What bridgecrewio/checkov shipped
Written by FoxPlug from public releases; not affiliated with Checkov. An automatic summary of the public release, pull request and commit data of github.com/bridgecrewio/checkov. Checkov did not write it and does not use or endorse FoxPlug. Every line links to the public change it describes.
Get a weekly update like this for your product, free
Week of September 14, 2026
What shipped
- Release 3.3.19 adds CKV_AWS_394, a new Terraform check that flags
aws_availability_zonesdata sources when they don't constrain which zones are returned. Release - PR #7687 upgrades parallelism and drain handling in the codebase. Pull request #7687
- PR #7688 fixes secrets detection by disabling spawn mode in frozen environments. Pull request #7688
Why it matters
This week adds a new security check for Terraform configurations and includes performance and reliability improvements. These changes help users catch infrastructure misconfigurations and ensure Checkov runs correctly in constrained environments.
Changelog entry
- feat(terraform): add CKV_AWS_394 for unconstrained
aws_availability_zonesdata source Release - chore(general): upgrade parallelism and drain Pull request #7687
- fix(secrets): disable spawn mode in frozen environment Pull request #7688
Checkov 3.3.19 is out. New check CKV_AWS_394 detects unconstrained aws_availability_zones data sources in Terraform. Plus improvements to parallelism and secrets handling.
Checkov 3.3.19 released with CKV_AWS_394, a new Terraform check that identifies aws_availability_zones data sources without zone constraints—a potential security oversight in infrastructure code. This release also brings parallelism upgrades and a fix for secrets detection in frozen environments, improving both performance and reliability.