CloudQuery azblob 4.5.11 - gRPC Security And SDK Pins

CloudQuery tagged plugins-destination-azblob-v4.5.11 on 22 August 2026. The Azure Blob destination has no feature bullets and no schema notes. The changelog is dependency pins, and the one with an operator visible label is the SECURITY bump of google.golang.org/grpc to v1.82.1, shipped with azure-sdk-for-go and plugin-sdk v4.95.3.

The full release notes and downloads are on the GitHub release page.

CloudQuery destination plugins talk to the CLI over gRPC. The notes mark #23140 as a SECURITY update of google.golang.org/grpc to v1.82.1 (commit 92abfb2). That is the only runtime security label on the Go module graph in this tag.

If you run this plugin as a separate process next to cloudquery sync, the plugin binary is the gRPC server the CLI dials. A patch that only shows up under deps still changes that process. The azblob notes do not name an advisory, a CVE, or a CloudQuery specific gRPC setting. Treat the SECURITY tag as the reason to rebuild and roll the destination, not as a documented Azure Blob behavior change.

golang.org/x/net also moved to v0.56.0 in #23033 (commit 43c367a). That library sits under the HTTP and HTTP/2 stacks that gRPC uses. Again, the plugin authors recorded a pin, not a writer bug.

The destination writes objects to Azure Blob. #22997 updates the azure-sdk-for-go monorepo (commit b706dea). The notes do not list a new auth mode, a new container option, or a changed blob path layout. Expect the usual SDK patch mix: client fixes, retry behavior, and API types this plugin already compiled against.

#22946 bumps github.com/cloudquery/plugin-sdk/v4 to v4.95.3 (commit b9aac1f). That SDK owns spec validation, table writing, and the plugin protocol. A destination tag can pick up SDK behavior without a plugin level changelog entry. If you wrap this destination or pin an older SDK in a fork, this is the bump to diff.

#23047 updates github.com/cloudquery/jsonschema to digest 45e7e20 (commit 0eebce9). That is config schema machinery. No spec field changes are listed for the azblob destination itself.

Winners here are operators who already automate plugin updates and want the Azure client and SDK current. Losers are teams that treat destination tags as no ops and skip validation. An SDK bump can change validation or write batching even when the plugin README is silent.

CloudQuery moves table batches as Apache Arrow. #23163 updates github.com/apache/arrow-go/v18 to v18.7.0 (commit 7df4831). An Arrow bump can change IPC details, type conversion, or memory layout. The azblob notes do not call out a writer bug. This is still the data path, not a lint only pin.

The go module directive moved twice in the same tag: v1.26.4 in #22996, then v1.26.5 in #23182. Builds that honor go 1.26.5 in go.mod need that toolchain. Users of a published plugin artifact do not pick the directive themselves.

pytest is pinned to v9.0.3 twice, both labeled SECURITY: #23069 and #23114. That is a Python test dependency. It does not load in the destination process at sync time. Duplicate PRs like this are renovate noise. Do not treat them as a production issue for the Azure writer.

Most of this section is internal housekeeping. The Arrow pin is the exception because it sits on the table batch path into blob uploads.

This is not a prerelease. The compare range is plugins-destination-azblob-v4.5.10 to plugins-destination-azblob-v4.5.11. There is no migration section and no breaking change list.

If you already run v4.5.10, take this tag for the gRPC SECURITY pin, the Azure SDK, plugin-sdk v4.95.3, and Arrow v18.7.0. Rerun a small sync against a scratch container and confirm blob names, content types, and batch sizes match the previous run. The notes give you no reason to rewrite destination YAML.

Skip it only if you do not run the Azure Blob destination. Other CloudQuery plugin tags in the same monorepo are not this release.