v1.0.4

Security

• SSRF validation on the headless-browser tier. The browser fallback
  (reached directly via BrowserMode::Always/Stealth, or via dispatch
  escalation to Tier::Browser) navigated page.goto(url) without the SSRF
  check the HTTP tier already enforced, so a seed or escalated URL could reach
  loopback, RFC1918, link-local, or cloud-metadata addresses through a real
  browser. The target is now validated against CrawlConfig::ssrf — the same
  deny_private policy and DNS resolution as the HTTP tier — before any
  navigation. (crates/crawlberg/src/browser.rs)

  Known limitation: in-browser redirects and client-side navigations are not
  yet re-validated per hop (that requires CDP request interception); the
  pre-navigation check plus deny_private cover the direct and
  DNS-rebinding-on-the-seed vectors.

Zig

Add to your build.zig.zon:

.dependencies = .{
    .crawlberg-zig = .{\n        .url = \"https://github.com/xberg-io/crawlberg/releases/download/v1.0.4/crawlberg-zig-v1.0.4.tar.gz\",\n        .hash = \"crawlberg-1.0.4-IoY1Ct8jfyBTZHDw9qk8k0HLhpQJVR8q7PbSEqodSyaz\",\n    },\n},\n```\n