cyberjunky/python-garminconnect 0.3.11

Release 0.3.11

on GitHub

What's Changed

New Features

• Added download_health_snapshot(requested_date), which downloads the Health Snapshot ZIP for a given calendar date — data not included in the regular activity/wellness export. (#415 by @LyzardKing)
• Wired into demo.py under System & Export ("Download Health Snapshot ZIP for today").

Security

Token storage

• Token writes now use an unpredictable temp filename with exclusive (O_EXCL) creation instead of a fixed sibling name opened with O_TRUNC. Previously, a file pre-planted at the predictable temp path had its inode reused during the write, letting an attacker holding a read descriptor on it observe token contents as they were written.
• login() no longer calls .resolve() on the tokenstore path before validation. Resolving followed symlinks and substituted the target path before the ancestry symlink check ever ran, letting a pre-planted tokenstore symlink bypass that check entirely — potentially causing a victim to silently adopt an attacker-seeded token file or write fresh tokens into an attacker-controlled directory.

Full Changelog: 0.3.10...master