LoginSign Up
← Back to all sparks
C

Cronicle

INFRA · APIS
Velocity5.0

Distributed task scheduler and job runner with web based control panel

cronicle.net ↗

Cronicle fixes active-job privilege visibility and chains a run of security dependency patches

job-schedulingopen-sourcesecurityself-hostednode-jscron
◆Current state
Cronicle's recent releases cluster around two themes: access control hardening and dependency security. The v0.9.131 fix applies category and server-group visibility checks to the active job API, login bootstrap, and websocket status payloads — closing a privilege bypass that exposed job activity to users without the right access. Alongside it, a string of vulnerability bumps (nodemailer, nanoid, sanitize-html) and the chained-event bug fix in v0.9.134 round out a security-focused cycle.
◆Where it's heading
The access control fixes in v0.9.125 and v0.9.131 look like the output of a systematic privilege audit rather than isolated bug reports. Node.js v22 is now officially required, the project is testing against v24, and dependencies are being kept current — all signs of a maintained project, not an abandoned one. No major new features are visible in this window.
◆Prediction
A few more targeted privilege-check patches are likely as the access control audit works through the surface. A 1.0 release milestone isn't signaled by anything in the current entries.

◆Recent moves

  1. 8d ago

    Fix: disabled chained events no longer run

    The chained-event bug — disabled events still triggering on chain completion — is fixed. In a job scheduler, a disabled event running unexpectedly can cascade into downstream effects users deliberately turned off; this is a meaningful correctness fix, not just a UI glitch.

    View source ↗
  2. 13d ago

    Security dep bump: nodemailer vuln fix

    Upstream nodemailer vulnerability fix, bumped via pixl-mail. No user-visible behavior change; standard security maintenance.

    View source ↗
  3. 16d ago

    HTTP Client: preserve status code on match failure + Node.js v24 compat

    Two changes: a Node.js v24 compatibility fix (suppresses a runtime warning from pixl-request) and a meaningful behavioral fix — the HTTP Client now preserves the actual HTTP status code in job results when response matching fails, instead of obscuring it. The latter makes failure diagnosis clearer.

    View source ↗
  4. 26d ago

    Fix: active job visibility now respects user category and group privileges

    Category and server-group visibility checks are now applied consistently to the active job API, login bootstrap, and websocket status payloads — closing a privilege bypass where users without the appropriate access could still observe job activity across all categories and groups. Part of a broader access control hardening pass that started in v0.9.125.

    View source ↗
  5. 27d ago

    Fix: HTML encoding for job labels

    HTML encoding fix for job label handling — prevents malformed labels from breaking the UI. A narrow correctness fix with no architectural impact.

    View source ↗
  6. 1mo ago

    Node.js v22 now official requirement

    Node.js v22 is now the official documented requirement, reflected in installer scripts. A runtime hygiene update that formalizes what was already expected in practice.

    View source ↗