chore(deps): update dependency checkov to v3.3.8

[renovate]

This PR contains the following updates:

Package	Update	Change	OpenSSF
checkov	minor	==3.2.510 → ==3.3.8

---

Release Notes

bridgecrewio/checkov (checkov)

v3.3.8

Bug Fix

• kubernetes: CKV_K8S_40 should pass when hostUsers is false - #​7580

v3.3.7

Feature

• general: fix github only output for sca - #​7598

v3.3.6

Bug Fix

• terraform: prevent crash in S3AllowsAnyPrincipal with unparsed v… - #​7581

v3.3.5

Feature

• general: fix danger node version - #​7589

Bug Fix

• general: retry kustomize/helm install to survive transient GitHub failures - #​7591
• terraform: CKV_AZURE_190 override singular get_expected_value - #​7592

v3.3.4

v3.3.3

v3.3.2

Bug Fix

• terraform_plan: handle computed log_bucket in CKV_GCP_62 and CKV_GCP_63 - #​7582
• terraform: pass CKV_GCP_123 when remove_default_node_pool is true - #​7575

v3.3.1

Compare Source

Feature

• serverless: disable vars opt out - #​7574

v3.3.0

Compare Source

• no noteworthy changes

v3.2.533

Compare Source

Bug Fix

• general: increase domain allow list as it blocks prisma release - #​7567
• sca: Kustomize and Helm improvements - #​7568
• terraform: pin security-group module to 5.3.1 in linked-module test - #​7570

v3.2.532

Compare Source

Feature

• general: verify ECDSA-P256 signatures on external custom checks before loading - #​7556

v3.2.531

Compare Source

Feature

• terraform: add CKV_AWS_393 for GitHub OIDC trust on aws_iam_role - #​7561

v3.2.530

Compare Source

Bug Fix

• serverless: disable env/file variable resolution by default - #​7554

v3.2.529

Compare Source

Bug Fix

• terraform: include 90-day boundary in rotation check CKV_AWS_304 - #​7544

v3.2.528

Compare Source

Bug Fix

• secrets: report all multiline regex matches per file, not just first occurrence - FIX - #​7540

v3.2.527

Compare Source

Feature

• secrets: Revert "fix(secrets): report all multiline regex matches per file, not just first occurrence" - #​7537

v3.2.526

Compare Source

Bug Fix

• helm: Accept helm version greater than v3 - #​7399

v3.2.525

Compare Source

Bug Fix

• terraform: fix wrong windows path - #​7529

v3.2.524

Compare Source

Bug Fix

• general: Revert Switch Terraform regex eval to RE2 for better performance - #​7520
• sca: Align ImageScanner.run_image_scan with execute_scan - #​7518

v3.2.523

Compare Source

v3.2.522

Compare Source

Bug Fix

• general: Strip unnecessary control bytes from CLI code block - #​7515
• general: Switch Terraform regex eval to RE2 for better performance - #​7516

v3.2.521

Compare Source

Bug Fix

• general: make version cache init lazy - #​7509
• secrets: report all multiline regex matches per file, not just first occurrence - #​7483

v3.2.520

Compare Source

v3.2.519

Compare Source

Bug Fix

• terraform: add aws:VpceAccount to recognized condition keys in check CKV_AWS_70 - #​7514
• terraform: Fix crash in GoogleKMSKeyIsPublic in membership check for unhashable types - #​7440

v3.2.518

Compare Source

v3.2.517

Compare Source

Bug Fix

• general: add domain allowlist validation for Prisma Cloud and Bridgecrew API URLs - #​7496
• terraform: Harden tar and zip extraction - #​7497

v3.2.516

Compare Source

v3.2.515

Compare Source

v3.2.514

Compare Source

v3.2.513

Compare Source

Bug Fix

• general: Log update - #​7482

v3.2.512

Compare Source

v3.2.511

Compare Source

Bug Fix

• general: Prevent run failure invalid policy - #​7476

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[jina-simulation]

Content removed.