Update garminconnect requirement from <1.0,>=0.3.5 to >=0.3.10,<1.0

[dependabot]

Updates the requirements on garminconnect to permit the latest version.

Release notes

Sourced from garminconnect's releases.

Release 0.3.10

What's Changed

This release is primarily a security-hardening pass covering authentication, token storage, and request handling.

Security

Token storage & session

• Reject symlinked tokenstore paths, including intermediate directories anywhere in the path's ancestry and ~username expansion — closes several local-attacker vectors that could redirect token read/write/delete to an attacker-controlled location.
• Token refresh and writes are now serialized with a lock and written atomically, preventing corrupted or raced token files.
• logout() now fully clears session cookies, MFA state, and wrapper fields instead of leaving stale credentials behind.
• Plaintext password is cleared from memory after a successful login.

Authentication flow

• login() clears stale auth state on entry, so a failed or partial login can no longer leave a mismatched token active.
• Two-step MFA (resume_login) now verifies the resulting token and fails closed instead of silently succeeding with a broken session.
• Interleaved MFA logins on a shared client instance no longer corrupt each other's pending state.
• JWT handling rejects unsigned (alg: none) tokens and malformed/adversarial exp claims that could otherwise crash every subsequent API call.

Request & URL handling

• All identifier-bearing API methods now validate their inputs (positive integers, UUIDs, sport keys, dates) before building request URLs, closing several path-traversal and query-injection gaps.
• The request-path guard now correctly decodes percent-encoded paths before validating them, and no longer misfires on legitimate encoded characters.
• domain= is now checked against an allowlist of official Garmin domains, preventing credential exfiltration via a malicious value.

Reliability / DoS

• Pagination in get_activities_by_date / get_goals is now capped, so a misbehaving or hostile server can no longer hang the client or exhaust memory.
• A 401 during upload retry now rewinds the file body correctly instead of silently re-uploading an empty or truncated file.

Logging & data hygiene

• Exception messages and debug logs no longer include raw server response bodies, CAS service tickets, or token contents.
• Hardened the VCR cassette sanitizer (JSON bodies, MFA codes, tickets) and the exercise-catalog generator script against recording or publishing session/account data.

Full Changelog: cyberjunky/python-garminconnect@0.3.9...0.3.10

Commits

• 414b540 Bumped version
• 02eab17 Merge pull request #412 from cyberjunky/security/audit-20260810
• de7bf51 security: make _run_request traversal guard segment-aware
• 999914c security: track nested <span> depth in exercise-picker parser
• 764ddfa security: fix exercise-catalog text accumulation and final-item flush
• a51330b security: address CodeRabbit review on PR #412
• a5ba3c9 Merge pull request #411 from cyberjunky/security/login-clear-stale-auth
• 662360c test: align FTP URL assertions with params kwarg, fix caplog level
• fa77b83 security: scope exercise-catalog extraction to each <li> element
• e2533a6 security: check full tokenstore ancestry for symlinks
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)