26

Notable changes in version 26:

• raise TLS key pinning expiry date
• update Gradle to 8.10.1
• update AndroidX Lifecycle libraries to 2.8.6
• update AndroidX Navigation libraries to 2.8.1
• update Android Gradle plugin to 8.6.1

A full list of changes from the previous release (version 25) is available through the Git commit log between the releases.

---

App Store is the client for the GrapheneOS app repository. It's included in GrapheneOS but can also be used on other Android 12+ operating systems. Our app repository currently provides our standalone apps, out-of-band updates to certain GrapheneOS components and a mirror of the core Google Play apps and Android Auto to make it easy for GrapheneOS users to install sandboxed Google Play with versions of the Google Play apps we've tested with our sandboxed Google Play compatibility layer.

GrapheneOS users must obtain GrapheneOS app updates through our App Store since verified boot metadata is required for out-of-band system app updates on GrapheneOS as part of extending verified boot to them.

25

Notable changes in version 25:

• add support for using v4 APK signatures instead of fs-verity metadata on Android 15
• enable generation of v4 APK signatures to replace fs-verity metadata for updates on Android 15 GrapheneOS
• skip system package check for static dependencies self checks
• extend workaround for PackageInstaller sessions getting stuck to newer Android versions
• update AndroidX Lifecycle libraries to 2.8.5
• update AndroidX Navigation KTX libraries to 2.8.0
• update AndroidX Fragment library to 1.8.3
• update AndroidX Activity KTX library to 1.9.2
• update Gradle to 8.10
• update Android Gradle plugin to 8.6.0
• update Kotlin to 2.0.20
• update Kotlin Symbol Processing to 1.0.25

A full list of changes from the previous release (version 24) is available through the Git commit log between the releases.

---

App Store is the client for the GrapheneOS app repository. It's included in GrapheneOS but can also be used on other Android 12+ operating systems. Our app repository currently provides our standalone apps, out-of-band updates to certain GrapheneOS components and a mirror of the core Google Play apps and Android Auto to make it easy for GrapheneOS users to install sandboxed Google Play with versions of the Google Play apps we've tested with our sandboxed Google Play compatibility layer.

GrapheneOS users must either obtain GrapheneOS app updates through our App Store or install it with adb install-multiple with both the APK and fs-verity metadata since fs-verity metadata is now required for out-of-band system app updates on GrapheneOS as part of extending verified boot to them.

24

Notable changes in version 24:

• change name from Apps to App Store
• delay update check for 10 seconds after the automatic update job starts to work around the network being declared as ready before it's functional (often caused by VPN apps)
• use a dedicated error message for failed background updates to make it easier to understand
• add a package flag for opting out of bulk updates
• declare DEFAULT and APP_MARKET intent categories
• update Android build tools to 35.0.0
• update Material Components library to 1.12.0
• update AndroidX AppCompat library to 1.7.0
• update AndroidX Fragment KTX library to 1.8.1
• update AndroidX Core KTX library to 1.13.1
• update AndroidX Lifecycle libraries to 2.8.1
• update Android Gradle plugin to 8.5.1
• update Gradle to 8.9
• update Kotlin to 2.0.0
• update Kotlin Symbol Processing to 1.0.21
• improve code quality

A full list of changes from the previous release (version 23) is available through the Git commit log between the releases.

---

App Store is the client for the GrapheneOS app repository. It's included in GrapheneOS but can also be used on other Android 12+ operating systems. Our app repository currently provides our standalone apps, out-of-band updates to certain GrapheneOS components and a mirror of the core Google Play apps and Android Auto to make it easy for GrapheneOS users to install sandboxed Google Play with versions of the Google Play apps we've tested with our sandboxed Google Play compatibility layer.

GrapheneOS users must either obtain GrapheneOS app updates through our App Store or install it with adb install-multiple with both the APK and fs-verity metadata since fs-verity metadata is now required for out-of-band system app updates on GrapheneOS as part of extending verified boot to them.

23

Notable changes in version 23:

• request package update ownership by default (our mirrors of Play services and Play Store for sandboxed Google Play have been excluded in our app repository's metadata)
• drop removed packages from the user interface after repository update rather than on next app restart
• add a way to mark a dependency being missing as ignored
• add caching for system feature checks
• add support for static dependencies on the device model
• verify shared library declaration during package installation to prevent a compromise of the repository signing key and server from being able to install new packages by adding them as dependencies of other apps
• use MATCH_ANY_USER flag for getSharedLibraries() when allowed to in order to detect already completed shared library updates on GrapheneOS to avoid conflicts when updating Vanadium browser in one profile and then Vanadium WebView in another profile or vice versa
• fix search bar chips padding
• dismiss keyboard when searching
• raise TLS key pinning expiry date
• update Gradle to 8.7
• update Android Gradle plugin to 8.3.2
• update Kotlin Symbol Processing to 1.0.20
• update AndroidX Activity KTX library to 1.9.0
• update AndroidX Core KTX library to 1.13.0
• update Bouncy Castle library to 1.78.1
• work around potentially buggy Android APIs
• improve code style, robustness and comments

A full list of changes from the previous release (version 22) is available through the Git commit log between the releases.

---

Apps is the client for the GrapheneOS app repository. It's included in GrapheneOS but can also be used on other Android 12+ operating systems. Our app repository currently provides our standalone apps, out-of-band updates to certain GrapheneOS components and a mirror of the core Google Play apps and Android Auto to make it easy for GrapheneOS users to install sandboxed Google Play with versions of the Google Play apps we've tested with our sandboxed Google Play compatibility layer.

GrapheneOS users must either obtain GrapheneOS app updates through our app repository or install it with adb install-multiple with both the APK and fs-verity metadata since fs-verity metadata is now required for out-of-band system app updates on GrapheneOS as part of extending verified boot to them.

22

Notable changes in version 22:

• skip renamed packages on initial GrapheneOS 14 QPR2 versions due to upstream original-package bug resolved for the next GrapheneOS release (i.e. users who still have an install from before Vanadium was renamed to app.vanadium.browser from org.chromium.chrome will need to wait until the next GrapheneOS release to update it)
• raise TLS key pinning expiry date
• update Gradle to 8.6
• update Kotlin to 1.9.23
• update Kotlin Symbol Processing to 1.0.19
• update Android Gradle plugin to 8.3.0
• update Bouncy Castle to 1.77
• update AndroidX Activity KTX to 1.8.2
• update AndroidX Fragment KTX to 1.6.2
• update AndroidX Navigation libraries and Safe Args plugin to 2.7.7
• update Material Components library to 1.11.0
• update KotlinX Coroutines to 1.8.0
• update AndroidX lifecycle libraries to 2.7.0

A full list of changes from the previous release (version 21) is available through the Git commit log between the releases.

---

Apps is the client for the GrapheneOS app repository. It's included in GrapheneOS but can also be used on other Android 12+ operating systems. Our app repository currently provides our standalone apps, out-of-band updates to certain GrapheneOS components and a mirror of the core Google Play apps to make it easy for GrapheneOS users to install sandboxed Google Play with versions of the Google Play apps we've tested with our sandboxed Google Play compatibility layer.

GrapheneOS users must either obtain GrapheneOS app updates through our app repository or install it with adb install-multiple with both the APK and fs-verity metadata since fs-verity metadata is now required for out-of-band system app updates on GrapheneOS as part of extending verified boot to them.

21

Notable changes in version 21:

• properly handle split APKs having their own density split APKs (fixes fully installing recent Play services releases)
• support updating disabled packages on Android 14+
• fix static dependencies for app variants
• remove non-descriptive app icon label to improve screen reader support
• set channel chip as not checkable to improve screen reader support
• update AndroidX Core KTX library to 1.12.0
• update AndroidX Activity KTX library to 1.8.0
• update AndroidX Navigation libraries to 2.7.4
• update AndroidX Preference KTX library to 1.2.1
• update AndroidX lifecycle libraries to 2.6.2
• update Glide library to 4.16.0
• switch to Kotlin Symbol Processing (KSP) variant of Glide library
• update Material library to 1.10.0
• update Bouncy Castle library to 1.76
• update Kotlin Coroutines libraries to 1.7.3
• update Gradle to 8.3
• update Kotlin to 1.9.10
• update AndroidX navigation safeargs plugin to 2.6.0
• update Android Gradle plugin to 8.1.2
• update Android build tools to 34.0.0
• update SDK to 34 (Android 14)
• update target API level to 34 (Android 14)
• add low-level ACCESS_NETWORK_STATE permission required by API 34 to schedule jobs depending on network availability
• add low-level FOREGROUND_SERVICE_DATA_SYNC permission required by API 34 to set foreground service type

A full list of changes from the previous release (version 20) is available through the Git commit log between the releases.

---

Apps is the client for the GrapheneOS app repository. It's included in GrapheneOS but can also be used on other Android 12+ operating systems. Our app repository currently provides our standalone apps, out-of-band updates to certain GrapheneOS components and a mirror of the core Google Play apps to make it easy for GrapheneOS users to install sandboxed Google Play with versions of the Google Play apps we've tested with our sandboxed Google Play compatibility layer.

GrapheneOS users must either obtain GrapheneOS app updates through our app repository or install it with adb install-multiple with both the APK and fs-verity metadata since fs-verity metadata is now required for out-of-band system app updates on GrapheneOS as part of extending verified boot to them.

20

Notable changes in version 20:

• revert change to ignore package dependencies when updating disabled packages
• do not require dependencies of disabled package to be enabled
• fix crash from failed assertion due to starting self-update twice when update all is pressed

A full list of changes from the previous release (version 19) is available through the Git commit log between the releases.

---

Apps is the client for the GrapheneOS app repository. It's included in GrapheneOS but can also be used on other Android 12+ operating systems. Our app repository currently provides our standalone apps, out-of-band updates to certain GrapheneOS components and a mirror of the core Google Play apps to make it easy for GrapheneOS users to install sandboxed Google Play with versions of the Google Play apps we've tested with our sandboxed Google Play compatibility layer.

GrapheneOS users must obtain GrapheneOS app updates through our app repository since fs-verity metadata is now required for out-of-band system app updates on GrapheneOS as part of extending verified boot to them.

19

Notable changes in version 19:

• ignore package dependencies when updating disabled packages
• add 1 year expiration to TLS key pinning since Apps is solely responsible for updating itself when used outside GrapheneOS and we don't want extremely out-of-date versions to be stranded without an update path (on GrapheneOS, System Updater prevents that happening)
• drop redundant TLS key pins for intermediates
• switch to modern Gradle plugin infrastructure
• raise TLS key pinning expiry date
• update Android Gradle plugin to 8.0.1
• update Gradle to 8.1.1
• update Kotlin to 1.8.21
• update AndroidX Activity KTX library to 1.7.1
• update AndroidX Fragment KTX library to 1.5.7
• update AndroidX Lifecycle Viewmodel library to 2.6.1

A full list of changes from the previous release (version 18) is available through the Git commit log between the releases.

---

Apps is the client for the GrapheneOS app repository. It's included in GrapheneOS but can also be used on other Android 12+ operating systems. Our app repository currently provides our standalone apps, out-of-band updates to certain GrapheneOS components and a mirror of the core Google Play apps to make it easy for GrapheneOS users to install sandboxed Google Play with versions of the Google Play apps we've tested with our sandboxed Google Play compatibility layer.

GrapheneOS users must obtain GrapheneOS app updates through our app repository since fs-verity metadata is now required for out-of-band system app updates on GrapheneOS as part of extending verified boot to them.

18

Notable changes in version 18:

• split up update check job from auto-update job in order to only automatically update apps while the device is idle while still notifying the user right away since updating apps kills their processes and can disrupt usage
• show up-to-date notification even if the process is killed while the OS is installing updates
• use separate notification channel for update check failures
• support updating disabled packages on current GrapheneOS releases where updating disabled packages doesn't re-enable them like it does on Android
• enforce auto-update network restrictions directly in addition to the JobScheduler constraints
• increase minimum repository timestamp
• add margin for "unable to fetch list" text
• reduce max padding between cards
• update Gradle to 8.1
• update Android Gradle plugin to 8.0.0
• update Kotlin to 1.8.20
• update Bouncy Castle library to 1.73
• update AndroidX Core KTX library to 1.10
• update AndroidX Activity KTX library to 1.7.0
• update AndroidX Fragment KTX library to 1.5.6

A full list of changes from the previous release (version 17) is available through the Git commit log between the releases.

---

Apps is the client for the GrapheneOS app repository. It's included in GrapheneOS but can also be used on other Android 12+ operating systems. Our app repository currently provides our standalone apps, out-of-band updates to certain GrapheneOS components and a mirror of the core Google Play apps to make it easy for GrapheneOS users to install sandboxed Google Play with versions of the Google Play apps we've tested with our sandboxed Google Play compatibility layer.

GrapheneOS users must obtain GrapheneOS app updates through our app repository since fs-verity metadata is now required for out-of-band system app updates on GrapheneOS as part of extending verified boot to them.

17

Notable changes in version 17:

• fix showing confirmation dialog for shared library installation
• don't track PackageInstaller sessions across app launches due to Android API bugs
• maintain and use global list of busy packages on GrapheneOS to avoid errors from multiple instances of Apps trying to update the same apps
• update Glide library to 4.15.1
• update Gradle to 8.0.2

A full list of changes from the previous release (version 16) is available through the Git commit log between the releases.

---

Apps is the client for the GrapheneOS app repository. It's included in GrapheneOS but can also be used on other Android 12+ operating systems. Our app repository currently provides our standalone apps, out-of-band updates to certain GrapheneOS components and a mirror of the core Google Play apps to make it easy for GrapheneOS users to install sandboxed Google Play with versions of the Google Play apps we've tested with our sandboxed Google Play compatibility layer.

GrapheneOS users must obtain GrapheneOS app updates through our app repository since fs-verity metadata is now required for out-of-band system app updates on GrapheneOS as part of extending verified boot to them.