[dependabot]

Updates the requirements on garminconnect to permit the latest version.

Release notes

Sourced from garminconnect's releases.

Release 0.3.11

What's Changed

New Features

• Added download_health_snapshot(requested_date), which downloads the Health Snapshot ZIP for a given calendar date — data not included in the regular activity/wellness export. (#415 by @​LyzardKing)
• Wired into demo.py under System & Export ("Download Health Snapshot ZIP for today").

Security

Token storage

• Token writes now use an unpredictable temp filename with exclusive (O_EXCL) creation instead of a fixed sibling name opened with O_TRUNC. Previously, a file pre-planted at the predictable temp path had its inode reused during the write, letting an attacker holding a read descriptor on it observe token contents as they were written.
• login() no longer calls .resolve() on the tokenstore path before validation. Resolving followed symlinks and substituted the target path before the ancestry symlink check ever ran, letting a pre-planted tokenstore symlink bypass that check entirely — potentially causing a victim to silently adopt an attacker-seeded token file or write fresh tokens into an attacker-controlled directory.

Full Changelog: cyberjunky/python-garminconnect@0.3.10...master

Commits

• ee9f968 Merge pull request #415 from LyzardKing/patch-1
• 70220b6 fix: clean up download_health_snapshot before merge
• 93285d7 Merge master into patch-1 for CI fixes
• 2ac1334 chore: bump version to 0.3.11
• f02545b docs: drop stray report number from test docstring
• e92390d security: use unpredictable O_EXCL temp file for token writes
• e1eddc4 security: do not resolve() tokenstore symlinks before validation
• 84a2605 Add small test for health_snapshot download
• b172c3a Add health snapshot download method
• 414b540 Bumped version
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)