From 8faa6deb7802cc209d0b84cd7d662e00c05c3e4e Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 25 Mar 2026 23:09:24 +0000
Subject: [PATCH] =?UTF-8?q?Security:=20upgrade=20python-jose=203.3.0=20?=
 =?UTF-8?q?=E2=86=92=203.5.0=20(ECDSA=20algorithm=20confusion=20CVE)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Agent-Logs-Url: https://github.com/christianlouis/pop_puller_to_gmail/sessions/20fa7a89-23e5-462c-8b4d-9c6cdb4d0501
---
 CHANGELOG.md             | 3 +++
 backend/requirements.txt | 2 +-
 docs/TODO.md             | 1 +
 3 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f24241a..cebd6dd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Security
+- Upgraded `python-jose` from 3.3.0 to 3.5.0 to fix CVE: algorithm confusion vulnerability with OpenSSH ECDSA keys (affected versions < 3.4.0).
+
 ### Added
 - **Unified Google OAuth flow**: Google Sign-In now requests all Gmail API scopes (`gmail.insert`, `gmail.labels`, `gmail.readonly`) in the same consent screen, so users no longer need a separate "Connect Gmail" step after signing in with Google. Gmail credentials are stored automatically on successful sign-in.
 - `include_granted_scopes=true` added to both the login and Gmail authorize URLs so scope additions take effect for users who previously connected.
diff --git a/backend/requirements.txt b/backend/requirements.txt
index 3510b4d..0827c49 100644
--- a/backend/requirements.txt
+++ b/backend/requirements.txt
@@ -11,7 +11,7 @@ psycopg2-binary==2.9.11
 asyncpg==0.31.0
 
 # Authentication
-python-jose[cryptography]==3.3.0
+python-jose[cryptography]==3.5.0  # Updated: Fixed algorithm confusion with OpenSSH ECDSA keys (was 3.3.0)
 bcrypt==4.3.0
 python-multipart==0.0.22  # Updated: Fixed multiple vulnerabilities (was 0.0.6)
 authlib==1.6.9  # Updated: Fixed OIDC hash binding, JWE RSA1_5 padding oracle, alg:none bypass, JWK header injection (was 1.6.6)
diff --git a/docs/TODO.md b/docs/TODO.md
index 7dc86fe..9bc8fbe 100644
--- a/docs/TODO.md
+++ b/docs/TODO.md
@@ -11,6 +11,7 @@ Comprehensive task breakdown for repository improvements and production readines
 - [x] Implement CSRF protection middleware
 - [x] Document all error codes in docs/ERRORS.md
 - [x] Create security ADR (Architecture Decision Records)
+- [x] Upgrade `python-jose` 3.3.0 → 3.5.0 (algorithm confusion with OpenSSH ECDSA keys, CVE, affected < 3.4.0)
 
 ### In Progress 🔨
 - [ ] Enable rate limiting per user/tier