cyberjunky/python-garminconnect 0.3.10 on GitHub

What's Changed

This release is primarily a security-hardening pass covering authentication, token storage, and request handling.

Token storage & session

Reject symlinked tokenstore paths, including intermediate directories anywhere in the path's ancestry and ~username expansion — closes several local-attacker vectors that could redirect token read/write/delete to an attacker-controlled location.
Token refresh and writes are now serialized with a lock and written atomically, preventing corrupted or raced token files.
logout() now fully clears session cookies, MFA state, and wrapper fields instead of leaving stale credentials behind.
Plaintext password is cleared from memory after a successful login.

Authentication flow

login() clears stale auth state on entry, so a failed or partial login can no longer leave a mismatched token active.
Two-step MFA (resume_login) now verifies the resulting token and fails closed instead of silently succeeding with a broken session.
Interleaved MFA logins on a shared client instance no longer corrupt each other's pending state.
JWT handling rejects unsigned (alg: none) tokens and malformed/adversarial exp claims that could otherwise crash every subsequent API call.

Request & URL handling

All identifier-bearing API methods now validate their inputs (positive integers, UUIDs, sport keys, dates) before building request URLs, closing several path-traversal and query-injection gaps.
The request-path guard now correctly decodes percent-encoded paths before validating them, and no longer misfires on legitimate encoded characters.
domain= is now checked against an allowlist of official Garmin domains, preventing credential exfiltration via a malicious value.

Reliability / DoS

Pagination in get_activities_by_date / get_goals is now capped, so a misbehaving or hostile server can no longer hang the client or exhaust memory.
A 401 during upload retry now rewinds the file body correctly instead of silently re-uploading an empty or truncated file.

Logging & data hygiene

Exception messages and debug logs no longer include raw server response bodies, CAS service tickets, or token contents.
Hardened the VCR cassette sanitizer (JSON bodies, MFA codes, tickets) and the exercise-catalog generator script against recording or publishing session/account data.

Full Changelog: 0.3.9...0.3.10