LoginSign Up
← Back to all sparks
C

Cronicle

INFRA · APIS
Velocity5.0

Distributed task scheduler and job runner with web based control panel

cronicle.net ↗

Cronicle ships eleven more security fixes in a day, from path traversal to token reuse.

job schedulersecuritypermissionsclusterself-hosted
◆Current state
Cronicle has moved from dependency bumps to a security sweep. On November 7 three releases fixed path traversal in job log deletion, reused cluster auth tokens, cross-category history disclosure, script parameter overrides in run_event, an echo endpoint and log watch tokens authorizing cluster broadcasts. That follows 0.9.141 and 0.9.142, which closed plugin substitution and API key leaks.
◆Where it's heading
The fixes cover the API, cluster sockets and file access, which reads like a systematic audit rather than one-off reports. The pace suggests more fixes may follow before the sweep ends.
◆Prediction
Expect more permission and cluster hardening releases in the next week, then a return to dependency bumps.

◆Recent moves

  1. 2d ago

    Cronicle 0.9.145 locks down status API and log watch tokens

    The status API is limited to the default ACL, an echo endpoint is removed, and job log watch tokens can no longer authorize cluster broadcasts. The third security release in one day.

    View source ↗
  2. 2d ago

    Cronicle 0.9.144 closes history leak and script overrides

    get_history no longer leaks events from other categories, and run_event can no longer override script parameters. It extends the run_event restriction started in 0.9.141.

    View source ↗
  3. 2d ago

    Cronicle 0.9.143 fixes path traversal and token reuse

    Five fixes: job update APIs use a strict allowlist, cluster sockets honor HTTPS settings, reused cluster tokens are rejected, the queue directory is locked to the daemon account, and log deletion blocks path traversal. The largest batch in the security sweep so far.

    View source ↗
  4. 7d ago

    Cronicle 0.9.142 blocks chain-reaction abuse and API key leaks

    Restricted accounts can no longer use chain reactions to run events, and API keys no longer show up in objects or audit metadata. Operators with shared or restricted accounts should upgrade.

    View source ↗
  5. 8d ago

    Cronicle 0.9.141 stops plugin substitution via run_event

    Restricts run_event overrides so callers cannot substitute a different plugin. Cronicle's first fix to its own permission model after weeks of dependency bumps.

    View source ↗
  6. 12d ago

    Cronicle 0.9.140 bumps pixl-tools, removes picomatch

    A pixl-tools bump that removes the picomatch module. Another single-dependency release in the maintenance line.

    View source ↗