Release v0.44.0 · Fluent-Health/terraform-stack-plan

Breaking

run step is removed (#240). It was renamed to run wrap in #229 and kept
as a warning-only alias only until the downstream infra terramate scripts
switched over; that switch is live and no other caller remains. run step now
exits 2 as an unknown subcommand. run wrap is unaffected — it is the
canonical verb.

This is why the bump is a minor rather than a patch: the CLI surface shrank.

Dependency fixes for the binary and the build:

google.golang.org/grpc → 1.83.1 (#242) — clears GHSA-hrxh-6v49-42gf
(gRPC-Go: xDS RBAC and HTTP/2 vulnerabilities) and CVE-2026-84304 (gRPC-Go:
heap memory exhaustion via HTTP/2 DATA frame fragmentation). grpc is linked
into the binary, reachable via internal/gauth →
google.golang.org/api/option → google.golang.org/grpc, so this is the fix
that matters for a released artifact: v0.43.1 shipped grpc 1.81.1.
github.com/getkin/kin-openapi → 0.144.0 (#242) — clears
GHSA-r277-6w6q-xmqw (critical) plus CVE-2026-76905, CVE-2026-77354 and
CVE-2026-73502. Note this package is an indirect requirement of oapi-codegen
and go mod why reports the main module does not need it, so it was not
compiled into the binary — build-time only.
web/ui lockfile (#243, #246): tar → 7.5.22, undici → 8.10.1, postcss →
8.5.26, browserslist → 4.28.8, nanoid → 3.3.18, and js-yaml → 4.3.2 via
a resolutions override (@redocly/openapi-core pins it at an exact 4.2.0, so
there was no in-range target). All of these are Node-side build tooling and
none appears in the shipped SPA bundle — the built bundle's sourcemap
enumerates 41 modules and contains none of them. CI does rebuild dist/
before the Go build, so the embedded SPA content changes even though the
vulnerable packages never enter it.