security: upgrade fastapi to 0.135.2, fix safety scan command, add safety policy for ecdsa CVEs

Agent-Logs-Url: https://github.com/christianlouis/InboxConverge/sessions/902f3b74-792c-4afa-8aae-96611262ee5f

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

.github/workflows/ci.yml

@@ -158,7 +158,7 @@ jobs:
         continue-on-error: true
 
       - name: Check dependencies for known vulnerabilities
-        run: safety check --json
+        run: safety scan --json
         continue-on-error: true
 
   # ── Phase 4: Build ─────────────────────────────────────────────────────

.safety-policy.yml

@@ -0,0 +1,22 @@
+# Safety policy configuration
+# See: https://docs.safetycli.com/safety-docs/safety-policy-file
+
+version: "3.0"
+
+security:
+  ignore-cvss-severity-below: 0
+  ignore-cvss-unknown-severity: false
+  ignore-vulnerabilities:
+    # ecdsa CVE: side-channel / Minerva attack (CVE-64396, CVE-64459)
+    # The ecdsa maintainers have explicitly stated that these vulnerabilities
+    # cannot be fixed in pure Python. ecdsa is a transitive dependency of
+    # python-jose[cryptography], which is used only for JWT token
+    # verification/signing – a context where precise timing side-channels
+    # are not exploitable by remote attackers. The 'cryptography' package
+    # (already installed) handles all sensitive key operations.
+    64396:
+      reason: "ecdsa side-channel (Minerva) — unfixable in pure Python per maintainers; not exploitable in our JWT-signing context"
+      expires: "2027-01-01"
+    64459:
+      reason: "ecdsa side-channel attack — unfixable in pure Python per maintainers; not exploitable in our JWT-signing context"
+      expires: "2027-01-01"

CHANGELOG.md

@@ -7,6 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 <!-- version list -->
 
+## [Unreleased]
+
+### Security
+
+- Upgraded `fastapi` from `0.109.1` to `0.135.2`, pulling in `starlette>=1.0.0` and fixing 4 Denial-of-Service vulnerabilities present in `starlette<=0.35.1`.
+- Updated CI security scan command from deprecated `safety check` to `safety scan`.
+- Added `.safety-policy.yml` to document and suppress the two unfixable `ecdsa` side-channel CVEs (64396, 64459) that the upstream maintainers have acknowledged cannot be resolved in pure Python.
+
 ## v0.4.2 (2026-03-28)
 
 ### Bug Fixes

backend/requirements.txt

@@ -1,5 +1,5 @@
 # Core Framework
-fastapi==0.109.1  # Updated: Fixed ReDoS vulnerability (was 0.109.0)
+fastapi==0.135.2  # Updated: Fixed starlette DoS vulnerabilities (was 0.109.1); pulls in starlette>=1.0.0
 uvicorn[standard]==0.27.0
 pydantic==2.12.5
 pydantic-settings==2.13.1

docs/TODO.md

@@ -4,6 +4,7 @@ Comprehensive task breakdown for repository improvements and production readines
 
 ## ✅ Recently Completed
 
+- [x] **Security: upgrade fastapi/starlette and fix safety CI command** — Upgraded `fastapi` to `0.135.2` (pulls in `starlette>=1.0.0`) fixing 4 DoS CVEs in `starlette<=0.35.1`; replaced deprecated `safety check` with `safety scan`; added `.safety-policy.yml` to suppress unfixable `ecdsa` side-channel CVEs (maintainers won't fix).
 - [x] **CI pipeline fixes**: Added `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true` to `ci.yml` (Node.js 20 deprecation), fixed Codecov `file:` → `files:` invalid input, replaced `<img>` with `<Image />` from `next/image` in `ProviderWizard.tsx` (ESLint no-img-element).
 - [x] **IMAP reliability: switched to UID-based commands** — `_fetch_imap_emails` now uses `UID SEARCH`, `UID FETCH`, and `UID STORE` throughout.  Sequence numbers are volatile (they shift on expunge), causing "Too many invalid IMAP commands" on strict servers (e.g. T-Online).  UIDs are stable.  The per-message `STORE +FLAGS \Seen` (redundant — RFC822 sets it implicitly) and per-message `STORE +FLAGS \Deleted` are replaced with single batch commands.  Stale already-seen UIDs are re-marked `\Seen` in one command.  Logout is now in a `finally` block so a mid-session `BYE` is handled gracefully.
 - [x] Fixed timezone display bug in Mailbox Activity and Admin Logs pages: ISO timestamps without a `Z` suffix were parsed as local time by JavaScript, shifting "Xm ago" / "Xh ago" displays and absolute dates by the client's UTC offset.