LoginSign Up
← Back to all sparks
C

Cronicle

INFRA · APIS
Velocity5.0

Distributed task scheduler and job runner with web based control panel

cronicle.net ↗

Cronicle has spent 2026 hardening the paths that let a scheduler run arbitrary commands

job-schedulersecurity-hardeningauthorizationdependency-updatesself-hostednodejs
◆Current state
Every release in the current window is security work. Since May, Cronicle has shipped ten versions consisting almost entirely of dependency vulnerability bumps and authorization tightening — shell-quote twice, sanitize-html twice, ws, nodemailer, socket.io, and a move off the unmaintained bcrypt-node. The 0.9.124 and 0.9.125 releases go further, restricting event parameters to those a plugin declares and reworking authorization for job logs, event placement and manual run targets. No new user-facing capability appears anywhere in the window.
◆Where it's heading
This is what a job scheduler's maturity looks like. Cronicle's core function — running commands on remote servers on a schedule — means every authorization gap is a remote execution path, and the fixes cluster precisely there: who may launch an event, against which targets, with which parameters, and what they can read afterward. The dependency bumps follow the same logic, since a scheduler's supply chain is part of its attack surface. Feature development appears to be paused, or at least invisible in the release notes, while this work continues.
◆Prediction
The cadence of roughly one release every one to two weeks, each carrying a dependency bump or an authorization fix, is likely to continue while the audit runs its course. Because 0.9.124 restricts event parameters to plugin-defined ones, expect follow-up fixes for deployments that relied on the looser behaviour.

◆Recent moves

  1. 4d ago

    Cronicle 0.9.126 fixes process monitoring on FreeBSD

    A single compatibility fix for ps_monitor_cmd handling on FreeBSD. The first release in months that is not security work, which is the only reason it stands out.

    View source ↗
  2. 10d ago

    Cronicle 0.9.125 tightens authorization on logs, targets and manual runs

    The densest security release in the window: cluster authentication clock validation restored, job log access aligned with job details permissions, server-side filtering applied to event data, and authorization hardened for both updated event placement and manual run targets. Each item closes a path where a user could reach a server or a log they should not.

    View source ↗
  3. 23d ago

    Cronicle 0.9.124 limits event params to plugin-defined ones

    Events and jobs may now only carry parameters the plugin itself declares, closing off injection of arbitrary values into command execution. It is the most behaviour-changing item of the campaign and the one most likely to break existing setups that relied on passing extra parameters.

    View source ↗
  4. 1mo ago

    Cronicle 0.9.123 replaces bcrypt-node with bcryptjs

    A swap from an unmaintained password hashing library to a maintained one. Invisible in use, but it removes a dependency that had stopped receiving fixes.

    View source ↗
  5. 1mo ago

    Cronicle 0.9.122 bumps shell-quote for vulnerability fixes

    A single dependency bump, and the second shell-quote update in three weeks. For a tool that assembles shell commands, this is the dependency most worth keeping current.

    View source ↗
  6. 1mo ago

    Cronicle 0.9.121 tightens launch options, bumps nodemailer and ws

    Event launch option handling is tightened alongside two upstream vulnerability bumps. Representative of the run of releases where the changelog is one hardening line and two version numbers.

    View source ↗