Quay vs Cronicle

Every release in the current window is security work. Since May, Cronicle has shipped ten versions consisting almost entirely of dependency vulnerability bumps and authorization tightening — shell-quote twice, sanitize-html twice, ws, nodemailer, socket.io, and a move off the unmaintained bcrypt-node. The 0.9.124 and 0.9.125 releases go further, restricting event parameters to those a plugin declares and reworking authorization for job logs, event placement and manual run targets. No new user-facing capability appears anywhere in the window.

This is what a job scheduler's maturity looks like. Cronicle's core function — running commands on remote servers on a schedule — means every authorization gap is a remote execution path, and the fixes cluster precisely there: who may launch an event, against which targets, with which parameters, and what they can read afterward. The dependency bumps follow the same logic, since a scheduler's supply chain is part of its attack surface. Feature development appears to be paused, or at least invisible in the release notes, while this work continues.

The cadence of roughly one release every one to two weeks, each carrying a dependency bump or an authorization fix, is likely to continue while the audit runs its course. Because 0.9.124 restricts event parameters to plugin-defined ones, expect follow-up fixes for deployments that relied on the looser behaviour.