Add OSV-Scanner security gate + clear all CVEs (Python floor to 3.10)

[vikrantpuppala]

Summary

This PR adds the OSV-Scanner security gate and clears all open dependency CVEs on the connector — without forcing any dependency-pin changes on consumers. The only breaking change is raising the Python floor to 3.10, which is required because the CVE-fixed cryptography and pyjwt releases are not installable on 3.8/3.9.

What it does

1. OSV-Scanner security workflow (securityScan.yml), hardened fail-closed

• Single workflow, three triggers: PR (fail on CVSS ≥ 7 or any unscored finding), weekly cron, and manual — reading poetry.lock natively.
• Ported the fail-closed hardening from the Go (databricks/databricks-sql-go#362) and Node (databricks/databricks-sql-nodejs#388) driver gates:
  • Capture osv-scanner's exit code; tolerate only 0/1 and fail closed on any other code (network error, corrupt binary) instead of masking with || true.
  • Validate the output is well-formed JSON with a .results array before parsing (partial/corrupt scan → fail closed, not "0 findings").
  • Resolve empty group max_severity via a cvss_num fallback to an UNKNOWN sentinel (using try (x|tonumber) catch null, not tonumber?) so a scoreless finding can never sort to 0 and sail past the gate. UNKNOWN always blocks.
  • Integer-count guards fail closed on parse failure.
  • Per-repo SMTP email dropped in favor of artifact upload for the planned cross-repo collator (parity with Go/Node).

2. Clears all CVEs by refreshing poetry.lock — no forced pin changes

• Every runtime dependency pin is unchanged (thrift ~=0.22.0, urllib3 >=1.26, requests ^2.18.1, pyjwt ^2.0.0, pyarrow floors). The existing constraints already allow the CVE-free versions; the refreshed lock simply resolves to them: urllib3 2.7.0, cryptography 49.0.0, pyarrow 23.0.1, requests 2.34.2, pyjwt 2.13.0, idna 3.18, python-dotenv 1.2.2.
• Consumers do not need us to relax or raise any pin to become CVE-free — they only need Python ≥ 3.10 (their environment, not our constraint).

3. Raises the Python floor to ^3.10 (the only breaking change)

• The fixed cryptography (≥46) and pyjwt (≥2.12) require Python ≥3.10 upstream, so a single CVE-clean lockfile cannot span 3.8/3.9. Both are long past EOL (3.8 EOL 2024-10, 3.9 EOL 2025-10) and no supported DBR LTS is affected. CI matrices updated to drop 3.9; Requires-Python fails safe for anyone still on 3.9 (they stay on 4.3.x).

4. thrift stays ~=0.22.0, documented accurately

• thrift 0.22.0 is affected by open Apache Thrift advisories (CVE-2025-48431 + the CVE-2026-41602..41636 set), but all are in non-Python bindings (Node.js / Go / c_glib / Java / Swift — verified against the upstream advisories), so the Python lib/py code we ship is not affected. The only fix (0.23.0) is the version that caused the SEV0 ES-1960554 DBR-LTS install break, so we cannot take it until a build-safe thrift ships (THRIFT-6067).
• These advisories are invisible to OSV-Scanner and Dependabot (both match by PyPI purl, but these CVEs are filed only against the upstream CPE cpe:2.3:a:apache:thrift with no package coordinate). A supplementary weekly NVD-CPE thrift watch in the workflow surfaces them and hard-fails if a Python-affecting thrift CVE ever appears. Scoped to thrift alone because an audit of all three drivers' full dependency sets found thrift is the only dep with this purl-vs-CPE gap.

5. Dev-tool + test fixes surfaced by the refresh

• Bump dev-only black ^22 → ^26 and pytest ^7 → ^9 to clear their advisories (never shipped in the wheel); reformat src with black 26.
• Fix 2 mypy errors surfaced by the newer mypy (auth/oauth.py, auth/retry.py) — type-annotation-only.
• Declare pytz as an explicit dev dependency (pandas 3.0 dropped it as a required dep; test_parameters.py imports it directly).

Result

• OSV-Scanner v2.3.8: 0 findings on the refreshed lock; osv-scanner.toml needs no suppressions.
• black --check passes; mypy passes; the Python matrix (3.10–3.14) is green.

Test plan

• OSV-Scanner v2.3.8 run locally against the refreshed poetry.lock → 0 findings, 0 blocking.
• Hardening verified against synthetic OSV JSON (scanner-error, partial-JSON, empty-severity, scoreless-UNKNOWN all fail closed).
• black --check src passes with black 26.5.1.
• mypy src passes (2 pre-existing latent errors fixed).
• Thrift NVD-CPE watch tested against live NVD (finds the CPE-only advisories, correctly flags 0 as Python-affecting).
• Verified all 3 drivers audited for the purl-vs-CPE gap: thrift is the only affected dep; Go/Node already ship the fixed thrift 0.23.0.

This pull request and its description were written by Isaac.

[peco-review-bot]

Verdict: 1 Medium · 1 Low

Solid, well-documented security gate; the fail-closed logic (exit-code classification, JSON validation, integer-count guards, UNKNOWN-always-blocks) is sound. Two non-blocking items: the scanner binary is executed without checksum verification (medium — it's the gate's root of trust and the rest of the workflow SHA-pins its actions), and the findings sort mis-places always-blocking UNKNOWN entries (low, display-only). The poetry.lock refresh and Python-floor bump to 3.10 look internally consistent with the CI matrix changes.