LoginSign Up
← Back to all sparks
C

Cronicle

INFRA · APIS
Velocity5.0

Distributed task scheduler and job runner with web based control panel

cronicle.net ↗

Cronicle is closing privilege escalation gaps in its cluster and job visibility layer through a sustained security hardening push.

job-schedulersecurity-hardeningaccess-controlnodejsopen-sourcecron
◆Current state
Cronicle has been shipping frequent small releases — roughly one per week — dominated by security patches, dependency updates, and access control fixes. The substantive work is in the authorization layer: cluster authentication clock validation restored, server-side event data filtering applied, category and server-group privilege checks added to active job API and WebSocket payloads, and event parameter validation hardened to restrict plugins to their declared parameters. Dependency management for known vulnerabilities (nanoid, sanitize-html, nodemailer) runs in parallel.
◆Where it's heading
The project is consolidating around security and compatibility rather than expanding features. The access control hardening suggests a push toward making Cronicle safer for multi-tenant or role-separated deployments — its key structural gap compared to enterprise schedulers. Node.js v22 is now the official minimum, closing the runtime lag and setting the stage for newer APIs.
◆Prediction
The privilege hardening work is likely not complete — user-level job isolation and audit logging are natural next steps for the multi-user scenario these access control changes are targeting. Continued dependency maintenance will keep the release cadence high even when no features land.

◆Recent moves

  1. 5d ago

    Cronicle 0.9.133: nodemailer vuln fix

    v0.9.133 bumps pixl-mail to patch a nodemailer vulnerability upstream. No functionality changes — pure security dependency maintenance.

    View source ↗
  2. 8d ago

    Cronicle 0.9.132: Node v24 compat + HTTP status preservation

    v0.9.132 bumps pixl-request for a Node.js v24 warning and adds HTTP status code preservation when response matching fails. The status code fix is a correctness improvement for HTTP Client jobs, but too narrow to affect most deployments.

    View source ↗
  3. 18d ago

    Version 0.9.131

    v0.9.131 applies category and server-group visibility checks to the active job API, login bootstrap, and WebSocket status payloads, ensuring users only see jobs they're authorized to view. This is a meaningful access control addition for multi-user or team deployments where job isolation matters.

    View source ↗
  4. 19d ago

    Cronicle 0.9.130: HTML encoding fix in job labels

    v0.9.130 fixes HTML encoding in job labels — an XSS-class correctness fix with no feature impact.

    View source ↗
  5. 1mo ago

    Cronicle 0.9.129: Node.js v22 requirement formalized

    v0.9.129 formalizes Node.js v22 as the minimum runtime requirement in docs and installer scripts. An administrative change with no code changes — sets the baseline for future runtime API use.

    View source ↗
  6. 1mo ago

    Cronicle 0.9.128: security dep bumps

    v0.9.128 bumps nanoid for a vulnerability fix and bumps pixl-server-user to v2, closing a related issue. Routine dependency maintenance in Cronicle's ongoing security upkeep cycle.

    View source ↗