweekly&utm_campaign=nw211209&utm_content=dsgiac) — Learn research on the state of IaC security, practical steps for building a DevSecOps culture, and tips for embedding automated security throughout the DevOps lifecycle. Download the guide for free. Bridgecrew sponsor **IN BRIEF:** - [npm 8.2.0](https://github.com/npm/cli/releases/tag/v8.2.0) has been released. - GitHub is making some [serious improvements to its code search functionality.](https://github.blog/2021-12-08-improving-github-code-search/) There's a waitlist if you want to try it out, though. - [Chalk 5.0](https://github.com/chalk/chalk/releases/tag/v5.0.0), the popular terminal styling library, is now out, and has gone pure ESM. TypeScript users will want to stick with Chalk 4 until TypeScript 4.6,[however](https://github.com/microsoft/TypeScript/issues/46452). [On Node.js Memory Limits: What You Should Know](https://blog.appsignal.com/2021/12/08/nodejs-memory-limits-what-you-should-know.html) — Node.js is pretty efficient in terms of its memory use so you might never run into its limits, but it’s worth understanding how Node’s memory management works and how to handle limits and things like memory leaks _before_ they crop up in your app. Camilo Reyes [Fighting TLS Fingerprinting with Node](https://httptoolkit.tech/blog/tls-fingerprinting-node-js/) — For a whole variety of reasons, some sinister, many commercial, a lot of online services want to track people and their use of the Web – fingerprinting is one way to do this, and the way TLS requests are made can add to this, as demonstrated here. Tim Perry [Want to Transfer a Domain with No Downtime? 👀 Our Handy Checklist 👉](https://dnsimple.link/node-weekly/9Dec2021) DNSimple sponsor [Creating Views with Postgres and TypeORM](https://wanago.io/2021/12/06/views-postgresql-typeorm/) — [TypeORM](https://typeorm.io/) is a popular ORM that supports the Active Record and Data Mapper patterns and can be used from Node. Marcin Wanago [How to Set Up Server Side Rendering (SSR) with React, Express.js, & esbuild](https://devtails.xyz/how-to-set-up-server-side-rendering-ssr-with-react-and-esbuild) Adam Berg 💻 Jobs [Senior Backend Developer 🚀(Remote, Work from Anywhere 🏖)](https://crystallize.com/careers/backend-developer) — We're reimagining eCommerce with super fast headless commerce service for product storytellers. React, Node, GraphQL? Let's talk. Crystallize [Find Tech Jobs with Hired](https://hired.com/join/?utm_source=newsletter&utm_medium=sponsor&utm_campaign=%28b2c%29%28l-all%29%28r-all%29%28cooper-nodeweekly%29&utm_content=find-your-next-job) — Create a profile on Hired to connect with hiring managers at growing startups and Fortune 500 companies. It's free for job-seekers. Hired 🛠 Code & Tools [graphql-request: A Minimal GraphQL Client for Node and Browsers](https://github.com/prisma-labs/graphql-request) — The target use here is small scripts and simple apps, not larger things where something like [Apollo](https://www.apollographql.com/) might provide the structure you need. Prisma Labs [CSSO 5.0: A CSS Minifier with Structural Optimizations](https://github.com/css/csso) — A tool that cleans, compresses, and restructures CSS. The newly dropped v5.0 adds ES module support and CSS Selectors Level 4 support too. Roman Dvornov [node-datachannel: libdatachannel Bindings for Node.js](https://github.com/murat-dogan/node-datachannel) — `libdatachannel` is a standalone C++17-based implementation of various WebRTC standards, as well as WebSockets, for use on POSIX platforms. Murat Doğan [Video for Node: Build Video in Just Two API Calls](https://get.mux.com/2ZEqn7w) Mux sponsor [Nock: HTTP Server Mocking and Expectations Library](https://github.com/nock/nock) — Let’s say you’re creating a client library that uses HTTP to hit a third party service. Nock will let you test it in isolation by mocking requests/responses. Nock [Ink 3.2: React, but for Building Interactive CLI Apps](https://github.com/vadimdemedes/ink) — Build your command line apps using React-style components. Vadim Demedes [github-unstar: Unstar All Your Starred GitHub Repos](https://github.com/tpkahlon/github-unstar) — If you’ve starred far too many repos on GitHub and want to start from scratch, this quick script could help. tpkahlon [async-sema: A Semaphore Implementation for Use with `async` and `await`](https://github.com/vercel/async-sema) Vercel [jsdom 19.0: Pure JS Implementation of Web Standards for Use with Node](https://github.com/jsdom/jsdom) Elijah Insua [Multer: Middleware to Handle `multipart/form-data` Submissions](https://github.com/expressjs/multer) Hage Yaapa [Zod: TypeScript-First Schema Validation with Static Type Inference](https://github.com/colinhacks/zod) Colin McDonnell **Got a new email?** You can [change your address here](https://nodeweekly.com/edit_subscription/*|UID|*). --- **Bored of us?** [Click here to stop getting Node Weekly](https://nodeweekly.com/leave/*|UID|*). --- **Got a link for us?** Reply and tell us. We can't include everything but we'll look at anything you send. Thanks! --- **Want to sponsor?** Email `[kristina@cooperpress.com](mailto:kristina@cooperpress.com)` for details. --- Published by Cooper Press Ltd. Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom [Stop getting this newsletter.](https://nodeweekly.com/leave/*|UID|*)