fix(deps): consolidate vulnerable package remediation

.github/dependency-review-config.yml

@@ -0,0 +1,8 @@
+---
+fail-on-severity: high
+# ecdsa Minerva timing attack (P-256); no upstream fix, transitive via checkov.
+# Re-evaluate when checkov drops the ecdsa dependency.
+allow-ghsas:
+  - GHSA-wj6h-64fc-37mp
+warn-on-openssf-scorecard-level: 3
+comment-summary-in-pr: on-failure

.github/workflows/pr-validation.yml

@@ -96,12 +96,7 @@ jobs:
       - name: Dependency Review
         uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
         with:
-          fail-on-severity: high
-          # ecdsa Minerva timing attack (P-256); no upstream fix, transitive via checkov.
-          # Re-evaluate when checkov drops the ecdsa dependency. See issue #641.
-          allow-ghsas: GHSA-wj6h-64fc-37mp
-          warn-on-openssf-scorecard-level: 3
-          comment-summary-in-pr: on-failure
+          config-file: ./.github/dependency-review-config.yml
 
   # Shell script linting
   shell-lint:

.grype.yaml

@@ -65,3 +65,12 @@ ignore:
   # inflate error (exit 16). Upstream grype bug; remove when upgrading past 0.86.1
   # with the fix included.
   - vulnerability: GHSA-rp8m-h266-53jh
+
+  # ecdsa 0.19.2 - HIGH severity, no upstream fix
+  # Justification: Minerva timing attack (CVE-2024-23342 / GHSA-wj6h-64fc-37mp, P-256).
+  # Pure-Python, transitive via checkov; not exploitable in CI/scan usage.
+  # Re-evaluate when checkov drops the ecdsa dependency.
+  - vulnerability: GHSA-wj6h-64fc-37mp
+    package:
+      name: ecdsa
+      type: python

osv-scanner.toml

@@ -20,3 +20,7 @@ reason = "rustls-pemfile 1.x: unmaintained; transitive via hyper-rustls. Resolve
 [[IgnoredVulns]]
 id = "RUSTSEC-2026-0097"
 reason = "rand: unsoundness with custom logger; awaiting upstream release."
+
+[[IgnoredVulns]]
+id = "GHSA-wj6h-64fc-37mp"
+reason = "ecdsa: Minerva timing attack (CVE-2024-23342), P-256; no upstream fix. Transitive via checkov. Re-evaluate when checkov drops the ecdsa dependency."

requirements.in

@@ -6,7 +6,7 @@ python-hcl2~=8.1.2               # HCL2 (Terraform) configuration parser
 jinja2~=3.1.6                    # Template engine for configuration generation
 
 # Security and Compliance Scanning
-checkov~=3.2.529                   # Infrastructure security and compliance scanner
+checkov~=3.3.6                   # Infrastructure security and compliance scanner
 
 # Security-Critical Dependencies (Version Pinned for CVE Remediation)
 asteval>=1.0.6                   # Safe mathematical expression evaluator