[vishr]

Summary

- Version = "5.4.3"
+ Version = "5.4.4"
+ Changelog describes proxy identity header hardening

Prepare v5.4.4 containing #3200. The proxy retains its derived X-Real-IP after hop-by-hop stripping; v5’s safe default extraction and existing CVE affected ranges are unchanged.

Evidence

• Before: The merged proxy hardening reports 5.4.3.
  After: The version and changelog identify 5.4.4.
• Runtime implementation is unchanged from the Claude-reviewed security-hardening PR. Release PR checks run before tagging.

Merge Danger

Door: two-way

Blast Radius: Release

Only version and release documentation change. The release tag will be created after checks pass.