Update dependency checkov to v3 - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
checkov	==2.0.1076 -> ==3.2.379

---

Release Notes

bridgecrewio/checkov (checkov)

v3.2.379

Compare Source

v3.2.378

Compare Source

Bug Fix

• secrets: Remove CKV_SECRET_80 instead of CKV_SECRET_6 - #​7029

v3.2.377

Compare Source

Feature

• terraform: adding 3 policies & tests - #​7011

Bug Fix

• cloudformation: Handle subs in CKV_AWS_384 - #​7022
• secrets: Fix Duplicated Violation in line bug - #​7027
• terraform: Fixed CKV2_GCP_10 to exclude non http triggered cloud functions from security_level requirement - #​7008
• terraform: Handle new resource type for CKV_GCP_73 - #​7023

v3.2.376

Compare Source

v3.2.375

Compare Source

v3.2.374

Compare Source

v3.2.373

Compare Source

Bug Fix

• terraform: CKV_GCP_74, CKV_GCP_76 incorrectly enforced for REGIONAL and GLOBAL managed proxy networks - #​7002

v3.2.372

Compare Source

Feature

• terraform: Add multiple checks - #​7016

Bug Fix

• terraform: Postgres latest stable version - #​7015

v3.2.371

Compare Source

v3.2.370

Compare Source

Bug Fix

• general: Handle ECS enhanced container insights - #​7001

v3.2.369

Compare Source

Bug Fix

• terraform: Multiple check fixes - #​6999

v3.2.368

Feature

• general: fix proxy access from git and registry loader - #​6992

v3.2.367

v3.2.366

Bug Fix

• bicep: Add bicep specific for CKV_AZURE_25 since ARM implementation fails - #​6996
• terraform: CKV_AZURE_249 & CKV_AWS_358 - better support for OIDC 'repo' detection regex and conditions order - #​6994

v3.2.365

v3.2.364

Bug Fix

• terraform: CKV_AWS_339 - Add EKS platform version 1.32 to allowed lists of versions - #​6988

v3.2.363

v3.2.362

Bug Fix

• secrets: Multiple matching groups are being caught as regex separated by | sign - #​6967
• secrets: Remove both random and base64 entropy secrets finding - #​6969

Platform

• general: Backfill more eval keys - #​6970

v3.2.361

v3.2.360

v3.2.359

v3.2.358

Feature

• general: Add env var for policy metadata - #​6979

v3.2.357

Feature

• general: initial support for python 3.13 - #​6962

Bug Fix

• terraform: OIDC checks fixes - #​6964

v3.2.356

v3.2.355

Feature

• terraform: Update CKV_AWS_358, add CKV_GCP_125 and CKV_AZURE_249 for OIDC claims analysis for GitHub - #​6960

Bug Fix

• terraform: Accept TLS 1.3 for Azure web apps and web app slots - #​6956

Platform

• terraform: Add eval keys - #​6929

v3.2.354

v3.2.353

Bug Fix

• general: Support CVE suppressions with the root file in repo - #​6948

v3.2.352

Feature

• terraform: add option to add external_modules_content_cache to terraform build_graph - #​6942

v3.2.351

Bug Fix

• terraform: Skip tsconfig in terraform plan - #​6941

v3.2.350

Feature

• terraform: add CKV_AZURE_248 - Azure batch account network access restriction - #​6928

Bug Fix

• terraform: Revert feat(terraform): Add a terraform block check (#​6904) - #​6937

v3.2.349

v3.2.348

v3.2.347

Feature

• general: Change behavior where if a config file is missing, run the scan as if there was no config file - #​6926

Bug Fix

• terraform: Fix for multiple checks - #​6933

v3.2.346

Feature

• terraform: add option to add proxy to request - #​6923

v3.2.345

Feature

• cloudformation: Add sensitive param check - #​6921
• terraform: add option to add proxy to request - #​6916
• terraform: check cognitive services restrict outbound network - #​6919

Bug Fix

• terraform_json: support CDKTF output in CKV_TF_3 - #​6918

v3.2.344

Bug Fix

• kubernetes: Add to nested resources on k8s graph inherit namespace - #​6912

v3.2.343

v3.2.342

Feature

• serverless: serverless definitions context - #​6910
• serverless: Serverless graph integration - #​6911
• terraform: Add a terraform block check - #​6904

v3.2.341

v3.2.340

v3.2.339

Bug Fix

• general: Fix jsonpath-key handling for special characters like "/" and reduce log size - #​6907
• serverless: Fix serverless check crash - #​6909

v3.2.337

v3.2.336

Feature

• general: add cortex:skip for suppressions - #​6908

Bug Fix

• terraform: fix CKV_AZURE_136 for replicas - #​6895
• terraform: Fix CKV_AZURE_227 for Azure V4 - #​6906

v3.2.335

v3.2.334

Feature

• serverless: Serverless graph vertices - #​6894

Bug Fix

• secrets: fix indentation to remove duplications - #​6626

v3.2.333

v3.2.332

Feature

• terraform: Add multi skip inline suppression - #​6860
• terraform: New bedrock check - #​6892

Bug Fix

• kubernetes: fix json file parsing - #​6891
• terraform: Fix CKV2_AZURE_31 - #​6893

v3.2.331

v3.2.330

v3.2.329

v3.2.328

Feature

• serverless: Serverless refactor for graph implementation - #​6885

Documentation

• general: docs flags update - #​6888

v3.2.327

Bug Fix

• terraform: Convert to graph check - #​6875

v3.2.326

Feature

• general: add new CIDR operator - #​6877

Bug Fix

• arm: Fix resource ID generation to use variables - #​6884

v3.2.325

v3.2.324

Bug Fix

• terraform_plan: run post_runner after get_enriched_resources for terraform_plan - #​6883

v3.2.322

Feature

• general: Update range includes to handle range values - #​6867

Bug Fix

• general: fix_memory error with adding new env - #​6879
• general: revert comment out ARM test - #​6882

v3.2.321

v3.2.320

Feature

• terraform: Add new checks to match run checks - #​6868

Bug Fix

• arm: Fix arm root folder - #​6880
• terraform: Update CKV_AZURE_164 to correct check on trust policy - #​6757

v3.2.319

v3.2.318

v3.2.317

Feature

• terraform: support resource_type attribute - #​6872

Bug Fix

• arm: Fix arm report resource naming - #​6876
• terraform: Fix two checks and logs - #​6874

v3.2.316

v3.2.315

v3.2.314

Feature

• general: add logs for suppression - #​6873

Bug Fix

• arm: Fix arm resource naming on integration with Prisma - #​6870

v3.2.313

v3.2.312

Bug Fix

• arm: Fix arm graph breadcrumbs - #​6869

v3.2.311

Bug Fix

• cloudformation: Fixed issue where Ref was not rendered correctly if the parameter name was identical to the default value - #​6856
• secrets: fix find line - #​6864
• secrets: masking test format - #​6859
• secrets: multiline matches show the secret and not the first line - #​6854

v3.2.310

v3.2.309

v3.2.308

v3.2.307

Bug Fix

• arm: Change ARM graph creation log lvl to debug - #​6857

v3.2.306

v3.2.305

Feature

• sca: support java full dependency tree scan - #​6834
• terraform: Add check - ensure AWS CodeGuru resource contains CMK - #​6851

Bug Fix

• general: Used jsonpath to update vertex attributes - #​6852
• terraform: Update EKS supported versions - #​6826
• terraform: Update CKV_AZURE_171 to check automatic_upgrade_channel - #​6756

v3.2.304

v3.2.303

v3.2.302

v3.2.301

Bug Fix

• secrets: skip empty match - #​6849

v3.2.300

Feature

• azure: add new policies for Azure Synapse arm - #​6553
• helm: Made helm + kustomize use the Kubernetes graph registry - #​6847
• secrets: Adding check_id to EnrichedSecret class - #​6842
• secrets: Masking secrets files - #​6848

Bug Fix

• secrets: add prerun support for singleline - #​6846
• terraform: Update CKV_AZURE_167 to correct check on retention policy - #​6758

v3.2.299

v3.2.298

v3.2.297

v3.2.296

Feature

• cloudformation: Support Fn::Sub in cases of using a pseudo parameter - #​6835
• terraform: support resource_type attribute - revert - #​6843

Bug Fix

• terraform: CKV_GCP_32 (GoogleComputeBlockProjectSSH) Add other common enabling values - #​6663

v3.2.295

v3.2.294

v3.2.293

Feature

• terraform: support resource_type attribute - #​6830

Bug Fix

• general: fixed mypy issue - #​6838

v3.2.292

v3.2.291

Feature

• general: remove specific botocore version - #​6796

Bug Fix

• arm: fix ARM graph block types - #​6824
• dockerfile: Handle heredoc - #​6828
• sast: filter unsupported policies - #​6833

v3.2.290

v3.2.289

v3.2.288

v3.2.287

Bug Fix

• graph: fix internal checks loading when adding custom policies in cli - #​6819

v3.2.286

Feature

• secrets: Add npm detector - #​6821

Bug Fix

• secrets: fix empty diff scan - #​6822

v3.2.285

v3.2.284

v3.2.283

v3.2.282

Bug Fix

• arm: finish variable rendering and use definitions context - #​6814

v3.2.281

Documentation

• general: Update Python versions and add env vars to the docs - #​6812

v3.2.280

Bug Fix

• arm: add middleware function for platform integration for Arm definitions - #​6811
• secrets: Update CKV_SECRET_4 to duplication list GENERIC_PRIVATE_KEY - #​6810
• terraform: Add opensearch to CKV2_AWS_5 - #​6807

v3.2.279

v3.2.278

Bug Fix

• arm: Align arm definitions function arguments - #​6808

v3.2.277

Bug Fix

• secrets: add detector for IbmCosHmac - #​6790

v3.2.276

Bug Fix

• terraform: Fix possible exception when for_each data has boolean values - #​6733

v3.2.275

Feature

• arm: Add arm definition context - #​6801

Bug Fix

• cloudformation: change parse log level - #​6794
• general: pipenv==2024.0.3 - #​6803
• secrets: omit all secrets value in line - #​6802
• terraform: Security group attached to aws_mskconnect_connector is not recognized - #​6780

v3.2.274

v3.2.273

v3.2.272

v3.2.271

Feature

• sca: add enableDotnetCpm env var to sca scan request - #​6786

v3.2.270

Feature

• arm: add variable and parameters edges and rendering - #​6787
• arm: arm custom policy support - #​6769

v3.2.269

Bug Fix

• terraform: Fix crash when version isn't a float - #​6783

v3.2.268

Feature

• terraform_plan: Support after_unknown evaluation of complex attributes - #​6784

v3.2.267

• no noteworthy changes

v3.2.266

Feature

• arm: unsupported module soft fail - #​6775

v3.2.265

v3.2.264

v3.2.263

v3.2.262

Feature

• terraform: 2 new checks - #​6764
• terraform: Add s3 data transport check - #​6763

Bug Fix

• helm: Remove helm target dir after scanning - #​6767
• kubernetes: Handle non-sting params in command - #​6768

v3.2.261

v3.2.260

v3.2.259

v3.2.258

Bug Fix

• terraform: Set timeout for parsing Terraform files with hcl2. - #​6759

v3.2.257

Bug Fix

• ansible: handle empty tasks - #​6751

v3.2.256

Feature

• terraform: New checks - #​6720

Bug Fix

• general: Fix operator docs - #​6735
• sca: add Pipfile and Pipfile.lock to supported package files list - #​6746
• terraform: extend CKV2_AWS_5 to include DMS Serverless (#​6628) - #​6630
• terraform: Remove dataproc.admin from multiple checks - #​6725
• terraform: Security group attached to an Elastic DocumentDB cluster is not recognized by check CKV2_AWS_5 - #​6687

Documentation

• general: update README.md - #​6719

v3.2.255

v3.2.254

Bug Fix

• terraform: Added ssl_mode attribute support to CKV_GCP_6 - #​6703

v3.2.253

Feature

• general: allow tool name field to be customised using cli arguments - #​6692
• secrets: Change log level - #​6716
• terraform: Add check for local user in storage - #​6715

Bug Fix

• terraform: Update CKV_AZURE_228 for automatic calculation - #​6714

v3.2.252

v3.2.251

Feature

• general: add severity metadata to custom policy - #​6579

v3.2.250

Bug Fix

• secrets: fix suppressions and duplications - #​6710

v3.2.249

Feature

• general: revert packages read permissions - #​6706
• terraform_plan: remove secret - #​6705

Bug Fix

• secrets: fix suppression and duplication - #​6701
• secrets: Revert suppression and duplication - #​6708
• terraform: Fix foreach multi attributes in field - #​6707

v3.2.248

v3.2.247

v3.2.246

Feature

• sast: add log level when running sast in windows - #​6704

v3.2.245

Feature

• kubernetes: Add policy for git-sync code injection - #​6694
• terraform_plan: add support for provider in tf_plan framework - #​6690

v3.2.244

v3.2.243

v3.2.242

Feature

• general: add support for windows 10 for aiohttp - #​6696

v3.2.241

Feature

• sast: remove the env var for Go - #​6697

Bug Fix

• secrets: add edge case for policy that looks like uuid - #​6698

v3.2.240

v3.2.239

Feature

• general: Add multiple checks to match runtime checks - #​6680

v3.2.238

Feature

• terraform: add support for TF cloudsplaining evaluated_keys - #​6677

Bug Fix

• secrets: change logs form info to debug - #​6685

v3.2.237

v3.2.236

• no noteworthy changes

v3.2.235

Feature

• cloudformation: SAM Globals support with CloudFormation - #​6657

v3.2.234

Feature

• sast: Adding support for sast in windows - #​6638

Bug Fix

• secrets: revert duplications suppressions for secrets - #​6674

v3.2.233

v3.2.232

Bug Fix

• general: add try except to loads file - #​6668
• secrets: duplications suppressions for secrets - #​6665

v3.2.231

v3.2.230

Feature

• general: Support multiple frameworks in custom policy - #​6666

Bug Fix

• general: revert support multiple frameworks in one custom policy - #​6664

v3.2.229

v3.2.228

Feature

• terraform: Add build policy to match run policy for API Method without Auth or API - #​6637

Bug Fix

• secrets: remove dups logic - #​6655
• secrets: Revert remove dups - #​6656
• terraform: Don't pass existed resources in non_exists resource checks - #​6653

v3.2.227

v3.2.226

v3.2.225

v3.2.224

v3.2.223

Bug Fix

• secrets: remove duplications in secrets - #​6648
• secrets: revert fixing duplications - #​6652

v3.2.222

v3.2.221

Bug Fix

• terraform: evaluate resource with double underscore - #​6642

v3.2.220

v3.2.219

Feature

• general: support multiple frameworks in one custom policy - #​6587
• terraform: Add run policy for RDS encryption in transit - #​6631

Documentation

• general: Add OpenTofu - #​6627

v3.2.218

v3.2.217

• no noteworthy changes

v3.2.216

Feature

• sast: Verify that all sast policies are parsed correctly - #​6621

Bug Fix

• secrets: fix secrets duplication - #​6619
• secrets: fix secrets duplication - Revert - #​6623

v3.2.215

v3.2.214

v3.2.213

Feature

• arm: ARM AppServiceInstanceMinimum - CKV_AZURE_212 - #​6502
• terraform: - TF and CFN - Add a policy for ensuring AWS Bedrock Agent is encrypted with a CMK - #​6603

Bug Fix

• ansible: Fix CKV2_ANSIBLE_2 - #​6610
• arm: Support upper and lower disabled for CKV_AZURE_189 - #​6609
• dockerfile: Fix edge case with apt in domain - #​6611
• terraform_plan: Fix parsing other types of provisioners - #​6606
• terraform: add condition for CKV_AWS_353 - #​6607
• terraform: catch unknowns with WAF configs - #​6612
• terraform: Handle default for CKV_GCP_76 - #​6608

v3.2.212

v3.2.211

v3.2.210

v3.2.209

Feature

• cloudformation: Enrich cloudsplaining eval keys - #​6602

Documentation

• general: add --repo-id to relevant examples with API key - #​6605

v3.2.208

Feature

• general: filter resource by provider for all resources types - #​6598
• secrets: add CKV_SECRET_192 to GENERIC_PRIVATE_KEY_CHECK_IDS - #​6600
• terraform: Update ckv-aws-8 policy - support unknown statement - #​6596

Bug Fix

• terraform: Fix resource type for CKV_AZURE_242 - #​6599

Platform

• general: handle multiple values for the same metadata filter - #​6604

v3.2.207

v3.2.206

v3.2.205

v3.2.204

Feature

• arm: add CKV_AZURE_191 to ensure that Managed identity provider is enabled for Azure Event Grid Topic - #​6496

Bug Fix

• sast: BCE-36172 fix cdk policies - #​6588

v3.2.203

v3.2.202

v3.2.201

Feature

• terraform: add 14 rules for tencentcloud provider - #​6448

Bug Fix

• secrets: fix secrets prerun bug - #​6594
• terraform: Exclude String in CKV_AWS_337 - #​6592

v3.2.200

v3.2.199

Feature

• arm: add CKV_AZURE_87 to ensure that Azure Defender is set to On for Key Vault - #​6418
• arm: ARM VnetSingleDNSServer - #​6379
• secrets: Adding the option to prerun before multiline pattern executing - #​6586
• secrets: If the prrun regex found but we already scanned file we already scann… - #​6591

v3.2.198

v3.2.197

v3.2.196

Feature

• general: Add metadata exception filter to GHA - #​6583
• general: Refactor all resource type handling in Checkov - #​6572

v3.2.195

v3.2.194

Feature

• arm: AKSEncryptionAtHostEnable - #​6575
• arm: AKSEphemeralOSDisks - #​6578
• arm: CKV_AZURE_92 to Ensure that Virtual Machines use managed disks - #​6455
• arm: FrontDoorWAFACLCVE202144228 - Mitigates the Log4j2 vulnerability CVE-2021-44228. - #​6419

Bug Fix

• general: fix the right numbers in TestSkipJsonRegexPattern - #​6580
• terraform: Fix title of CKV_AZURE_238 - #​6570

v3.2.193

Bug Fix

• terraform: fix failures of no caller on definition context - #​6573
• terraform: TFPlan + TF fixes for google_project_iam_policy + google_iam_policy - #​6577

v3.2.192

v3.2.191

Bug Fix

• general: fix sca unit tests for python 3.12 - #​6574

v3.2.190

• no noteworthy changes

v3.2.189

Feature

• arm: add CKV_AZURE_169 to ensure that AKS use the Paid Sku for its SLA - #​6545
• arm: add CKV_AZURE_177 to ensure that Windows VM enables automatic updates - #​6484
• cloudformation: Update audit_logs valid values - #​6566

v3.2.188

v3.2.187

v3.2.186

Feature

• azure: add new policies for Azure Synapse (tf and arm) - #​6554
• bicep: support bicep custom policy - #​6561

Bug Fix

• arm: CKV_AZURE_56 just for authsettingsV2 name - #​6557
• secrets: filter secrets that have vault: in them - #​6565

v3.2.185

v3.2.184

v3.2.183

Feature

• terraform_plan: support tf_plan after_unknown enrichment - #​6517

Bug Fix

• secrets: small fix for filtering - #​6562

Platform

• general: pass repo ID to runconfig - #​6560

v3.2.182

v3.2.181

v3.2.180

v3.2.179

Feature

• arm: add CKV_AZURE_206 to ensure that Storage Accounts use replication - #​6524
• arm: BCE-33785 Support Azure Synapse Analytics policies - #​6513

v3.2.178

v3.2.177

Bug Fix

• sast: fix cdk policies - #​6552

v3.2.176

v3.2.175

Feature

• arm: AzureSearchSQLQueryUpdates - #​6543

v3.2.174

Feature

• arm: add CKV_AZURE_172 to ensure autorotation of Secrets Store CSI Driver secrets for AKS clusters - #​6533
• arm: add CKV_AZURE_173 to ensure that API management uses at least TLS 1.2 - #​6478
• arm: AppServicePlanZoneRedundant - #​6472
• arm: AzureSearchSLAIndex - #​6530
• arm: SQLDatabaseZoneRedundant - #​6515
• azure: add new policies for Azure Synapse - #​6520
• general: update detect secrets package - #​6535

v3.2.173

v3.2.172

v3.2.171

Feature

• arm: add CKV_AZURE_171 to ensure that AKS cluster upgrade channel is chosen - #​6532
• arm: add CKV_AZURE_175 to ensure that Web PubSub uses a SKU with an SLA - #​6523
• arm: add CKV_AZURE_178 to ensure that linux VM enables SSH with keys for secure communication - #​6486
• arm: add CKV_AZURE_85 to ensure that Azure Defender is set to On for Kubernetes - #​6279
• arm: CKV_AZURE_99 to Ensure Cosmos DB accounts have restricted access - #​6498
• arm: DataFactoryNoPublicNetworkAccess - #​6479
• arm: DataLakeStoreEncryption - #​6516
• arm: EventHubNamespaceMinTLS12 - #​6485

Bug Fix

• openapi: [CKV_OPENAPI_3] Prevent false-positive when checking for http+!basic - #​6406
• terraform_json: support locals block in CDKTF output - #​6452
• terraform: Deprecate CKV2_AWS_67 - #​6529

v3.2.170

v3.2.169

v3.2.168

v3.2.167

v3.2.166

v3.2.165

v3.2.164

Documentation

• general: Add Python note - #​6521

v3.2.163

Feature

• arm: add CKV_AZURE_174 to ensure that API management public access is disabled - #​6480
• arm: AppServicePHPVersion - #​6436
• arm: AppServicePublicAccessDisabled - #​6467
• arm: KeyVaultEnablesPurgeProtection - #​6465
• arm: PubsubSpecifyIdentity - [#​6483](https://re

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.