Update dependency checkov to v3 #22

cloudformation: Fixed issue where Ref was not rendered correctly if the parameter name was identical to the default value - #6856
secrets: fix find line - #6864
secrets: masking test format - #6859
secrets: multiline matches show the secret and not the first line - #6854

`v3.2.310`

`v3.2.309`

`v3.2.308`

`v3.2.307`

Bug Fix

arm: Change ARM graph creation log lvl to debug - #6857

`v3.2.306`

`v3.2.305`

Feature

sca: support java full dependency tree scan - #6834
terraform: Add check - ensure AWS CodeGuru resource contains CMK - #6851

Bug Fix

general: Used jsonpath to update vertex attributes - #6852
terraform: Update EKS supported versions - #6826
terraform: Update CKV_AZURE_171 to check automatic_upgrade_channel - #6756

`v3.2.304`

`v3.2.303`

`v3.2.302`

`v3.2.301`

Bug Fix

secrets: skip empty match - #6849

`v3.2.300`

Feature

azure: add new policies for Azure Synapse arm - #6553
helm: Made helm + kustomize use the Kubernetes graph registry - #6847
secrets: Adding check_id to EnrichedSecret class - #6842
secrets: Masking secrets files - #6848

Bug Fix

secrets: add prerun support for singleline - #6846
terraform: Update CKV_AZURE_167 to correct check on retention policy - #6758

`v3.2.299`

`v3.2.298`

`v3.2.297`

`v3.2.296`

Feature

cloudformation: Support Fn::Sub in cases of using a pseudo parameter - #6835
terraform: support resource_type attribute - revert - #6843

Bug Fix

terraform: CKV_GCP_32 (GoogleComputeBlockProjectSSH) Add other common enabling values - #6663

`v3.2.295`

`v3.2.294`

`v3.2.293`

Feature

terraform: support resource_type attribute - #6830

Bug Fix

general: fixed mypy issue - #6838

`v3.2.292`

`v3.2.291`

Feature

general: remove specific botocore version - #6796

Bug Fix

arm: fix ARM graph block types - #6824
dockerfile: Handle heredoc - #6828
sast: filter unsupported policies - #6833

`v3.2.290`

`v3.2.289`

`v3.2.288`

`v3.2.287`

Bug Fix

graph: fix internal checks loading when adding custom policies in cli - #6819

`v3.2.286`

Feature

secrets: Add npm detector - #6821

Bug Fix

secrets: fix empty diff scan - #6822

`v3.2.285`

`v3.2.284`

`v3.2.283`

`v3.2.282`

Bug Fix

arm: finish variable rendering and use definitions context - #6814

`v3.2.281`

Documentation

general: Update Python versions and add env vars to the docs - #6812

`v3.2.280`

Bug Fix

arm: add middleware function for platform integration for Arm definitions - #6811
secrets: Update CKV_SECRET_4 to duplication list GENERIC_PRIVATE_KEY - #6810
terraform: Add opensearch to CKV2_AWS_5 - #6807

`v3.2.279`

`v3.2.278`

Bug Fix

arm: Align arm definitions function arguments - #6808

`v3.2.277`

Bug Fix

secrets: add detector for IbmCosHmac - #6790

`v3.2.276`

Bug Fix

terraform: Fix possible exception when for_each data has boolean values - #6733

`v3.2.275`

Feature

arm: Add arm definition context - #6801

Bug Fix

cloudformation: change parse log level - #6794
general: pipenv==2024.0.3 - #6803
secrets: omit all secrets value in line - #6802
terraform: Security group attached to aws_mskconnect_connector is not recognized - #6780

`v3.2.274`

`v3.2.273`

`v3.2.272`

`v3.2.271`

Feature

sca: add enableDotnetCpm env var to sca scan request - #6786

`v3.2.270`

Feature

arm: add variable and parameters edges and rendering - #6787
arm: arm custom policy support - #6769

`v3.2.269`

Bug Fix

terraform: Fix crash when version isn't a float - #6783

`v3.2.268`

Feature

terraform_plan: Support after_unknown evaluation of complex attributes - #6784

`v3.2.267`

no noteworthy changes

`v3.2.266`

Feature

arm: unsupported module soft fail - #6775

`v3.2.265`

`v3.2.264`

`v3.2.263`

`v3.2.262`

Feature

terraform: 2 new checks - #6764
terraform: Add s3 data transport check - #6763

Bug Fix

helm: Remove helm target dir after scanning - #6767
kubernetes: Handle non-sting params in command - #6768

`v3.2.261`

`v3.2.260`

`v3.2.259`

`v3.2.258`

Bug Fix

terraform: Set timeout for parsing Terraform files with hcl2. - #6759

`v3.2.257`

Bug Fix

ansible: handle empty tasks - #6751

`v3.2.256`

Feature

terraform: New checks - #6720

Bug Fix

general: Fix operator docs - #6735
sca: add Pipfile and Pipfile.lock to supported package files list - #6746
terraform: extend CKV2_AWS_5 to include DMS Serverless (#6628) - #6630
terraform: Remove dataproc.admin from multiple checks - #6725
terraform: Security group attached to an Elastic DocumentDB cluster is not recognized by check CKV2_AWS_5 - #6687

Documentation

general: update README.md - #6719

`v3.2.255`

`v3.2.254`

Bug Fix

terraform: Added ssl_mode attribute support to CKV_GCP_6 - #6703

`v3.2.253`

Feature

general: allow tool name field to be customised using cli arguments - #6692
secrets: Change log level - #6716
terraform: Add check for local user in storage - #6715

Bug Fix

terraform: Update CKV_AZURE_228 for automatic calculation - #6714

`v3.2.252`

`v3.2.251`

Feature

general: add severity metadata to custom policy - #6579

`v3.2.250`

Bug Fix

secrets: fix suppressions and duplications - #6710

`v3.2.249`

Feature

general: revert packages read permissions - #6706
terraform_plan: remove secret - #6705

Bug Fix

secrets: fix suppression and duplication - #6701
secrets: Revert suppression and duplication - #6708
terraform: Fix foreach multi attributes in field - #6707

`v3.2.248`

`v3.2.247`

`v3.2.246`

Feature

sast: add log level when running sast in windows - #6704

`v3.2.245`

Feature

kubernetes: Add policy for git-sync code injection - #6694
terraform_plan: add support for provider in tf_plan framework - #6690

`v3.2.244`

`v3.2.243`

`v3.2.242`

Feature

general: add support for windows 10 for aiohttp - #6696

`v3.2.241`

Feature

sast: remove the env var for Go - #6697

Bug Fix

secrets: add edge case for policy that looks like uuid - #6698

`v3.2.240`

`v3.2.239`

Feature

general: Add multiple checks to match runtime checks - #6680

`v3.2.238`

Feature

terraform: add support for TF cloudsplaining evaluated_keys - #6677

Bug Fix

secrets: change logs form info to debug - #6685

`v3.2.237`

`v3.2.236`

no noteworthy changes

`v3.2.235`

Feature

cloudformation: SAM Globals support with CloudFormation - #6657

`v3.2.234`

Feature

sast: Adding support for sast in windows - #6638

Bug Fix

secrets: revert duplications suppressions for secrets - #6674

`v3.2.233`

`v3.2.232`

Bug Fix

general: add try except to loads file - #6668
secrets: duplications suppressions for secrets - #6665

`v3.2.231`

`v3.2.230`

Feature

general: Support multiple frameworks in custom policy - #6666

Bug Fix

general: revert support multiple frameworks in one custom policy - #6664

`v3.2.229`

`v3.2.228`

Feature

terraform: Add build policy to match run policy for API Method without Auth or API - #6637

Bug Fix

secrets: remove dups logic - #6655
secrets: Revert remove dups - #6656
terraform: Don't pass existed resources in non_exists resource checks - #6653

`v3.2.227`

`v3.2.226`

`v3.2.225`

`v3.2.224`

`v3.2.223`

Bug Fix

secrets: remove duplications in secrets - #6648
secrets: revert fixing duplications - #6652

`v3.2.222`

`v3.2.221`

Bug Fix

terraform: evaluate resource with double underscore - #6642

`v3.2.220`

`v3.2.219`

Feature

general: support multiple frameworks in one custom policy - #6587
terraform: Add run policy for RDS encryption in transit - #6631

Documentation

general: Add OpenTofu - #6627

`v3.2.218`

`v3.2.217`

no noteworthy changes

`v3.2.216`

Feature

sast: Verify that all sast policies are parsed correctly - #6621

Bug Fix

secrets: fix secrets duplication - #6619
secrets: fix secrets duplication - Revert - #6623

`v3.2.215`

`v3.2.214`

`v3.2.213`

Feature

arm: ARM AppServiceInstanceMinimum - CKV_AZURE_212 - #6502
terraform: - TF and CFN - Add a policy for ensuring AWS Bedrock Agent is encrypted with a CMK - #6603

Bug Fix

ansible: Fix CKV2_ANSIBLE_2 - #6610
arm: Support upper and lower disabled for CKV_AZURE_189 - #6609
dockerfile: Fix edge case with apt in domain - #6611
terraform_plan: Fix parsing other types of provisioners - #6606
terraform: add condition for CKV_AWS_353 - #6607
terraform: catch unknowns with WAF configs - #6612
terraform: Handle default for CKV_GCP_76 - #6608

`v3.2.212`

`v3.2.211`

`v3.2.210`

`v3.2.209`

Feature

cloudformation: Enrich cloudsplaining eval keys - #6602

Documentation

general: add --repo-id to relevant examples with API key - #6605

`v3.2.208`

Feature

general: filter resource by provider for all resources types - #6598
secrets: add CKV_SECRET_192 to GENERIC_PRIVATE_KEY_CHECK_IDS - #6600
terraform: Update ckv-aws-8 policy - support unknown statement - #6596

Bug Fix

terraform: Fix resource type for CKV_AZURE_242 - #6599

Platform

general: handle multiple values for the same metadata filter - #6604

`v3.2.207`

`v3.2.206`

`v3.2.205`

`v3.2.204`

Feature

arm: add CKV_AZURE_191 to ensure that Managed identity provider is enabled for Azure Event Grid Topic - #6496

Bug Fix

sast: BCE-36172 fix cdk policies - #6588

`v3.2.203`

`v3.2.202`

`v3.2.201`

Feature

terraform: add 14 rules for tencentcloud provider - #6448

Bug Fix

secrets: fix secrets prerun bug - #6594
terraform: Exclude String in CKV_AWS_337 - #6592

`v3.2.200`

`v3.2.199`

Feature

arm: add CKV_AZURE_87 to ensure that Azure Defender is set to On for Key Vault - #6418
arm: ARM VnetSingleDNSServer - #6379
secrets: Adding the option to prerun before multiline pattern executing - #6586
secrets: If the prrun regex found but we already scanned file we already scann… - #6591

`v3.2.198`

`v3.2.197`

`v3.2.196`

Feature

general: Add metadata exception filter to GHA - #6583
general: Refactor all resource type handling in Checkov - #6572

`v3.2.195`

`v3.2.194`

Feature

arm: AKSEncryptionAtHostEnable - #6575
arm: AKSEphemeralOSDisks - #6578
arm: CKV_AZURE_92 to Ensure that Virtual Machines use managed disks - #6455
arm: FrontDoorWAFACLCVE202144228 - Mitigates the Log4j2 vulnerability CVE-2021-44228. - #6419

Bug Fix

general: fix the right numbers in TestSkipJsonRegexPattern - #6580
terraform: Fix title of CKV_AZURE_238 - #6570

`v3.2.193`

Bug Fix

terraform: fix failures of no caller on definition context - #6573
terraform: TFPlan + TF fixes for google_project_iam_policy + google_iam_policy - #6577

`v3.2.192`

`v3.2.191`

Bug Fix

general: fix sca unit tests for python 3.12 - #6574

`v3.2.190`

no noteworthy changes

`v3.2.189`

Feature

arm: add CKV_AZURE_169 to ensure that AKS use the Paid Sku for its SLA - #6545
arm: add CKV_AZURE_177 to ensure that Windows VM enables automatic updates - #6484
cloudformation: Update audit_logs valid values - #6566

`v3.2.188`

`v3.2.187`

`v3.2.186`

Feature

azure: add new policies for Azure Synapse (tf and arm) - #6554
bicep: support bicep custom policy - #6561

Bug Fix

arm: CKV_AZURE_56 just for authsettingsV2 name - #6557
secrets: filter secrets that have vault: in them - #6565

`v3.2.185`

`v3.2.184`

`v3.2.183`

Feature

terraform_plan: support tf_plan after_unknown enrichment - #6517

Bug Fix

secrets: small fix for filtering - #6562

Platform

general: pass repo ID to runconfig - #6560

`v3.2.182`

`v3.2.181`

`v3.2.180`

`v3.2.179`

Feature

arm: add CKV_AZURE_206 to ensure that Storage Accounts use replication - #6524
arm: BCE-33785 Support Azure Synapse Analytics policies - #6513

`v3.2.178`

`v3.2.177`

Bug Fix

sast: fix cdk policies - #6552

`v3.2.176`

`v3.2.175`

Feature

arm: AzureSearchSQLQueryUpdates - #6543

`v3.2.174`

Feature

arm: add CKV_AZURE_172 to ensure autorotation of Secrets Store CSI Driver secrets for AKS clusters - #6533
arm: add CKV_AZURE_173 to ensure that API management uses at least TLS 1.2 - #6478
arm: AppServicePlanZoneRedundant - #6472
arm: AzureSearchSLAIndex - #6530
arm: SQLDatabaseZoneRedundant - #6515
azure: add new policies for Azure Synapse - #6520
general: update detect secrets package - #6535

`v3.2.173`

`v3.2.172`

`v3.2.171`

Feature

arm: add CKV_AZURE_171 to ensure that AKS cluster upgrade channel is chosen - #6532
arm: add CKV_AZURE_175 to ensure that Web PubSub uses a SKU with an SLA - #6523
arm: add CKV_AZURE_178 to ensure that linux VM enables SSH with keys for secure communication - #6486
arm: add CKV_AZURE_85 to ensure that Azure Defender is set to On for Kubernetes - #6279
arm: CKV_AZURE_99 to Ensure Cosmos DB accounts have restricted access - #6498
arm: DataFactoryNoPublicNetworkAccess - #6479
arm: DataLakeStoreEncryption - #6516
arm: EventHubNamespaceMinTLS12 - #6485

Bug Fix

openapi: [CKV_OPENAPI_3] Prevent false-positive when checking for http+!basic - #6406
terraform_json: support locals block in CDKTF output - #6452
terraform: Deprecate CKV2_AWS_67 - #6529

`v3.2.170`

`v3.2.169`

`v3.2.168`

`v3.2.167`

`v3.2.166`

`v3.2.165`

`v3.2.164`

Documentation

general: Add Python note - #6521

`v3.2.163`

Feature

arm: add CKV_AZURE_174 to ensure that API management public access is disabled - #6480
arm: AppServicePHPVersion - #6436
arm: AppServicePublicAccessDisabled - #6467
arm: KeyVaultEnablesPurgeProtection - #6465
arm: PubsubSpecifyIdentity - #6483

`v3.2.162`

`v3.2.161`

`v3.2.160`

`v3.2.159`

Bug Fix

arm: fix CKV_AZURE_78: siteConfig object should be under properties - #6477
general: Mypy issues - #6510
terraform: ignore comment out modules - #6507

`v3.2.158`

`v3.2.157`

`v3.2.156`

Feature

arm: add CKV_AZURE_129 Ensure that MariaDB server enables geo-redundant backups - #6427
arm: add CKV_AZURE_137 Ensure ACR admin account is disabled - #6430
arm: add CKV_AZURE_139 Ensure ACR set to disable public networking - #6428
arm: add CKV_AZURE_166 Ensure container image quarantine, scan, and mark images verified - #6431
arm: add CKV_AZURE_168 to ensure that Azure Kubernetes Cluster (AKS) nodes should use a minimum number of 50 pods - #6385
arm: add CKV_AZURE_45 to ensure that no sensitive credentials are exposed in VM custom_data - #6422
arm: add CKV_AZURE_70 to ensure that Function apps is only accessible over HTTPS - #6457
arm: ARM AppServiceSlotDebugDisabled - CKV_AZURE_155 - #6453
arm: ARM AppServiceSlotHTTPSOnly - #6454
arm: ARM VnetLocalDNS - #6424
arm: PostgressSQLGeoBackupEnabled - #6456
arm: StorageAccountName - #6426
secrets: dont filter secrets - #6508

Bug Fix

azure: fix description of CKV_AZURE_236 - #6503
kubernetes: Fix CKV_K8S_31 for CronJobs - #6506
sca: fix parsing json with comments - #6509
terraform: CKV_AWS_339 add Kubernetes 1.30 to AWS EKS version checks - #6353
terraform: remove print from CKV_AWS_364 - #6504

`v3.2.155`

`v3.2.154`

`v3.2.153`

`v3.2.152`

`v3.2.151`

`v3.2.150`

`v3.2.149`

`v3.2.148`

`v3.2.147`

`v3.2.146`

`v3.2.145`

Documentation

general: Note for feature requests - #6497

`v3.2.144`

Bug Fix

kubernetes: ensure seccompProfile is set to RuntimeDefault for all containers in deployments and similar resources - #6459
terraform: Add more conditions for CKV_AWS_70 - #6464

`v3.2.143`

`v3.2.142`

`v3.2.141`

Bug Fix

secrets: dedup secrets history values - #6462

`v3.2.140`

Feature

azure: fix ckv_azure_189 according to docs - #6413

Bug Fix

sca: Support parsing json with comments - #6466

Documentation

general: fix pre-commit link - #6433

`v3.2.139`

`v3.2.138`

Feature

graph: support creation of resource type allow/deny lists - #6451

Bug Fix

terraform: Fix name of CKV2_AWS_67 to be more clear - #6434
terraform: Fix when apt is in rm statement - #6437
terraform: Update CKV_AWS_224 title - #6435

`v3.2.137`

`v3.2.136`

Bug Fix

arm: Correct AzureMLWorkspacePrivateEndpoint rule check logic - #6432
general: removed references Putin references - #6445

`v3.2.135`

`v3.2.134`

`v3.2.133`

Feature

general: add AI_AND_ML to CheckCategories - #6423

Bug Fix

sast: Update CKV IDs for CDK policies - #6415

`v3.2.132`

`v3.2.131`

`v3.2.130`

Feature

arm: add CKV_AZURE_135 to ensure Application Gateway WAF prevents message lookup in Log4j2. - #6364
arm: add CKV_AZURE_140 to ensure that Local Authentication is disabled on CosmosDB - #6329
arm: add CKV_AZURE_163 Enable vulnerability scanning for container images - #6339
arm: add MariaDbPublicAccessDisabled convert policy to arm - #6246
arm: AKSLocalAdminDisabled - [#6334](https://redirect.gi

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate bot force-pushed the renovate/checkov-3.x branch 4 times, most recently from 5ea9214 to 2b25a61 Compare June 23, 2024 22:41

renovate bot force-pushed the renovate/checkov-3.x branch 9 times, most recently from b85bae5 to ef3a72f Compare July 1, 2024 14:28

renovate bot force-pushed the renovate/checkov-3.x branch 10 times, most recently from a84b545 to b2aef53 Compare July 9, 2024 10:27

renovate bot force-pushed the renovate/checkov-3.x branch 7 times, most recently from c376ea5 to 53f3b7d Compare July 14, 2024 11:54

renovate bot force-pushed the renovate/checkov-3.x branch 8 times, most recently from 64c56f4 to b253490 Compare December 3, 2024 11:54

renovate bot force-pushed the renovate/checkov-3.x branch 5 times, most recently from 38dfdf1 to c180fbe Compare December 8, 2024 16:50

renovate bot force-pushed the renovate/checkov-3.x branch 9 times, most recently from 66eaba3 to c4912e7 Compare December 21, 2024 20:11

renovate bot force-pushed the renovate/checkov-3.x branch 3 times, most recently from 2f8b941 to e1218e9 Compare January 6, 2025 11:21

renovate bot force-pushed the renovate/checkov-3.x branch 3 times, most recently from 91379cd to 4e24535 Compare January 9, 2025 13:45

Update dependency checkov to v3

192c65d

renovate bot force-pushed the renovate/checkov-3.x branch from 4e24535 to 192c65d Compare January 15, 2025 11:19

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update dependency checkov to v3 #22

Update dependency checkov to v3 #22

renovate bot commented Jun 17, 2024 •

edited

Loading

Update dependency checkov to v3 #22

Are you sure you want to change the base?

Update dependency checkov to v3 #22

Conversation

renovate bot commented Jun 17, 2024 • edited Loading

Release Notes

Feature

Bug Fix

Feature

Bug Fix

Feature

Bug Fix

Feature

Feature

Bug Fix

Bug Fix

Feature

Bug Fix

Feature

Bug Fix

Feature

Bug Fix

Feature

Bug Fix

Feature

Documentation

Bug Fix

Feature

Bug Fix

Bug Fix

Feature

Bug Fix

Feature

Bug Fix

Feature

Bug Fix

Feature

Bug Fix

Bug Fix

Bug Fix

Bug Fix

Feature

Bug Fix

Bug Fix

Feature

Bug Fix

Feature

Bug Fix

Feature

Bug Fix

Feature

Bug Fix

Bug Fix

Feature

Bug Fix

Bug Fix

Documentation

Bug Fix

Bug Fix

Bug Fix

Bug Fix

Feature

Bug Fix

Feature

renovate bot commented Jun 17, 2024 •

edited

Loading