release: v1.4.4

New: recursive multi-hop node chaining. config_gen follows chain_node_id
transitively and wires the dial-proxy at every hop (cycle detection +
depth cap), so a 3-node chain (exit → mid → entry) generates fully;
before, only the first link was wired and deeper relays silently dialed
direct.

Changed: WireGuard can only be a chain's EXIT hop — xray can't tunnel
traffic through a WireGuard outbound (as a relay it forwards 0 bytes,
verified live). Guarded in the nodes API (400), config_gen (skip + warn),
and the Node form (omit WG from the chain dropdown). Frontend build moved
to Vite 8 / Rolldown (@vitejs/plugin-react 4→6), dropping bundled esbuild.

Fixed: Route Explainer accepts a full URL — it now extracts the bare host
instead of resolving the whole string (was a confusing NXDOMAIN).

Security: dropping esbuild closes 2 dev-scope esbuild advisories + the
Vite ≤6.4.1 path-traversal; react-router 7.15→7.18 (CSRF); @babel/core /
form-data / js-yaml patched via npm audit fix. npm audit → 0.

No schema migration, no breaking changes. Backend suite 762 passing;
25 frontend tests passing; npm audit clean.

Author: DaveBugg

CHANGELOG.md

@@ -4,6 +4,57 @@ All notable user-facing changes to PiTun. Full per-release detail lives in the
 [GitHub Releases](https://github.com/DaveBugg/PiTun/releases); this file is the
 committed summary.
 
+## v1.4.4 — 2026-06-16
+
+Multi-hop node chaining that actually wires every hop, a Route Explainer that
+accepts pasted URLs, and a frontend toolchain refresh (Vite 5→8 / Rolldown) that
+drops the vulnerable esbuild dependency. Plus security bumps for react-router and
+build-time transitives.
+
+### Added
+
+- **Recursive multi-hop node chaining.** `config_gen` now follows `chain_node_id`
+  transitively, wiring proxySettings (→ `sockopt.dialerProxy`) at every hop with
+  cycle detection and a depth cap. A 3-node chain (exit → mid → entry) generates
+  fully; previously only the first link was wired and deeper relays silently
+  dialed direct, collapsing the chain.
+
+### Changed
+
+- **WireGuard can only be a chain's exit hop.** xray can't tunnel traffic THROUGH
+  a WireGuard outbound — as a relay it forwards 0 bytes (config is accepted, xray
+  starts, traffic dies; verified live: WG-over-VLESS works, VLESS-over-WG and
+  WG-over-WG = 0 B). Enforced three ways: the nodes API rejects pointing a chain
+  at a WireGuard node (400), config_gen skips a WG-relay link with a warning, and
+  the Node form omits WireGuard from the "chain via" dropdown.
+- **Frontend build moved to Vite 8 / Rolldown** (`@vitejs/plugin-react` 4→6),
+  which removes the bundled esbuild entirely.
+
+### Fixed
+
+- **Route Explainer accepts a full URL.** Pasting `https://host/path` resolved the
+  whole string as a domain → confusing NXDOMAIN. It now extracts the bare host
+  (strips scheme / userinfo / path / port, leaves bare IPv6 intact).
+
+### Security / dependencies
+
+- Dropping esbuild (via the Vite 8 bump) closes 2 dev-scope esbuild advisories
+  (Deno integrity GHSA-gv7w-rqvm-qjhr; Windows dev-server file read
+  GHSA-g7r4-m6w7-qqqr) and the Vite ≤6.4.1 path-traversal (GHSA-4w7w-66w2-5vf9).
+- `react-router` / `react-router-dom` 7.15.0 → 7.18.0 — CSRF via PUT/PATCH/DELETE
+  document requests (GHSA-84g9-w2xq-vcv6).
+- Build-time transitives patched via `npm audit fix`: `@babel/core` (arbitrary
+  file read), `form-data` (CRLF injection), `js-yaml` (DoS). `npm audit` → 0.
+
+### Notes
+
+- No breaking changes, no schema migration (alembic head stays at `017`).
+- The frontend now builds with Rolldown — output is functionally identical;
+  verified in a browser (authenticated, 0 console errors).
+- Backend suite 762 passing; 25 frontend tests passing; `npm audit` clean.
+
+**Full Changelog:** https://github.com/DaveBugg/PiTun/compare/v1.4.3...v1.4.4
+
 ## v1.4.3 — 2026-06-15
 
 Set-aware routing rule **export/import** (pick scopes, resolve conflicts, import

backend/app/config.py

@@ -5,7 +5,7 @@
 # OpenAPI metadata, `/health` response, and `/system/status` so the
 # frontend can display it next to the xray version. Bump this on each
 # release — frontend keeps its own version in `frontend/package.json`.
-APP_VERSION = "1.4.3"
+APP_VERSION = "1.4.4"
 
 
 class Settings(BaseSettings):

frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pitun-frontend",
   "private": true,
-  "version": "1.4.3",
+  "version": "1.4.4",
   "license": "BSD-3-Clause",
   "type": "module",
   "scripts": {