September's security updateshave been posted for most of the Nexus family, although a few devices are still mysteriously lagging behind on official Nougat images. The source code for most of the changes has been uploaded to the Android Open Source Project (AOSP) and we've generated a list of those changes for quick and easy viewing. The security bulletin already details most of the issues resolved this month, but there may be additional details lurking behind the code, so feel free to take a look around.
There are currently five new builds posted: three for Marshmallow (MMB30W, MOB31E, MTC20K) and two for Nougat (NRD90R, NRD90S). I'll save everybody a couple moments of page loads to say that each changelog for Marshmallow is basically identical, except for MTC20K, which also adds a single CTS test. The changelogs for Nougat include a few more fixes distinct from those on 6.0.1.
Most of the changes will probably only make sense to people with some experience or familiarity with particular projects. However, this patch appears to prevent the Settings app from being started during device setup, a step that's usually necessary to bypass factory reset protection on Marshmallow. If anything else interesting turns up, drop a line in the comments.
The MTC20L version tag (for the Nexus 6P) is still missing from AOSP, and there are still three devices completely without Nougat firmware builds or version tags. We'll keep an eye out for those and update this post when changelogs are ready.
Reading the changelogs?There are a lot of questions and confusion surrounding changelogs, so here are a few reminders and tips that might clear some things up.
To begin with, all changelogs are named with their starting and ending tags. That's because changelogs pick up where previous changelogs left off, but the names and numbers aren't necessarily sequential. For example, 6.0.1_r56 is based on r48, not on r55. Changelogs always build off of another changelog, sometimes even in the same month. Also remember that while most patches are only written once, they may be copied across multiple development branches running in parallel, so a single patch may appear in more than one changelog.
Also remember that these changelogs only list changes uploaded to the Android Open Source Project. They do not include changes made to the closed source proprietary binaries used to build the final firmware for a device. Sometimes a new tag and build number are created for updates where only those binaries have been replaced, which usually results in a virtually empty changelog.
Finally, changelogs for developer previews contain only a short list of changes. This is because Google does not post the full code for a new version of Android until the OS is final. Most of the code disclosed prior to a final OS release is usually for compliance with the GPL or similarly licensed projects, or belonging to projects Google itself chooses to make available in advance.
September security updates : (Sept 6)
MMB30W android-6.0.1_r57 > android-6.0.1_r65 Nexus 6 MOB31E android-6.0.1_r61 > android-6.0.1_r66 Nexus 6, Nexus 5, Nexus 9 LTE MTC20K android-6.0.1_r62 > android-6.0.1_r67 Nexus 5X NRD90R android-7.0.0_r1 > android-7.0.0_r3 Nexus 9 Wi-Fi, Nexus Player, Pixel C NRD90S android-7.0.0_r3 > android-7.0.0_r4 Nexus 5X