--- title: "Node.js challengers gaining ground" publication: "Node Weekly" issue: 479 published_at: "2023-03-23" canonical_url: "https://nodeweekly.com/issues/479" --- Plus npm safety, a OTP library, and taking an anonymous dump. | Together with [![Userfront\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,w_600,h_110/e_make_transparent/co_white,e_outline:7/lnopbsxefrqqsjq14fvr.png)](https://userfront.com/tutorials/react-authentication?utm_source=nodeweekly.com&utm_medium=newsletter&utm_campaign=primary&utm_content=react_authentication) #​479 — March 23, 2023 [Read on the Web](https://nodeweekly.com/issues/479) ![Node.js Weekly](https://res.cloudinary.com/cpress/image/upload/v1653576619/lgfqinzbdqttwmhvljxb.png) [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/l7xzca0kmv21uudplths.jpg)](https://github.blog/changelog/2023-03-21-general-availability-of-granular-access-token-on-npm/) 🔒 [npm Granular Access Tokens Now Generally Available](https://github.blog/changelog/2023-03-21-general-availability-of-granular-access-token-on-npm/) — The [granular access token](https://docs.npmjs.com/about-access-tokens#about-granular-access-tokens) feature on the npm registry is now generally available, allowing you to restrict token access to specific packages, set expiration dates, limit access by IP range, and more. GitHub [Automatic npm Publishing with GitHub Actions and Granular Tokens](https://httptoolkit.com/blog/automatic-npm-publish-gha/) — As mentioned above, GitHub has announced granular access tokens for the npm registry. Tim explains why this is a big deal, not only from a security point of view for us all, but also for anyone publishing packages. Tim Perry [![\](https://copm.s3.amazonaws.com/c1c05630.png)](https://userfront.com/tutorials/react-authentication?utm_source=nodeweekly.com&utm_medium=newsletter&utm_campaign=primary&utm_content=react_authentication) [React Authentication, Simplified](https://userfront.com/tutorials/react-authentication?utm_source=nodeweekly.com&utm_medium=newsletter&utm_campaign=primary&utm_content=react_authentication) — In this article, we lay out a new approach to authentication (plus access control & SSO) in React applications. Userfront sponsor [Deno 1.32 Released with Enhanced Node Compatibility](https://deno.com/blog/v1.32) — I know this is a _Node_ newsletter, but given Deno’s provenance and continuing insistence for Node.js compatibility, this is Node news in a round about way. 1.32 ships with TypeScript 5 and extends `package.json` support in particular. Deno Team [Why We Added `package.json` Support to Deno](https://deno.com/blog/package-json-support) — Further to the above item and Deno’s Node and npm compatibility continuing to improve, the Deno team has been facing questions about the runtime’s core priorities. Ryan Dahl explains more about the thinking here. Ryan Dahl This item led to [an amusing Hacker News subthread](https://news.ycombinator.com/item?id=35233413) wondering if Deno is just heading back to where Node already is. Probably not, but it's a playful observation, and a common issue around the 'version 2' of popular systems generally. **IN BRIEF:** - The folks at Socket have [introduced what they're calling 'safe npm',](https://socket.dev/blog/introducing-safe-npm) a transparent wrapper for `npm` that tries to protect users from malware, typosquatting, malicious install scripts, and more. - Over on Twitter, Sid Palas started with what he called [a 'pile of 💩' `Dockerfile` for a Node app](https://twitter.com/sidpalas/status/1634194026500096000) and worked up to a podium-place example. - Snyk's Vivek Maskara takes a quick look at [how Express, Fastify, and NestJS secure themselves](https://snyk.io/blog/comparing-node-js-web-frameworks/) against common security concerns. - Swizec Teller asks: Can you build a semantic search system in an afternoon? [It seems so.](https://swizec.com/blog/build-semantic-search-in-an-afternoon-yep/) [Migrating from ts-node to Bun](https://johnnyreilly.com/migrating-from-ts-node-to-bun) — Everyone’s coming after Node.js this week! Now it’s the turn of performance oriented [Bun.](https://bun.sh/) John runs us through porting a console app from ts-node over to Bun — something he calls “_a pretty easy process_”. John Reilly [Tuple, a Lightning-Fast Pairing Tool Built for Remote Developers](https://tuple.app?utm_source=cooperpress&utm_medium=newsletter&utm_campaign=sponsorship-blitz&utm_content=Node+Weekly_Brief+Link) Tuple sponsor [Create a CLI Chatbot with the ChatGPT API and Node](https://philna.sh/blog/2023/03/13/create-a-cli-chatbot-with-chatgpt-api-and-node-js/) — If you can’t beat AI, join them..? Phil Nash [What's New in Eleventy 2: How a Great Node.js Static Site Generator Just Got Better](https://www.sitepoint.com/eleventy-2/) Craig Buckler 🛠 Code & Tools [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/kt5bjo6zhxzifr60nqjp.jpg)](https://github.com/hectorm/otpauth) [OTPAuth: One Time Password (HOTP/TOTP) Library](https://github.com/hectorm/otpauth) — When you log in on a site with 2FA and you’re asked for six digits from your authentication app, that’s _probably_ a so-called Time-based One-Time Password (or TOTP). This library for Node, Deno, Bun _and_ the browser lets you work with both TOTPs and HOTPs (HMAC-based OTPs) from JavaScript. Héctor Molinero Fernández [DOCX 8.0: Generate Word `.docx` Files from Node or Browser](https://docx.js.org/) — The code to lay out your documents is verbose but there’s a _lot_ of functionality baked in. Here’s a [CodePen-based example](https://codepen.io/dolanmiu/pen/RwNeObg) and [the v8.0 release notes](https://github.com/dolanmiu/docx/releases/tag/8.0.0) – [GitHub repo.](https://github.com/dolanmiu/docx) Dolan Miu [🚀 Monitor And Optimize Website Speed To Rank Higher in Google](https://www.debugbear.com/?utm_source=newsletter&utm_medium=sponsored&utm_campaign=node-weekly-2) — Monitor Google's Core Web Vitals and optimize performance using in-depth reports built for developers. Improve SEO & UX. DebugBear sponsor [Malibu: Framework-Agnostic CSRF Middleware](https://github.com/tinyhttp/malibu) — ESM only, zero-dependency, and TypeScript types are included. It’s compatible with Express, Tinyhttp, and most modern frameworks based around the core HTTP package. Reinaldy Rafli [pg-anonymizer 0.7.0: Anonymized Data Dumping from Postgres](https://github.com/rap2hpoutre/pg-anonymizer) — A Node-powered tool for taking anonymized exports of databases. Sensitive data is replaced with faked data of equivalent types. Raphaël Huchet [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/pjx92wwgoaxm7dhgvie4.jpg)](https://github.com/sindresorhus/eslint-formatter-pretty) [eslint-formatter-pretty 5.0: Pretty ESLint Formatter](https://github.com/sindresorhus/eslint-formatter-pretty) — Nicer output than the default. Sort results by severity. Get stylized inline code blocks, and more. Sindre Sorhus [Express-Ts-Auth-Service: A Ready-to-Use Authentication Service](https://github.com/Louis3797/express-ts-auth-service) — A pre-built authentication server built around Express.js, JSON Web Tokens, TypeScript and MySQL (via Prisma). Louis X [AWS JWT Verify: Verify JWTs Signed by Amazon Cognito](https://github.com/awslabs/aws-jwt-verify) — In both Node.js and the browser. Amazon Web Services 💻 Jobs [Full Stack JavaScript Engineer @ Emerging Cybersecurity Startup](https://defendify.breezy.hr/p/b07e57b21e02-saas-software-engineer) — Small team/big results. Fun + flexible + always interesting. Come build our award-winning, all-in-one cybersecurity platform. Defendify [Software Engineer (Backend)](https://jobs.ashbyhq.com/stickermule/477eed3e-4aae-46e6-a8ab-0646dbfb11cd?utm_source=Cooperpress) — Join our "kick ass" team. Our software team operates from 17 countries and we're always looking for more exceptional engineers. Sticker Mule [Find Tech Jobs with Hired](https://hired.com/join/?utm_source=newsletter&utm_medium=sponsor&utm_campaign=%28b2c%29%28l-all%29%28r-all%29%28cooper-nodeweekly%29&utm_content=easy-job-hunting) — Hired makes job hunting easy-instead of chasing recruiters, companies approach you with salary details up front. Create a free profile now. Hired **QUICK RELEASES:** - [Playwright 1.32.0](https://github.com/microsoft/playwright/releases/tag/v1.32.0) – Powerful browser control and Web testing framework. More on this in _JavaScript Weekly_ tomorrow as it's [▶️ quite an interesting release.](https://www.youtube.com/watch?v=jF0yA-JLQW0) - [js-bson 5.1](https://github.com/mongodb/js-bson/releases/tag/v5.1.0) ↳ BSON parser library. Now supports `Map` - [express-mysql-session 3.0](https://github.com/chill117/express-mysql-session/releases/tag/v3.0.0) ↳ MySQL session store for Express.js. - [Hexo 7.0 RC1](https://github.com/hexojs/hexo/releases/tag/v7.0.0-rc1) ↳ Node blogging framework. - [Slonik 33.1.3](https://github.com/gajus/slonik) ↳ Type safe Postgres client library. - [Fastify 4.15](https://github.com/fastify/fastify/releases/tag/v4.15.0) ↳ Fast, low overhead web framework. - [node-cache-manager 5.2](https://github.com/node-cache-manager/node-cache-manager) ↳ Flexible cache module. - [Electron 23.2](https://github.com/electron/electron/releases/tag/v23.2.0) - [pnpm 7.30.1](https://github.com/pnpm/pnpm/releases/tag/v7.30.1) **Got a link for us?** Reply and tell us. We can't include everything but we'll look at anything you send. _Thanks!_ --- **Sponsorship:** Email `[kristina@cooperpress.com](mailto:kristina@cooperpress.com)` for details. --- Published by Cooper Press Ltd. Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom [Cancel your subscription](https://nodeweekly.com/leave/*|UID|*) or [change your address.](https://nodeweekly.com/edit_subscription/*|UID|*)