Must Link to heading

Failure to address these items will result in immediate crashes, blocked network traffic, or rejection from the app marketplace.

Android 17 (API Level 37) Link to heading

  • Mandatory Large-Screen Resizability: On displays with a smallest width 600dp, the system now ignores developer opt-outs for orientation and resizability. Manifest attributes like screenOrientation and resizeableActivity="false" are discarded; applications must natively support free-form windowing and orientation changes.
  • Local Network Lockdown: Apps must acquire the ACCESS_LOCAL_NETWORK runtime permission to communicate with devices on local subnets. Socket connection attempts to local addresses are intercepted and blocked at the kernel level if the permission is absent.
  • Native Library Hardening: Any native library loaded via System.load() must be marked read-only; failing to do so will cause the system to throw a fatal UnsatisfiedLinkError.
  • Static Final Integrity: Modifying static final fields via reflection now throws an IllegalAccessException, and modifications via JNI will cause an immediate app crash.
  • SMS OTP Protection: Programmatic access to standard SMS OTP messages is delayed by three hours for most apps to prevent hijacking. Developers should migrate to the SMS Retriever API for immediate access.
  • Background Audio Hardening: Background apps must have a valid foreground service with while-in-use capabilities to play audio or request focus; otherwise, API calls fail silently.
  • Play Store Contacts Policy: Broad READ_CONTACTS use now requires a technical declaration in the Play Console justifying core functionality or a migration to the permission-free System Contacts Picker.
  • Lock-Free MessageQueue: The core threading architecture is now lock-free to reduce missed frames, which breaks deep reflection on private internal fields like mMessages or mIdleHandlers.
  • NPU Feature Declaration: Apps requiring direct access to Neural Processing Units must explicitly declare the android.hardware.npu feature flag in the manifest to avoid hardware blocking.
  • Activity Recreation Updates: The system no longer restarts activities by default for configuration changes like keyboard visibility or color mode. If your app relies on a full restart to reload resources, you must explicitly opt-in using android:recreateOnConfigChanges.

Android 16 (API Level 36) Link to heading

  • Edge-to-Edge Mandatory: The manifest opt-out for edge-to-edge enforcement is deprecated and disabled; apps must natively support drawing behind system bars.
  • Predictive Back Navigation: Predictive back system animations are enabled by default; apps must use supported back navigation APIs as onBackPressed is no longer called.

Android 14 & 15 (API Level 34-35) Link to heading

  • Foreground Service Types: Apps must declare specific types (e.g., location, mediaPlayback) and obtain corresponding runtime permissions before starting the service.
  • Selected Photos Access: Users can grant partial media access; apps should utilize the Jetpack PickVisualMedia API to support the out-of-process system picker.
  • Executable Hardening: Dynamically loaded executable files (DEX, JAR) must be marked read-only.
  • Implicit Intent Restrictions: Implicit intents can no longer target non-exported internal application components.

Android 13 (API Level 33) Link to heading

  • Media Permission Granularization: The broad READ_EXTERNAL_STORAGE is split into READ_MEDIA_IMAGES, READ_MEDIA_VIDEO, and READ_MEDIA_AUDIO.
  • Notification Permission: Apps must request the POST_NOTIFICATIONS runtime permission to display alerts.

Android 12 (API Level 31-32) Link to heading

  • Safer Component Exporting: Every Activity or Service with an intent filter must explicitly declare android:exported="true|false".
  • PendingIntent Mutability: Every PendingIntent must specify either FLAG_IMMUTABLE or FLAG_MUTABLE to prevent background hijack exploits.

Android 11 (API Level 30) Link to heading

  • Scoped Storage Mandate: Broad file system access via legacy opt-outs is permanently removed; apps must use app-specific directories or the MediaStore API.
  • Package Visibility: Apps cannot query all installed packages by default; targets must be declared in a <queries> block in the manifest.

These best practices ensure your app remains responsive and efficient.

  • Abolish System.gc(): Modern ART uses Generational Concurrent Mark-Compact (GenGC) to frequently collect short-lived objects. Manual calls are often ignored to save power or trigger disruptive pauses that cause visible UI jank.
  • Per-App Memory Guardrails: The system enforces strict RAM limits based on device capacity, tracking Anonymous Resident Set Size (rss:anon). Exceeding these triggers a silent kernel termination; identify these via ApplicationExitInfo.getDescription() for the string “MemoryLimiter”.
  • Enforce R8 “Full Mode”: Removing android.enableR8.fullMode=false allows aggressive tree shaking and method inlining, significantly reducing DEX size and resident memory footprint.
  • Adopt Compose-First UI: Standard View-based components are now in maintenance mode. All new platform APIs and tools are built exclusively for Jetpack Compose.
  • AppFunctions Framework: Transition to the “Intelligence System” by annotating capabilities with @AppFunction. This allows AI agents to discover and execute your app’s workflows using KDoc descriptions.
  • Trim Memory Voluntarily: Implement onTrimMemory() to release substantial allocations like Bitmaps or video buffers when the app leaves the visible state, extending the time your process remains cached.