Checkov 3.4.0 Release Notes: No Noteworthy Changes — Upgrade Guide for Terraform Scanning

Introduction

Checkov is a static analysis tool for infrastructure as code that scans Terraform, CloudFormation, Kubernetes manifests, and other IaC formats for security and compliance misconfigurations before they reach production. The bridgecrewio/checkov project has published version 3.4.0.

What Is New

The published release notes for Checkov 3.4.0 state explicitly: "no noteworthy changes." There are no documented new checks, flags, deprecations, or breaking changes in this release's notes.

Because the notes don't list concrete feature names, PR numbers, or check IDs, this article will not speculate on internal fixes or rule updates that may have shipped silently (dependency bumps, minor bug fixes, check-rule corrections, etc.). If you rely on specific Checkov behavior (custom policies, suppression comments, or a pinned check ID), review the full diff yourself before trusting any summary:

• Release page: https://github.com/bridgecrewio/checkov/releases/tag/3.4.0

Upgrade Steps

Checkov is typically installed via pip, a container image, or as a wrapper around terraform plan. Treat this as a routine patch bump and validate in CI before rolling out broadly.

If you pin Checkov in a Python requirements file:

pip install checkov==3.4.0

If you use a requirements.txt with a range constraint:

checkov>=3.4.0,<4.0.0

If you run Checkov via Docker in CI:

docker pull bridgecrew/checkov:3.4.0

If Checkov is invoked from a Terraform CI pipeline (GitHub Actions example), bump the action's version input:

- name: Checkov scan
  uses: bridgecrewio/checkov-action@master
  with:
    directory: .
    framework: terraform
    version: 3.4.0

There is no dedicated terraform init -upgrade step here since Checkov is an external scanner, not a Terraform provider or module — it reads your .tf files and plan output independently of the Terraform binary itself.

Verify

Confirm the installed version matches the target release:

checkov --version

Run a scan against an existing Terraform directory to confirm no new failures or crashes were introduced by the upgrade:

checkov -d . --framework terraform --compact

Compare the pass/fail/skip counts against your previous baseline run. If the counts are identical (or differ only due to intentional code changes), the upgrade is safe to merge into your pipeline.

Conclusion

Checkov 3.4.0's release notes report no noteworthy changes, so this is a low-risk, low-effort upgrade. Bump the pinned version in your requirements file, Docker tag, or CI action, re-run your existing Terraform scans to confirm parity, and consult the GitHub release page directly if you need commit-level detail beyond what's documented here.