fix(ci): replace safety scan with pip-audit to fix CI EOF error

Agent-Logs-Url: https://github.com/christianlouis/InboxConverge/sessions/986fc7f4-e884-4169-bd81-eca034e926e2

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

.github/workflows/ci.yml

@@ -150,7 +150,7 @@ jobs:
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install bandit safety
+          pip install bandit pip-audit
           pip install -r backend/requirements.txt
 
       - name: Run Bandit security scan
@@ -158,7 +158,7 @@ jobs:
         continue-on-error: true
 
       - name: Check dependencies for known vulnerabilities
-        run: safety scan --json
+        run: pip-audit -r backend/requirements.txt
         continue-on-error: true
 
   # ── Phase 4: Build ─────────────────────────────────────────────────────

CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 <!-- version list -->
 
+## [Unreleased]
+
+### Fixed
+
+- CI: replaced `safety scan --json` (requires interactive login in Safety CLI v3) with `pip-audit` to fix EOF error in the security scan job
+
 ## v0.4.4 (2026-03-28)
 
 ### Bug Fixes

docs/TODO.md

@@ -5,6 +5,7 @@ Comprehensive task breakdown for repository improvements and production readines
 ## ✅ Recently Completed
 
 - [x] **IMAP: fix all emails appearing empty** — `aioimaplib` stores RFC822 literal data as `bytearray`, not `bytes`. The extraction loop was checking `isinstance(line, bytes)` which returns `False` for `bytearray`, so every email body was silently skipped. Fixed to accept both types and convert to `bytes`. Affected T-Online, GMX, and all IMAP accounts.
+- [x] **CI: fix safety scan EOF error** — replaced `safety scan --json` (Safety CLI v3 requires interactive login) with `pip-audit` (no auth required, maintained by PyPA).
 - [x] **Security: upgrade fastapi/starlette and fix safety CI command** — Upgraded `fastapi` to `0.135.2` (pulls in `starlette>=1.0.0`) fixing 4 DoS CVEs in `starlette<=0.35.1`; replaced deprecated `safety check` with `safety scan`; added `.safety-policy.yml` to suppress unfixable `ecdsa` side-channel CVEs (maintainers won't fix).
 - [x] **IMAP RFC 3501 flag syntax & aioimaplib UID SEARCH fix**: `_fetch_imap_emails`
   now uses a plain `SEARCH UNSEEN` + `FETCH (UID)` to resolve sequence numbers to