LoginSign Up
← Back to all sparks
C

Cronicle

INFRA · APIS
Velocity5.0

Distributed task scheduler and job runner with web based control panel

cronicle.net ↗

Security patching gives way to a hard Node.js 22 floor for every self-hosted install.

job-schedulerself-hostedsecurity-hardeningauthorizationdependency-maintenanceruntime-requirements
◆Current state
Cronicle is a self-hosted distributed job scheduler with a web UI, plugin-defined job types, and a multi-server cluster model. Its 0.9.11x-0.9.12x releases are dominated by two threads: dependency bumps closing published vulnerabilities in sanitize-html, nanoid, shell-quote, ws, and nodemailer, and a sustained authorization review of its own. Version 0.9.125 restored cluster authentication clock validation, aligned job log access checks with job details, moved event filtering server-side, and hardened authorization for event placement and manual run targets; 0.9.124 restricted event and job parameters to those a plugin actually defines. Version 0.9.129 changes register: it raises the supported runtime rather than patching another dependency.
◆Where it's heading
The pattern in 0.9.124 and 0.9.125 is not incidental fixes but a systematic pass over where the server trusted client input — parameters, filters, targets, and log access were each independently tightened, and password hashing moved from the unmaintained bcrypt-node to bcryptjs in 0.9.123. The Node.js 22 requirement is the same instinct applied to the platform: patching transitive dependencies one at a time only holds if the runtime underneath is still receiving fixes. Feature work remains essentially absent from this window. For a scheduler that executes arbitrary commands across a cluster, that allocation is defensible.
◆Prediction
A declared runtime floor usually precedes code that depends on it, so expect the next releases to stop working around older Node versions. The hardening sweep should continue through the remaining API surface before feature work resumes.

◆Recent moves

  1. 3d ago

    Node.js v22 becomes the official runtime requirement

    Node.js v22 is declared the official requirement across the docs and the installer scripts. It is a one-line change to the changelog but an action item for every self-hosted operator still on an older runtime, and it is the first release in this window that is neither a dependency bump nor an authorization fix.

    View source ↗
  2. 5d ago

    nanoid vulnerability bump, pixl-server-user to v2

    Two dependency bumps, one closing a nanoid vulnerability and one moving pixl-server-user to a new major. Continues the near-weekly cadence of supply-chain patching that fills this changelog.

    View source ↗
  3. 6d ago

    sanitize-html and nanoid vulnerability fixes

    Bumps sanitize-html for multiple vulnerability fixes and pins its nanoid sub-dependency via override. Released a day before 0.9.128, which bumps nanoid again — the transitive dependency needed two passes.

    View source ↗
  4. 13d ago

    FreeBSD compatibility for process monitoring

    Adjusts ps_monitor_cmd handling so process monitoring works on FreeBSD. Narrow platform compatibility, and the only non-security change in this stretch of releases.

    View source ↗
  5. 19d ago

    Cluster auth clock validation restored, five authorization gaps closed

    The densest security release in the window: cluster authentication clock validation restored, job log access checks aligned with job details, event data filtering moved server-side, and authorization hardened for both updated event placement and effective targets on manual runs. Five independent trust boundaries tightened in one release, which reads as the output of a deliberate review rather than reported bugs.

    View source ↗
  6. 1mo ago

    Event and job parameters restricted to plugin-defined ones

    Hardens event parameter validation so only parameters a plugin actually declares can be included in events and jobs. For a scheduler where plugins define what a job executes, unconstrained parameters are the shortest path from an authenticated user to unintended execution.

    View source ↗