What bridgecrewio/checkov shipped
Written by FoxPlug from the repository's own releases; not affiliated with Checkov. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/bridgecrewio/checkov; Checkov did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of November 2, 2026
What shipped
- Release 3.4.2 hardened network and credential handling defaults and added an optional allowlist for external Terraform module download sources. Release
- Release 3.4.3 fixed Terraform userinfo test URLs so they are built dynamically. Release
- The Terraform userinfo fix builds the test URLs dynamically instead of relying on static values. Pull request #7776
- The optional allowlist for external Terraform module download sources was added so those sources can be restricted. Pull request #7758
- Network and credential handling defaults were hardened. Pull request #7701
- Release 3.4.1 merged a branch into another branch. Release
Why it matters
This week delivered two patch releases covering security-related defaults and Terraform module download controls. Users who rely on external Terraform modules can now restrict which sources are allowed, and network and credential defaults are more conservative. A separate patch also fixed how Terraform userinfo test URLs are built.
Changelog entry
- Release 3.4.2: hardened network and credential handling defaults and added an optional allowlist for external Terraform module download sources. Release
- Release 3.4.3: built Terraform userinfo test URLs dynamically. Release
- Terraform: userinfo test URLs are now built dynamically. Pull request #7776
- Terraform: added an optional allowlist for external module download sources. Pull request #7758
- General: hardened network and credential handling defaults. Pull request #7701
New releases: 3.4.2 hardens network and credential handling defaults and adds an optional allowlist for external Terraform module download sources. 3.4.3 fixes Terraform userinfo test URLs to be built dynamically.
Two patch releases are out this week. Release 3.4.2 hardens network and credential handling defaults and adds an optional allowlist for external Terraform module download sources, giving teams a way to restrict where modules are fetched from. Release 3.4.3 fixes a Terraform issue by building userinfo test URLs dynamically. Upgrade to pick up the changes.
Week of October 5, 2026
What shipped
- AWS credential pairs stored as bare delimiter-separated values only surfaced the access key, so the high-entropy scanner never flagged the 40-char secret as CKV_SECRET_6, leaving the AWS validator without a partner. Pull request #7734
- When scanning a Terraform plan, the plan parser resolves
for_eachmodule calls so module configuration blocks are found correctly. Pull request #7723 - --skip-path is documented as a regular expression matched against the path relative to the scanned directory, and
sca_packagenow applies that regex and filters hidden directories throughfilter_ignored_paths. Pull request #7712 - External module references in Terraform are kept inside the directory. Pull request #7721
- For Helm, the source folder should be within the directory. Pull request #7722
- Kustomize file path logic is corrected. Pull request #7720
- Git loader tests for Terraform avoid
tmp_pathso test runs no longer hang. Pull request #7726
Why it matters
This week brought fixes across secrets scanning, Terraform plan parsing, SCA path filtering, Helm, Kustomize and Terraform git loaders. If you scan AWS credentials exported as CSV or delimited values, the secret half of the pair is now flagged so the AWS validator can check it. Terraform plan users get for_each module calls resolved, and SCA users get --skip-path and hidden-dir filtering.
Changelog entry
- Release 3.3.27: Bug Fix secrets: detect paired AWS secret in bare CSV/delimited format - #7734 Release
- Release 3.3.26: Bug Fix
terraform_plan: resolvefor_eachmodule calls in plan parser - #7723 Release - Release 3.3.25: Bug Fix helm: source folder should be within the directory - #7722 kustomize: fix file path logic - #7720 terraform: avoid
tmp_pathin git loader tests - #7726 terraform: external module ref keeps inside directory - #7721 Release - Release 3.3.24: Merge b4fd36e into 768bcb4 … Release
- Release 3.3.23: Bug Fix sca: apply --skip-path regex and hidden-dir filtering to
sca_package- #7712 Release - Fix(secrets): detect paired AWS secret in bare CSV/delimited format Pull request #7734
- Fix(
terraform_plan): resolvefor_eachmodule calls in plan parser Pull request #7723 - Fix(sca): apply --skip-path regex and hidden-dir filtering to
sca_packagePull request #7712 - Fix(terraform): external module ref keeps inside directory Pull request #7721
- Fix(helm): source folder should be within the directory Pull request #7722
- Fix(kustomize): fix file path logic Pull request #7720
- Fix(terraform): avoid
tmp_pathin git loader tests Pull request #7726
This week: AWS credential pairs in bare CSV are now both surfaced, Terraform plan for_each module calls resolve, sca_package applies --skip-path regex and hidden-dir filtering, and Helm, Kustomize and git loader path fixes land.
This week Checkov shipped several fixes. Secrets scanning now detects paired AWS secrets in bare CSV or delimited formats, so when an access key is exported without quotes or prefixes, the 40-char secret is flagged as CKV_SECRET_6 and the AWS validator gets its partner. Terraform plan parsing resolves for_each module calls, so module configuration blocks are found correctly. SCA applies the --skip-path regular expression and hidden-directory filtering to sca_package through filter_ignored_paths. Helm source folders are kept within the directory, Kustomize file path logic is corrected, external Terraform module references stay inside the directory, and Terraform git loader tests avoid tmp_path hangs.
Week of September 14, 2026
What shipped
- Release 3.3.19 adds CKV_AWS_394, a new Terraform check that flags
aws_availability_zonesdata sources when they don't constrain which zones are returned. Release - PR #7687 upgrades parallelism and drain handling in the codebase. Pull request #7687
- PR #7688 fixes secrets detection by disabling spawn mode in frozen environments. Pull request #7688
Why it matters
This week adds a new security check for Terraform configurations and includes performance and reliability improvements. These changes help users catch infrastructure misconfigurations and ensure Checkov runs correctly in constrained environments.
Changelog entry
- Feat(terraform): add CKV_AWS_394 for unconstrained
aws_availability_zonesdata source Release - Chore(general): upgrade parallelism and drain Pull request #7687
- Fix(secrets): disable spawn mode in frozen environment Pull request #7688
Checkov 3.3.19 is out. New check CKV_AWS_394 detects unconstrained aws_availability_zones data sources in Terraform. Plus improvements to parallelism and secrets handling.
Checkov 3.3.19 released with CKV_AWS_394, a new Terraform check that identifies aws_availability_zones data sources without zone constraints—a potential security oversight in infrastructure code. This release also brings parallelism upgrades and a fix for secrets detection in frozen environments, improving both performance and reliability.
More from bridgecrewio/checkov on GitHub
Merged pull requests
- fix(bicep): resolve references within the declaring file (#7794, merged November 10, 2026 by itrocki) (source)
- fix(terraform): build userinfo test URLs dynamically (#7776, merged November 2, 2026 by talazuri) (source)
- fix(terraform): add optional allowlist for external module download sources (#7758, merged November 2, 2026 by talazuri) (source)
- fix(general): harden network and credential handling defaults (#7701, merged November 2, 2026 by talazuri) (source)
- fix(secrets): load platform-provided detectors in spawn-mode secrets … (#7757, merged October 20, 2026 by Saarett) (source)
- fix(terraform): extend MySQL public access check to cover flexible server resources (#7737, merged October 13, 2026 by talazuri) (source)
- fix(terraform): resolve graph edges for count/for_each indexed resource references (#7736, merged October 12, 2026 by talazuri) (source)
- fix(secrets): detect paired AWS secret in bare CSV/delimited format (#7734, merged October 11, 2026 by MaryArmaly) (source)
- fix(
terraform_plan): resolvefor_eachmodule calls in plan parser (#7723, merged October 7, 2026 by omriyoffe-panw) (source) - fix(terraform): avoid
tmp_pathin git loader tests (#7726, merged October 6, 2026 by yuvalmich) (source) - fix(helm): source folder should be within the directory (#7722, merged October 6, 2026 by yuvalmich) (source)
- fix(terraform): external module ref keeps inside directory (#7721, merged October 6, 2026 by yuvalmich) (source)
Releases
- 3.4.3, published November 2, 2026. First change listed: terraform: build userinfo test URLs dynamically - #7776 (source)
- 3.4.2, published November 2, 2026. First change listed: general: harden network and credential handling defaults - #7701 (source)
- 3.4.0, published October 28, 2026. First change listed: no noteworthy changes (source)
- 3.3.30, published October 20, 2026. First change listed: secrets: load platform-provided detectors in spawn-mode secrets … - #7757 (source)
- 3.3.29, published October 13, 2026. First change listed: terraform: extend MySQL public access check to cover flexible server resources - #7737 (source)
- 3.3.28, published October 12, 2026. First change listed: terraform: resolve graph edges for count/foreach indexed resource references - #7736 (source)
From the changelog
- 3.4.3: terraform: build userinfo test URLs dynamically - #7776 (source)
- 3.4.2: general: harden network and credential handling defaults - #7701 (source)
- 3.4.2: terraform: add optional allowlist for external module download sources - #7758 (source)
From the README
- Checkov is a static code analysis tool for infrastructure as code (IaC) and also a software composition analysis (SCA) tool for images and open source packages. (source)
Who ships it
- nimrodkor: 3,032 commits on the default branch (source)
- gruebel: 1,902 commits on the default branch (source)
- JamesWoolfenden: 1,137 commits on the default branch (source)
- actions-user: 764 commits on the default branch (source)
- mikeurbanski1: 714 commits on the default branch (source)
- schosterbarak: 629 commits on the default branch (source)