flohoss/gocron v0.13.3

Release v0.13.3

on GitHub

OIDC hardening release. The server can now be pinned to its external origin so login callbacks and logouts use absolute URLs, and discovery no longer hangs when the identity provider is unresponsive.

Highlights

• server.app_url — new optional setting for the externally reachable origin of this instance. It builds the OIDC callback URL and is sent as post_logout_redirect_uri. When unset, both are still derived from the request, but GoCron now logs a warning if OIDC is enabled without it — set it whenever clients reach the instance behind a reverse proxy.

Fixes

• OIDC discovery is now bounded by a 10s timeout instead of waiting on a stuck provider, and the failure retries on the next request.
• Failed OIDC callbacks return an explanatory message field instead of an opaque error.
• js-yaml is pinned to a patched release (^4.3.2) for the OIDC dependency chain.

Improvements

• The example config is spaced out into readable blocks, and the trusted_proxies comment clarifies it only affects client IP detection for logging and rate limiting.

Changes in This Release

• [meta] Update coverage badge [skip ci] (1d4629f) by @github-actions[bot]
• [fix] Time out OIDC discovery against a stuck provider (4a38f3a) by @flohoss
• [feature] Add server.app_url for absolute OIDC URLs (ae76282) by @flohoss
• [improve] Space out the example config for readability (0a76653) by @flohoss
• [meta] Update go packages (62de1b4) by @flohoss
• [fix] Override js-yaml to patched version for OIDC dep chain (519da20) by @flohoss
• [meta] Update openapi spec (af7278a) by @flohoss
• [fix] Send OIDC scheme test from a trusted peer address (d2d2d86) by @flohoss
• [meta] Update coverage badge [skip ci] (ef72b1b) by @github-actions[bot]

Full Changelog: v0.13.2...v0.13.3

Docker Image

docker pull ghcr.io/flohoss/gocron:v0.13.3
docker pull ghcr.io/flohoss/gocron:latest

Binary Downloads

Download one of the attached binaries extracted from the release image:

• gocron_<version>_linux_amd64
• gocron_<version>_linux_arm64

Verify with ./gocron_<version>_linux_<arch> --version.

Image digest:

ghcr.io/flohoss/gocron:v0.13.3@sha256:50d3665bf7a62105fba2d9baf8ad622c76aaece40848d4626c6236291c0a8021

Build Information

• Version: v0.13.3
• Build Time: 2026-10-15T19:45:05Z
• Repository: https://github.com/flohoss/gocron
• Platform: linux/amd64,linux/arm64
• Attestations: SLSA Provenance, SBOM