From 61d525cb82bc22e790c4775e905ceff9ef0c56ef Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 28 Mar 2026 23:03:11 +0000
Subject: [PATCH 1/2] Initial plan


From 8152635238ab4167dc3c63b31b4d54d85ace76a2 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 28 Mar 2026 23:04:23 +0000
Subject: [PATCH 2/2] fix(ci): replace safety scan with pip-audit to fix CI EOF
 error

Agent-Logs-Url: https://github.com/christianlouis/InboxConverge/sessions/986fc7f4-e884-4169-bd81-eca034e926e2

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
---
 .github/workflows/ci.yml | 4 ++--
 CHANGELOG.md             | 6 ++++++
 docs/TODO.md             | 1 +
 3 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b60103b..b193207 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -150,7 +150,7 @@ jobs:
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install bandit safety
+          pip install bandit pip-audit
           pip install -r backend/requirements.txt
 
       - name: Run Bandit security scan
@@ -158,7 +158,7 @@ jobs:
         continue-on-error: true
 
       - name: Check dependencies for known vulnerabilities
-        run: safety scan --json
+        run: pip-audit -r backend/requirements.txt
         continue-on-error: true
 
   # ── Phase 4: Build ─────────────────────────────────────────────────────
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 086b353..7fb1722 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 <!-- version list -->
 
+## [Unreleased]
+
+### Fixed
+
+- CI: replaced `safety scan --json` (requires interactive login in Safety CLI v3) with `pip-audit` to fix EOF error in the security scan job
+
 ## v0.4.4 (2026-03-28)
 
 ### Bug Fixes
diff --git a/docs/TODO.md b/docs/TODO.md
index ec030e6..d705201 100644
--- a/docs/TODO.md
+++ b/docs/TODO.md
@@ -5,6 +5,7 @@ Comprehensive task breakdown for repository improvements and production readines
 ## ✅ Recently Completed
 
 - [x] **IMAP: fix all emails appearing empty** — `aioimaplib` stores RFC822 literal data as `bytearray`, not `bytes`. The extraction loop was checking `isinstance(line, bytes)` which returns `False` for `bytearray`, so every email body was silently skipped. Fixed to accept both types and convert to `bytes`. Affected T-Online, GMX, and all IMAP accounts.
+- [x] **CI: fix safety scan EOF error** — replaced `safety scan --json` (Safety CLI v3 requires interactive login) with `pip-audit` (no auth required, maintained by PyPA).
 - [x] **Security: upgrade fastapi/starlette and fix safety CI command** — Upgraded `fastapi` to `0.135.2` (pulls in `starlette>=1.0.0`) fixing 4 DoS CVEs in `starlette<=0.35.1`; replaced deprecated `safety check` with `safety scan`; added `.safety-policy.yml` to suppress unfixable `ecdsa` side-channel CVEs (maintainers won't fix).
 - [x] **IMAP RFC 3501 flag syntax & aioimaplib UID SEARCH fix**: `_fetch_imap_emails`
   now uses a plain `SEARCH UNSEEN` + `FETCH (UID)` to resolve sequence numbers to