ci: Fix JDK 25 and OWASP CI failures for v0.6.0 release

[phillipleblanc]

Changes

Fixes CI failures blocking the v0.6.0 release.

1. Fix JDK 25 test failures (NoClassDefFoundError: RootAllocator)

Root cause: JDK 25 disables sun.misc.Unsafe memory-access methods by default (JEP 471). Arrow's NettyAllocationManager static initializer calls through PooledByteBufAllocatorL → UnsafeDirectLittleEndian → EmptyByteBuf.memoryAddress(), which throws UnsupportedOperationException when Netty cannot use Unsafe for off-heap buffers.

Fix: Add --sun-misc-unsafe-memory-access=allow JVM flag conditionally for JDK 23+ in CI. Uses a ${extraArgLine} Maven property in the surefire <argLine> so the flag is only passed when needed (it crashes the JVM on JDK < 23). Also adds --add-opens=java.base/jdk.internal.misc=ALL-UNNAMED for Netty's PlatformDependent Unsafe access.

2. Suppress CVE-2026-25087 in OWASP Dependency-Check

Root cause: CVE-2026-25087 (CVSS 7.0) is flagged against Apache Arrow itself (arrow-memory-core, flight-core, flight-sql, flight-sql-jdbc-core). Arrow 19.0.0 is the latest release — no upstream fix is available.

Fix: Add owasp-suppressions.xml with a documented suppression entry, wired into the dependency-check-maven plugin config via <suppressionFile>. Includes notes to remove the suppression once Arrow publishes a patched version.

3. Make OWASP Dependency-Check resilient to NVD API failures

Root cause: The NVD API is unreliable — returning 429 rate limits, and without a valid API key it attempts to download all 340K+ NVD records, exceeding the 30-minute job timeout.

Fix:

• continue-on-error: true on the workflow step so NVD infrastructure issues don't block CI
• <failOnError>false</failOnError> in the Maven plugin config so analysis errors (corrupted DB, connection failures) don't fail the build
• Explicit -DnvdApiKey="$NVD_API_KEY" passthrough in case the environment variable isn't picked up automatically

[Copilot]

Pull request overview

This PR unblocks the v0.6.0 release by addressing CI failures related to JDK 25 incompatibility with Apache Arrow and an OWASP Dependency-Check finding affecting Arrow artifacts.

Changes:

• Wire an OWASP Dependency-Check suppression file into the Maven plugin configuration.
• Add a suppression entry for CVE-2026-25087.
• Disable JDK 25 from the GitHub Actions build matrix with a note to re-enable later.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
pom.xml	Configures dependency-check-maven to use a suppression file during CVE scanning.
owasp-suppressions.xml	Adds a documented suppression for CVE-2026-25087.
.github/workflows/build.yaml	Comments out JDK 25 in the CI matrix due to Arrow/JDK compatibility.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.