What bridgecrewio/checkov shipped
Generated by FoxPlug from public activity — not affiliated with Checkov.
Week of September 14, 2026
What shipped
- Release 3.3.19 adds CKV_AWS_394, a new Terraform check that flags aws_availability_zones data sources when they don't constrain which zones are returned. Release
- PR #7687 upgrades parallelism and drain handling in the codebase. Pull request #7687
- PR #7688 fixes secrets detection by disabling spawn mode in frozen environments. Pull request #7688
Why it matters
This week adds a new security check for Terraform configurations and includes performance and reliability improvements. These changes help users catch infrastructure misconfigurations and ensure Checkov runs correctly in constrained environments.
Changelog entry
- feat(terraform): add CKV_AWS_394 for unconstrained aws_availability_zones data source Release
- chore(general): upgrade parallelism and drain Pull request #7687
- fix(secrets): disable spawn mode in frozen environment Pull request #7688
Checkov 3.3.19 is out. New check CKV_AWS_394 detects unconstrained aws_availability_zones data sources in Terraform. Plus improvements to parallelism and secrets handling.
Checkov 3.3.19 released with CKV_AWS_394, a new Terraform check that identifies aws_availability_zones data sources without zone constraints—a potential security oversight in infrastructure code. This release also brings parallelism upgrades and a fix for secrets detection in frozen environments, improving both performance and reliability.