Add OWASP suppression for CVE-2026-25087 and re-enable dependency check in release (#1296)

## Summary
- Added `owasp-suppressions.xml` to suppress CVE-2026-25087 (Apache
Arrow C++ only, false positive for Java Arrow libraries)
- Referenced suppression file in `jdbc-core/pom.xml` OWASP plugin config
- Re-enabled the OWASP dependency check in the release build step
(replaces `-Ddependency-check.skip=true` from #1286) and passes NVD API
key for fast NVD updates

Previously #1286 skipped the OWASP check entirely in the build step as a
quick fix for the v3.3.1 release. This PR restores the check with proper
suppression so real vulnerabilities are still caught during releases.

## Test plan
- [ ] Verify CI passes with the suppression file
- [ ] Verify the OWASP check runs during the release build step without
failing on Arrow CVE

NO_CHANGELOG=true

OVERRIDE_FREEZE=true

This pull request was AI-assisted by Isaac.

Signed-off-by: Madhavendra Rathore <madhavendra.rathore@databricks.com>

Author: msrathore-db

.github/workflows/release-thin.yml

@@ -51,7 +51,9 @@ jobs:
       - name: Build dependencies
         run: |
           mvn -Prelease clean install --batch-mode -pl jdbc-core -am -Dgpg.skip=true \
-            -Ddependency-check.skip=true
+            -Dnvd.api.key=${{ secrets.NVD_API_KEY }} \
+            -Dossindex.username=${{ secrets.OSSINDEX_USERNAME }} \
+            -Dossindex.password=${{ secrets.OSSINDEX_PASSWORD }}
 
       # Step 2: Deploy only the thin JAR module to Maven Central
       # We don't use -am here to avoid the central-publishing-maven-plugin

.github/workflows/release.yml

@@ -36,7 +36,9 @@ jobs:
       - name: Build dependencies
         run: |
           mvn -Prelease clean install --batch-mode -pl jdbc-core -am -Dgpg.skip=true \
-            -Ddependency-check.skip=true
+            -Dnvd.api.key=${{ secrets.NVD_API_KEY }} \
+            -Dossindex.username=${{ secrets.OSSINDEX_USERNAME }} \
+            -Dossindex.password=${{ secrets.OSSINDEX_PASSWORD }}
 
       # Step 2: Deploy only the uber JAR module to Maven Central
       # We don't use -am here to avoid the central-publishing-maven-plugin

jdbc-core/pom.xml

@@ -355,6 +355,9 @@
               This helps us identify and address significant security risks early in the development process.
            -->
           <failBuildOnCVSS>7</failBuildOnCVSS>
+          <suppressionFiles>
+            <suppressionFile>${project.basedir}/../owasp-suppressions.xml</suppressionFile>
+          </suppressionFiles>
           <nvdApiKey>${nvd.api.key}</nvdApiKey>
           <nvdMaxRetryCount>10</nvdMaxRetryCount>
           <nvdApiDelay>4000</nvdApiDelay>

owasp-suppressions.xml

@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
+    <!--
+      CVE-2026-25087 is a Use After Free vulnerability in the Apache Arrow C++ IPC
+      file reader when pre-buffering is enabled with variadic buffers.
+      It does NOT affect the Java Arrow libraries (arrow-memory-core, arrow-vector, etc.)
+      which are pure Java with no native code. The OWASP scanner falsely matches because
+      both share the "apache:arrow" CPE namespace.
+      See: https://nvd.nist.gov/vuln/detail/CVE-2026-25087
+    -->
+    <suppress>
+        <notes><![CDATA[
+            CVE-2026-25087 affects Apache Arrow C++ only, not Java.
+            False positive due to CPE matching on the shared "apache:arrow" namespace.
+        ]]></notes>
+        <packageUrl regex="true">^pkg:maven/org\.apache\.arrow/.*$</packageUrl>
+        <cve>CVE-2026-25087</cve>
+    </suppress>
+</suppressions>