CloudQuery CLI 6.41.2 - Plugin SDK, gRPC, And OTEL Pins

CloudQuery tagged cli-v6.41.2 on 31 August 2026 as a stable CLI patch, not a prerelease. The notes are entirely Go module bumps: plugin-pb-go to v1.27.17, plugin-sdk/v4 to v4.96.2, google.golang.org/grpc to v1.83.1, google.golang.org/protobuf to v1.36.12, and newer OpenTelemetry collector and Go SDK libraries. No sync command, spec field, or destination writer changed in this tag.

The full release notes and downloads are on the GitHub release page. The diff against the previous CLI tag is cli-v6.41.1...cli-v6.41.2.

The CLI talks to source and destination plugins over a protobuf gRPC bus. That bus is generated from plugin-pb and consumed through plugin-pb-go. This tag takes two steps: #23245 moved plugin-pb-go from v1.27.15 to v1.27.16, then #23275 landed v1.27.17.

v1.27.16 is the heavier of the two. It regenerates Go stubs from plugin-pb, bumps arrow-go/v18 to v18.7.0, and pulls golang.org/x/net to v0.55.0 with a security label on that update. The CLI binary therefore ships a newer net stack under the plugin client, even though the CloudQuery notes do not list a CVE of their own.

#23277 then pins plugin-sdk/v4 at v4.96.2 (from v4.96.1). That SDK patch is itself a dependency roll: more plugin-pb-go, gRPC, protobuf, and several aws-sdk-go-v2 monorepo updates. There is no new CLI flag, table, or transformer in this tag.

This GitHub tag is the CLI only. Source and destination plugin packages version on their own cadence. Bumping the CLI image does not publish those plugin binaries. Treat cli-v6.41.2 as a CLI binary refresh and keep plugin pins until those packages cut their own tags.

#23234 and #23288 walk google.golang.org/grpc through v1.83.0 and then to v1.83.1. #23270 sets google.golang.org/protobuf to v1.36.12.

v1.83.1 is a grpc-go security patch for xDS RBAC matchers. Nested Principal and Permission rules that used :scheme or grpc- prefixed headers, mixed case header names, or a Host matcher that was not rewritten to :authority could let DENY rules fail open. That path matters for xDS control planes. A typical CloudQuery sync that execs local plugin processes over gRPC does not use that matcher set. The same patch also restricts memory overhead when buffering small data frames on the transport, which is the part that can show up in a busy CLI process.

Do not read this tag as a CloudQuery auth change. Specs, API tokens, and plugin spec YAML are untouched in the notes. The protobuf pin is a library bump with no documented wire format change on the CloudQuery side.

#23292 updates the OpenTelemetry collector monorepo. Collector component, consumer, pdata, and receiver move from v1.63.0 to v1.65.0. confighttp and otlpreceiver move from v0.157.0 to v0.159.0. The same go get on cli/go.mod also rewrote configgrpc from v0.157.0 to v1.65.0.

#23293 updates the OpenTelemetry Go monorepo. go.opentelemetry.io/otel, metric, sdk, and trace move from v1.44.0 to v1.45.0. Log packages move from v0.20.0 to v0.21.0.

Those libraries sit under CLI telemetry export, not under table extract or load. If a job ships traces or metrics to an OTLP collector, watch exporter path handling and HTTP Retry-After behavior after the SDK bump. The notes do not document a CloudQuery config key change for telemetry.

This is internal plumbing. There is no new cq subcommand for traces. Operators who do not export OTLP from the CLI will see a larger binary graph and little else.

The notes on the GitHub release page list no breaking CLI change and no migration step. The tag is a patch on cli-v6.41.1.

Roll the CLI binary or container to cli-v6.41.2 when you next rebuild the sync image. Keep plugin versions on their own pins. If you vendor CloudQuery as a Go module rather than a binary, run go mod tidy and expect the gRPC, protobuf, and OpenTelemetry graphs to move with it.

No schema migration, no spec rewrite, no destination table rename.