chore(build): isolate Checkov 3.3.16 upgrade

[Marcel Bindseil (bindsi)]

Pull Request

IMPORTANT: This is a draft, not a merge-ready dependency update. The newly introduced ecdsa dependency is affected by GHSA-wj6h-64fc-37mp / CVE-2024-23342. No security exception has been added.

Description

Isolated the Checkov upgrade from #794 so the other four Python dependency updates can proceed independently. Updated Checkov from locked version 3.2.531 to 3.3.16, bc-detect-secrets from 1.5.47 to 1.5.50, and added Checkov's ecdsa 0.19.2 dependency.

Related Issue

Relates to #794. No separate issue is linked.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Blueprint modification or addition
• Component modification or addition
• Documentation update
• CI/CD pipeline change
• Other (please describe): isolated security-scanner dependency update

Implementation Details

Changed only root requirements.in and requirements.txt. Retained the existing dependency hashes from the original reviewed Checkov update. Left GitPython, python-hcl2, NumPy, dotenv and all ROS2 requirements unchanged relative to main.

The inspected Checkov consumer performs public-key signature verification, which the advisory explicitly excludes. Exploitable signing behavior has not been demonstrated. The dependency nevertheless fails the repository's security policy; this draft tracks the update without suppressing that policy.

Testing Performed

• Terraform plan/apply
• Blueprint deployment test
• Unit tests
• Integration tests
• Bug fix includes regression test (see Test Policy)
• Manual validation
• Other: Linux x86_64 / Python 3.12 constrained dependency resolution succeeded for 97 packages; git diff --check passed

The original grouped update's package hashes, hash-enforced installation, dependency consistency and Checkov startup were reviewed previously. The independent branch was checked for resolution and exact scope; its security gate is expected to reject ecdsa. No deployment or cloud integration test was run.

Validation Steps

1. Confirm the diff contains only Checkov and its two affected transitive dependencies.
2. Resolve the ecdsa policy blocker through an upstream dependency change. Keep this draft blocked until the advisory is remediated; no exception is proposed.
3. Require passing Dependency Scan, Security Scan and PR Validation Gate on the final head before marking ready or merging.

Checklist

• I have updated the documentation accordingly
• I have added tests to cover my changes
• All new and existing tests passed
• I have run terraform fmt on all Terraform code
• I have run terraform validate on all Terraform code
• I have run az bicep format on all Bicep code
• I have run az bicep build to validate all Bicep code
• I have checked for any sensitive data/tokens that should not be committed
• Lint checks pass (run applicable linters for changed file types)

Security Review

• No credentials, secrets, or tokens are hardcoded or logged
• RBAC and identity changes follow least-privilege principles
• No new network exposure or public endpoints introduced without justification
• Dependency additions or updates have been reviewed for known vulnerabilities
• Container image changes use pinned digests or SHA references

Known blocking advisory: GHSA-wj6h-64fc-37mp. The checked dependency-review item means the advisory was examined, not that it was accepted or remediated.

Additional Notes

Keep this PR in draft. #794 retains GitPython 3.1.61, python-hcl2 8.1.3, NumPy 2.5.2 and python-dotenv 1.2.3 without this Checkov upgrade. No merge is requested for the Checkov-only draft.

Screenshots (if applicable)

Not applicable.

[github-actions]

Dependency Review

The following issues were found:

• ❌ 1 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.

See the Details below.

Vulnerabilities

requirements.txt

Name	Version	Vulnerability	Severity
ecdsa	0.19.2	Minerva timing attack on P-256 in python-ecdsa	high

Only included vulnerabilities with severity high or higher.

OpenSSF Scorecard

Package	Version	Score	Details
pip/ecdsa	0.19.2	🟢 5	Details Check Score Reason Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Security-Policy 🟢 10 security policy file detected Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review 🟢 3 Found 5/15 approved changesets -- score normalized to 3 Packaging ⚠️ -1 packaging workflow not detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing 🟢 10 project is fuzzed License 🟢 9 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST 🟢 8 SAST tool detected but not run on all commits
pip/bc-detect-secrets	1.5.50	Unknown	Unknown
pip/checkov	3.3.16	🟢 7	Details Check Score Reason Maintained 🟢 10 30 commit(s) out of 30 and 7 issue activity out of 30 found in the last 90 days -- score normalized to 10 Code-Review 🟢 3 11 out of last 30 changesets reviewed before merge -- score normalized to 3 Vulnerabilities 🟢 10 no vulnerabilities detected CII-Best-Practices ⚠️ 2 badge detected: in_progress Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches Token-Permissions ⚠️ 0 non read-only tokens detected in GitHub workflows Security-Policy 🟢 10 security policy file detected License 🟢 10 license file detected Dependency-Update-Tool 🟢 10 update tool detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Fuzzing ⚠️ 0 project is not fuzzed SAST 🟢 10 SAST tool is run on all commits Binary-Artifacts 🟢 10 no binaries found in the repo Packaging 🟢 10 publishing workflow detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0

Scanned Files

• requirements.txt