Croniter (and other) dependency risks (due to EU CRA): Package unmaintained and scheduled for potential removal

[1fanwang]

What do you see as an issue?

Description:

The croniter package, which Airflow uses for parsing cron expressions (particularly extended syntax like 0 0 * * MON#1), has been officially declared unmaintained as of December 10, 2024. The maintainer announced potential removal of all resources by March 15, 2025 due to EU Cyber Resilience Act regulations.

(Was helping an internal Airflow user on their cron expressions today and found out this news through browsing the Airflow User doc links)

Airflow Doc:
https://airflow.apache.org/docs/apache-airflow/stable/authoring-and-scheduling/cron.html#cron-presets

Impact:

• Extended cron syntax functionality in Airflow depends on this package
• No future security patches or updates will be provided
• Package could be removed from PyPI in March 2025

Details

From https://github.com/corpusops/croniter

While this repository has been inactive for some time, this formal notice, issued on December 10, 2024, serves as the official declaration to clarify the situation. Consequently, this repository and all associated resources (including related projects, code, documentation, and distributed packages such as Docker images, PyPI packages, etc.) are now explicitly declared unmaintained and abandoned.

I would like to remind everyone that this project’s free license has always been based on the principle that the software is provided "AS-IS", without any warranty or expectation of liability or maintenance from the maintainer. As such, it is used solely at the user's own risk, with no warranty or liability from the maintainer, including but not limited to any damages arising from its use.

Due to the enactment of the Cyber Resilience Act (EU Regulation 2024/2847), which significantly alters the regulatory framework, including penalties of up to €15M, combined with its demands for unpaid and indefinite liability, it has become untenable for me to continue maintaining all my Open Source Projects as a natural person. The new regulations impose personal liability risks and create an unacceptable burden, regardless of my personal situation now or in the future, particularly when the work is done voluntarily and without compensation.

No further technical support, updates (including security patches), or maintenance, of any kind, will be provided.

These resources may remain online, but solely for public archiving, documentation, and educational purposes.

Users are strongly advised not to use these resources in any active or production-related projects, and to seek alternative solutions that comply with the new legal requirements (EU CRA).

Using these resources outside of these contexts is strictly prohibited and is done at your own risk.

Regarding the potential transfer of the project to another entity, discussions are ongoing, but no final decision has been made yet. As a last resort, if the project and its associated resources are not transferred, I may begin removing any published resources related to this project (e.g., from PyPI, Docker Hub, GitHub, etc.) starting March 15, 2025, especially if the CRA’s risks remain disproportionate.

Solving the problem

Potential Solutions:

1. Evaluate alternative cron parsing libraries
2. Consider forking and maintaining croniter within Apache Airflow
3. Implement native support for extended cron syntax

Open questions

• It is likely that it's not just this one OSS tool that Airflow depends on is reacting to EU CRA, might need a scalable solution to handle this
• Would be helpful to get broader community input on preferred approach before the March 2025 deadline.

FYI: Links a few things I read about ASF's reaction (TG)

https://news.apache.org/foundation/entry/update-on-eu-software-regulation-lots-of-improvements-good-news
https://news.apache.org/foundation/entry/open-source-community-unites-to-build-cra-compliant-cybersecurity-processes

Anything else

No response

Are you willing to submit PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct

[boring-cyborg[bot]]

Thanks for opening your first issue here! Be sure to follow the issue template! If you are willing to raise PR to address this issue please do so, no need to wait for approval.

[jedcunningham]

Thanks @1fanwang for making sure this was on our radar! The Airflow PMC is aware of this and we have been working behind the scenes on some options. We will have more to share soon.

[potiuk]

Additionally - yes, we are in contact with @kiorky and we discussed and proposeed a number of options and help, also explaining th the worries or his are not justified, we also proposed any assistance and help in any kind of migration and taking over maintenance of croniter by other entities. Similarly a number of people reacted in similar way, and I know @kiorky is discussing options with some other enties that have been engaged before with croniter. Also a number of places like pallets-eco and other exists where in the past similar projects found it's home.

So we hope when it comes to real decision, the support, proposals and reach out of various community members will make the creator of croniter, make the right decisions, but we are preparing for all scenarios - including forking relevant parts of croniter and incorporating it in Airflow if needs be - until we find a better replacement we've been vendoring-in other projects in the past in similar cases.

[potiuk]

Converted it into dicussion because this is at most this - a discussion, until decisions are made and announced - hopefully if breaking with enough of a lead time that will allow to adapt.