search

turbot / steampipe-plugin-terraform

Use SQL to instantly query resources, data sources and more from Terraform code. Open source CLI. No DB required.
https://hub.steampipe.io/plugins/turbot/terraform
Apache License 2.0
28 stars 3 forks source link

Bump github.com/Checkmarx/kics from 1.4.9 to 1.7.8 #58

Closed dependabot[bot] closed 1 year ago

dependabot[bot] commented 1 year ago

Bumps github.com/Checkmarx/kics from 1.4.9 to 1.7.8.

Release notes

Sourced from github.com/Checkmarx/kics's releases.

v1.7.8

🚀 New features and improvements

feat(engine): added github workflows scan in Checkmarx/kics#6664 feat(query): unpinned actions full length commit sha in Checkmarx/kics#6698 feat(query): ansible hosts ansible tower exposed to internet in Checkmarx/kics#6691 feat(query): ansible config allow unsafe lookups in Checkmarx/kics#6626 feat(query): ansible playbooks communication over http in Checkmarx/kics#6687 feat(panic): add panic handler to terraform parser by @​liorj-orca in Checkmarx/kics#6726

🐛 Bug fixes

fix(workflows): fixed action's pin in Checkmarx/kics#6689 fix(query): ca certificate identifier is outdated tf aws in Checkmarx/kics#6683 fix(engine): added condition to check if gitignore is not empty to fix unit tests in Checkmarx/kics#6706 fix(query): dockercompose Host Namespace is Shared in Checkmarx/kics#6719 fix(test): e2e name in Checkmarx/kics#6685

📦 Dependency updates bumps

ci(deps): bump golang from 1.20.7-alpine to 1.21.0-alpine in Checkmarx/kics#6623

👻 Maintenance

update(docs): adding github icon into readme and docs website in Checkmarx/kics#6722 update(comments): comments related to files extensions updated in Checkmarx/kics#6696 docs(queries): update queries catalog in Checkmarx/kics#6699

v1.7.7

🚀 New features and improvements

feat(panic): add panic handler to possible panic places in Checkmarx/kics#6527

🐛 Bug fixes

fix(query): query search_key now contains correct value of resource in Checkmarx/kics#6655 fix(workflow): skip apache license workflow if user is a bot in Checkmarx/kics#6657 fix(parser): added condition in convertExpression in Checkmarx/kics#6635 fix(engine): skip broken symlink/eloop by @​liorj-orca in Checkmarx/kics#6665 fix(parser): support nameless tf resources by @​liorj-orca in Checkmarx/kics#6510 fix(query): support GCP IAM policy members as lists by @​Tohar-orca in Checkmarx/kics#6548

👻 Maintenance

update(doc): kics github action version update in Checkmarx/kics#6667 docs(queries): update queries catalog in Checkmarx/kics#6662

v1.7.6

🚀 New features and improvements

feat(query): docdb logging is disabled for pulumi in Checkmarx/kics#6556 feat(query): docdb logging is disabled for crossplane in Checkmarx/kics#6557 feat(query): docdb logging is disabled for cloudformation in Checkmarx/kics#6555 feat(parser): ansible inventory in Checkmarx/kics#6516 feat(query): amazon rds db instance publicly accessible query for pulumi in Checkmarx/kics#6562 feat(query): rds DB Instance Publicly Accessible for Crossplane in Checkmarx/kics#6615 feat(parser): ansible configuration support in Checkmarx/kics#6595 feat(engine): add kics analyze command in Checkmarx/kics#6582

... (truncated)

Changelog

Sourced from github.com/Checkmarx/kics's changelog.

Changes in v1.6.0

Breaking Changes

Processing .gitignore – paths assumed for KICS scan exclusion

From v1.6, KICS will read .gitignore file in the root of the project to exclude from the scan the paths therein.

How does this impact your scans?

  • You will only be affected by this change in case you use KICS locally on your develop environment.
    • Notice that if you are using KICS on top of a repository (e.g., as part of a CI/CD pipeline) those paths already do not exist, so there will be no effect for those scenarios.
  • You’ll notice an apparent loss of results: results identified in files under the .gitignore paths will no more be identified.

Consistency between scan with and without the -t flag

-t or --type flag is used to instruct KICS to scan only files of specific technologies.

Before v1.6, KICS with -t flag would scan the project and, in case there are no files of the specified technologies, it will terminate with a message “No files were scanned” and no other output.

From v1.6, KICS will keep its behavior consistent whether -t flag is used or not. Meaning: it will always output results file, even if it is an “empty” results report is created due to no files being scanned, as shown in the image below.

How does this impact your scans?

  • You will only be affected by this change in case you use KICS with flag -t/--type AND there are no files of the specified “type” in the scanned project.
  • If you rely on the message “No files were scanned” for some post-scan action, this change will also affect you, because that message disappears now.

Masking Secrets – Hide secrets from results when KICS finds them

From v1.6, KICS will mask/hide identified secrets out of results reports, in order to avoid exposing them to undesirable report readers.

How does this impact your scans?

  • This is not likely to impact you in any way.
  • Notice that results of secrets and passwords will appear in a slightly different, but more secure, fashion (see below an example of an HTML report)

... (truncated)

Commits


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
dependabot[bot] commented 1 year ago

Superseded by #68.