What bridgecrewio/checkov shipped
Written by FoxPlug from the repository's own releases; not affiliated with Checkov. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/bridgecrewio/checkov; Checkov did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of October 5, 2026
What shipped
- AWS credential pairs stored as bare delimiter-separated values only surfaced the access key, so the high-entropy scanner never flagged the 40-char secret as CKV_SECRET_6, leaving the AWS validator without a partner. Pull request #7734
- When scanning a Terraform plan, the plan parser resolves
for_eachmodule calls so module configuration blocks are found correctly. Pull request #7723 - --skip-path is documented as a regular expression matched against the path relative to the scanned directory, and
sca_packagenow applies that regex and filters hidden directories throughfilter_ignored_paths. Pull request #7712 - External module references in Terraform are kept inside the directory. Pull request #7721
- For Helm, the source folder should be within the directory. Pull request #7722
- Kustomize file path logic is corrected. Pull request #7720
- Git loader tests for Terraform avoid
tmp_pathso test runs no longer hang. Pull request #7726
Why it matters
This week brought fixes across secrets scanning, Terraform plan parsing, SCA path filtering, Helm, Kustomize and Terraform git loaders. If you scan AWS credentials exported as CSV or delimited values, the secret half of the pair is now flagged so the AWS validator can check it. Terraform plan users get for_each module calls resolved, and SCA users get --skip-path and hidden-dir filtering.
Changelog entry
- Release 3.3.27: Bug Fix secrets: detect paired AWS secret in bare CSV/delimited format - #7734 Release
- Release 3.3.26: Bug Fix
terraform_plan: resolvefor_eachmodule calls in plan parser - #7723 Release - Release 3.3.25: Bug Fix helm: source folder should be within the directory - #7722 kustomize: fix file path logic - #7720 terraform: avoid
tmp_pathin git loader tests - #7726 terraform: external module ref keeps inside directory - #7721 Release - Release 3.3.24: Merge b4fd36e into 768bcb4 … Release
- Release 3.3.23: Bug Fix sca: apply --skip-path regex and hidden-dir filtering to
sca_package- #7712 Release - Fix(secrets): detect paired AWS secret in bare CSV/delimited format Pull request #7734
- Fix(
terraform_plan): resolvefor_eachmodule calls in plan parser Pull request #7723 - Fix(sca): apply --skip-path regex and hidden-dir filtering to
sca_packagePull request #7712 - Fix(terraform): external module ref keeps inside directory Pull request #7721
- Fix(helm): source folder should be within the directory Pull request #7722
- Fix(kustomize): fix file path logic Pull request #7720
- Fix(terraform): avoid
tmp_pathin git loader tests Pull request #7726
This week: AWS credential pairs in bare CSV are now both surfaced, Terraform plan for_each module calls resolve, sca_package applies --skip-path regex and hidden-dir filtering, and Helm, Kustomize and git loader path fixes land.
This week Checkov shipped several fixes. Secrets scanning now detects paired AWS secrets in bare CSV or delimited formats, so when an access key is exported without quotes or prefixes, the 40-char secret is flagged as CKV_SECRET_6 and the AWS validator gets its partner. Terraform plan parsing resolves for_each module calls, so module configuration blocks are found correctly. SCA applies the --skip-path regular expression and hidden-directory filtering to sca_package through filter_ignored_paths. Helm source folders are kept within the directory, Kustomize file path logic is corrected, external Terraform module references stay inside the directory, and Terraform git loader tests avoid tmp_path hangs.
Week of September 14, 2026
What shipped
- Release 3.3.19 adds CKV_AWS_394, a new Terraform check that flags
aws_availability_zonesdata sources when they don't constrain which zones are returned. Release - PR #7687 upgrades parallelism and drain handling in the codebase. Pull request #7687
- PR #7688 fixes secrets detection by disabling spawn mode in frozen environments. Pull request #7688
Why it matters
This week adds a new security check for Terraform configurations and includes performance and reliability improvements. These changes help users catch infrastructure misconfigurations and ensure Checkov runs correctly in constrained environments.
Changelog entry
- Feat(terraform): add CKV_AWS_394 for unconstrained
aws_availability_zonesdata source Release - Chore(general): upgrade parallelism and drain Pull request #7687
- Fix(secrets): disable spawn mode in frozen environment Pull request #7688
Checkov 3.3.19 is out. New check CKV_AWS_394 detects unconstrained aws_availability_zones data sources in Terraform. Plus improvements to parallelism and secrets handling.
Checkov 3.3.19 released with CKV_AWS_394, a new Terraform check that identifies aws_availability_zones data sources without zone constraints—a potential security oversight in infrastructure code. This release also brings parallelism upgrades and a fix for secrets detection in frozen environments, improving both performance and reliability.