CloudQuery Square v1.3.32 - Security Dependency Updates

CloudQuery published the Square source plugin release plugins-source-square-v1.3.32 on July 13, 2026. The main operator facing change is the move to pyarrow 23.0.1, which the release notes mark as a security fix. The same release moves pytest to 9.0.3 under that classification; this is a standard release, not a prerelease.

The full release notes and downloads are on the GitHub release page.

The release updates pyarrow to 23.0.1. The project records the work in issue 23068 and commit 84b5873. This is the part of the release most closely tied to the data path, since PyArrow supplies columnar types and memory representation to Python data tooling.

The release notes classify the update as both a bug fix and a security change. They do not name a CVE, identify an affected PyArrow feature, or describe an exploit path. Operators should not map the release to a scanner finding without checking the resolved package inventory in the deployed artifact.

After rollout, confirm that the plugin environment actually resolves pyarrow 23.0.1. Then rerun the relevant dependency scan against that artifact. The tag proves what CloudQuery released, but a container cache, an inherited lock file, or a separate build process can still determine what reaches production.

The second dependency update moves pytest to 9.0.3. CloudQuery tracks it in issue 23069 and commit 4f3b70b. The release notes apply the same security marker but again provide no advisory identifier or exposure detail.

This change matters most to teams that build the Square source from the repository or reproduce its test environment. The notes identify pytest only as a dependency. They do not say whether it is present in a production package or image, so artifact inspection should settle that question.

Recreate cached test environments before validating the release. A stale environment can keep an older pytest version while the connector tag has moved forward. Treat this as verification toolchain maintenance, not as a new Square extraction feature.

Version 1.3.32 contains only the two dependency fixes described above. The notes announce no new Square resources, schema changes, pagination changes, authentication changes, configuration keys, or state migration. They also contain no breaking change notice or manual migration step.

That keeps the upgrade review narrow. Pin plugins-source-square-v1.3.32, run a representative Square sync, and compare emitted schemas and row counts with the current baseline. Confirm pyarrow 23.0.1 in the runtime environment and pytest 9.0.3 wherever the test suite is installed.

Start with the same Square account, resource selection, and destination used for the current version. That holds input and output constant while the dependency set changes. Save the resolved package list beside the sync result. It gives reviewers direct evidence that the intended PyArrow build ran during validation.

The absence of connector changes in the notes is not a substitute for a sync test. It does mean the rollout should be described as dependency remediation. If a schema or extraction result changes, the release notes do not provide an expected connector behavior change that would explain it.