chore(deps): bump checkov from 3.2.531 to 3.3.23 in the pip group across 1 directory

[dependabot]

Bumps the pip group with 1 update in the / directory: checkov.

Updates checkov from 3.2.531 to 3.3.23

Release notes

Sourced from checkov's releases.

3.3.23

Bug Fix

• sca: apply --skip-path regex and hidden-dir filtering to sca_package - #7712

3.3.21

Bug Fix

• terraform_json: handle HCL JSON array and single-dict block formats in parser - #7707

3.3.20

Bug Fix

• terraform_plan: skip resources being removed from state ('forget' action) - #7676

3.3.19

Feature

• terraform: add CKV_AWS_394 for unconstrained aws_availability_zones data source - #7658

3.3.17

Bug Fix

• general: honour scope.provider for platform-downloaded custom po… - #7677

3.3.16

Bug Fix

• terraform: Added current Azure Terraform resources and taggable resources as of hashicorp/azurerm provider version 4.81 - #7652

3.3.15

Bug Fix

• sca: match CVE suppressions case-insensitively - #7659
• sca: match CvesAccounts suppressions on unprefixed account ids - #7660

3.3.13

Bug Fix

• kubernetes: Fix K8S suppressions annotations - #7651

3.3.12

Bug Fix

• sca: correct Windows path handling in image referencer - #7650

3.3.9

Bug Fix

• terraform: handle null container_properties in aws_batch_job_def… - #7636

... (truncated)

Changelog

Sourced from checkov's changelog.

3.3.23 - 2026-10-05

Bug Fix

• sca: apply --skip-path regex and hidden-dir filtering to sca_package - #7712

3.3.21 - 2026-09-30

Bug Fix

• terraform_json: handle HCL JSON array and single-dict block formats in parser - #7707

3.3.20 - 2026-09-27

Bug Fix

• terraform_plan: skip resources being removed from state ('forget' action) - #7676

3.3.19 - 2026-09-17

Feature

• terraform: add CKV_AWS_394 for unconstrained aws_availability_zones data source - #7658

3.3.17 - 2026-09-10

Bug Fix

• general: honour scope.provider for platform-downloaded custom po… - #7677

3.3.16 - 2026-08-30

Bug Fix

• terraform: Added current Azure Terraform resources and taggable resources as of hashicorp/azurerm provider version 4.81 - #7652

3.3.15 - 2026-08-27

Bug Fix

• sca: match CVE suppressions case-insensitively - #7659
• sca: match CvesAccounts suppressions on unprefixed account ids - #7660

3.3.13 - 2026-08-20

Bug Fix

• kubernetes: Fix K8S suppressions annotations - #7651

3.3.12 - 2026-08-19

... (truncated)

Commits

• 06b86ed fix(sca): apply --skip-path regex and hidden-dir filtering to sca_package (#7...
• e7d3dd9 fix(sca): apply --skip-path regex and hidden-dir filtering to sca_package (#7...
• 4ef6eb5 chore(secrets): bump bc-detect-secrets from 1.5.50 to 1.5.52 (#7708)
• d93c9b6 chore(secrets): bump bc-detect-secrets from 1.5.50 to 1.5.52 (#7708)
• 25dfc3a chore: update release notes
• bbe2e10 chore: update release notes
• e8c8dec fix(terraform_json): handle HCL JSON array and single-dict block formats in p...
• 29ba174 chore: update release notes
• d89e8dd fix(terraform_plan): skip resources being removed from state ('forget' action)
• 06ac571 fix(terraform_plan): skip resources being removed from state ('forget' action...
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: pip. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

Dependency Review

The following issues were found:

• ❌ 1 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.

See the Details below.

Vulnerabilities

requirements.txt

Name	Version	Vulnerability	Severity
ecdsa	0.19.2	Minerva timing attack on P-256 in python-ecdsa	high

Only included vulnerabilities with severity high or higher.

OpenSSF Scorecard

Package	Version	Score	Details
pip/ecdsa	0.19.2	🟢 5	Details Check Score Reason Code-Review 🟢 3 Found 5/15 approved changesets -- score normalized to 3 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Security-Policy 🟢 10 security policy file detected Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing 🟢 10 project is fuzzed License 🟢 9 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST 🟢 8 SAST tool detected but not run on all commits
pip/bc-detect-secrets	1.5.52	Unknown	Unknown
pip/checkov	3.3.23	🟢 7	Details Check Score Reason Maintained 🟢 10 30 commit(s) out of 30 and 7 issue activity out of 30 found in the last 90 days -- score normalized to 10 Code-Review 🟢 3 11 out of last 30 changesets reviewed before merge -- score normalized to 3 Vulnerabilities 🟢 10 no vulnerabilities detected CII-Best-Practices ⚠️ 2 badge detected: in_progress Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches Token-Permissions ⚠️ 0 non read-only tokens detected in GitHub workflows Security-Policy 🟢 10 security policy file detected License 🟢 10 license file detected Dependency-Update-Tool 🟢 10 update tool detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Fuzzing ⚠️ 0 project is not fuzzed SAST 🟢 10 SAST tool is run on all commits Binary-Artifacts 🟢 10 no binaries found in the repo Packaging 🟢 10 publishing workflow detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0

Scanned Files

• requirements.txt

[Katrien De Graeve (katriendg)]

We should not merge this in, pull a vulnerable package