Merge pull request #118 from christianlouis/copilot/upgrade-fastapi-starlette

security: fix safety CI failures — upgrade starlette, fix deprecated scan command, suppress unfixable ecdsa CVEs

.github/workflows/ci.yml

@@ -158,7 +158,7 @@ jobs:
         continue-on-error: true
 
       - name: Check dependencies for known vulnerabilities
-        run: safety check --json
+        run: safety scan --json
         continue-on-error: true
 
   # ── Phase 4: Build ─────────────────────────────────────────────────────

.safety-policy.yml

@@ -0,0 +1,22 @@
+# Safety policy configuration
+# See: https://docs.safetycli.com/safety-docs/safety-policy-file
+
+version: "3.0"
+
+security:
+  ignore-cvss-severity-below: 0
+  ignore-cvss-unknown-severity: false
+  ignore-vulnerabilities:
+    # ecdsa CVE: side-channel / Minerva attack (CVE-64396, CVE-64459)
+    # The ecdsa maintainers have explicitly stated that these vulnerabilities
+    # cannot be fixed in pure Python. ecdsa is a transitive dependency of
+    # python-jose[cryptography], which is used only for JWT token
+    # verification/signing – a context where precise timing side-channels
+    # are not exploitable by remote attackers. The 'cryptography' package
+    # (already installed) handles all sensitive key operations.
+    64396:
+      reason: "ecdsa side-channel (Minerva) — unfixable in pure Python per maintainers; not exploitable in our JWT-signing context"
+      expires: "2027-01-01"
+    64459:
+      reason: "ecdsa side-channel attack — unfixable in pure Python per maintainers; not exploitable in our JWT-signing context"
+      expires: "2027-01-01"

CHANGELOG.md

@@ -9,6 +9,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Security
+
+- Upgraded `fastapi` from `0.109.1` to `0.135.2`, pulling in `starlette>=1.0.0` and fixing 4 Denial-of-Service vulnerabilities present in `starlette<=0.35.1`.
+- Updated CI security scan command from deprecated `safety check` to `safety scan`.
+- Added `.safety-policy.yml` to document and suppress the two unfixable `ecdsa` side-channel CVEs (64396, 64459) that the upstream maintainers have acknowledged cannot be resolved in pure Python.
 ### Fixed
 
 - **IMAP: fix T-Online BYE "Too many invalid IMAP commands"** — `UID STORE` flag

backend/requirements.txt

@@ -1,5 +1,5 @@
 # Core Framework
-fastapi==0.109.1  # Updated: Fixed ReDoS vulnerability (was 0.109.0)
+fastapi==0.135.2  # Updated: Fixed starlette DoS vulnerabilities (was 0.109.1); pulls in starlette>=1.0.0
 uvicorn[standard]==0.27.0
 pydantic==2.12.5
 pydantic-settings==2.13.1

docs/TODO.md

@@ -4,6 +4,7 @@ Comprehensive task breakdown for repository improvements and production readines
 
 ## ✅ Recently Completed
 
+- [x] **Security: upgrade fastapi/starlette and fix safety CI command** — Upgraded `fastapi` to `0.135.2` (pulls in `starlette>=1.0.0`) fixing 4 DoS CVEs in `starlette<=0.35.1`; replaced deprecated `safety check` with `safety scan`; added `.safety-policy.yml` to suppress unfixable `ecdsa` side-channel CVEs (maintainers won't fix).
 - [x] **IMAP RFC 3501 flag syntax & aioimaplib UID SEARCH fix**: `_fetch_imap_emails`
   now uses a plain `SEARCH UNSEEN` + `FETCH (UID)` to resolve sequence numbers to
   stable UIDs (aioimaplib blocks `uid("search")`), and wraps all flag names in