https://raw.githubusercontent.com/OrcVole/crawl4ai-cloudron/main/CloudronVersions.json
Description
0.9.4
Crawl4AI
Crawl4AI is an open-source web crawling and extraction API, built to feed clean data into language models or automation workflows. It fetches a page with a real Chromium headless browser and returns the content as clean Markdown, raw HTML, a screenshot, or a PDF. The package exposes both a REST API and an MCP endpoint, so AI agent tools can call it directly.
Every request requires an API token, generated automatically the first time the app starts. There is no way to use the service without it. Because the browser runs inside a container, its own security sandbox cannot be enabled; this is the same situation every headless-browser app on Cloudron is in (browserless included). The package compensates: the token is required on every call, requests to addresses inside your server's own private network are refused by default, and optional scripting hooks are disabled.
Nothing here needs backing up beyond the API token itself: there is no separate database, and crawl results are not kept.
This package includes software developed by UncleCode as part of the Crawl4AI project, licensed Apache-2.0 with an attribution requirement (see NOTICE). It is a community package, not affiliated with or officially supported by the Crawl4AI project.
Recent Changes
Bump three of upstream's own bundled Python packages to close known HIGH-severity CVEs:
PyJWT (CVE-2026-32597, CVE-2026-48526), msgpack (GHSA-6v7p-g79w-8964), and setuptools
(CVE-2025-47273). PyJWT is not reachable in this package regardless, since JWT auth is forced
off; the others get the same fix out of caution.
Remove pip from the runtime image. Nothing in the running app uses it, and its own vendored
copies of msgpack and setuptools still carried the fixed CVEs, so scanners kept reporting them.
The image now has no known fixable HIGH or CRITICAL issue in its own Python packages; what
remains is inherited unchanged from the Cloudron base image.