The CommonsBlog


Random Musings on the Android 17 Beta 3

Well, Android 17 Beta 3 dropped. Ordinarily, we would expect a third beta to be a very minor release, especially since the point of this release is that Android 17 “officially reached platform stability”. Instead, Beta 3 might be the biggest of the pre-release versions in terms of the amount of change, and we have the least time to cope with that change. I am curious as to who in Google thinks that this approach is a good idea, and why.

Compounding the challenge is that a lot of the changes that I see in the API differences report seem to be undocumented.

So, let’s start in on the random musings…

What Feels Like Double-Speak

They added a new setExactAndAllowWhileIdle() overload on AlarmManager that takes a listener. It is “ideal for apps that currently rely on continuous wakelocks” according to the announcement blog post, but it is explained in the same post as “reducing wakelocks”. It is unclear how continuous wakelocks represent a reduction.

What Feels Like Double-Speak, Part Deux

Android now provides a user setting to hide app names (labels) on the home screen workspace. Ensure your app icon is distinct and recognizable.

Well, our app icon cannot be “distinct and recognizable” based on colors, courtesy of mandatory Material You theming. And our app icon cannot be “distinct and recognizable” based on outer shape, courtesy of user-configurable launcher icon shapes. Google’s entire point seems to be to make it such that app icons are not “distinct and recognizable”, and now some users might wind up not even having captions for those indistinguishable icons. 🧐

What Needs More Documentation

Media projection is the Android SDK’s area for screenshots and screencasts. That seems to have been expanded to cover “app content projection”, but it is unclear what that is.

There is a new SerialManager for access to serial ports. It is unclear whether this is limited to direct serial ports or if it includes things like USB-to-serial adapters.

There is a new WebAppManager “that manages the installation and querying of Web Apps” and serves as “the entry point for managing Web Apps installed as Android apps”. It is unclear whether this is communicating with the user’s default Web browser or what.

There is a new PccSandboxManager and a lot of other new APIs tied to a Private Compute Core (PCC) sandbox. It is not completely clear what use cases this is intended for and who is allowed to actually employ it.

There is a new VoiceInteractionManager that seems like it is tied to assistant or assistive technologies, but could really use more details.

What Makes It Seems Like Android Desktops Are Coming Soon

A few items showed up in this beta tied to desktop mode, such as:

What Makes Me Wonder If Spam Is Everywhere

There are now caps on how many keys an app can put in the Android Keystore.

What Seems Blurry

SurfaceView now has getBlurRegions() and setBlurRegions(). Apparently, these let you blur sections of the SurfaceView. Given the nature of SurfaceView, I am not surprised that they needed to add a dedicated API for this — with TextureView, you should be able to do your own blurs as needed. However, a bit more documentation on this would be nice.

What Is a Secret, Sometimes

ShowSecretsSetting is how we find out whether “characters entered into a password, pin or other secret field… should either be shown or echoed briefly”, with separate values for physical keyboards versus touchscreen keyboards.

What Signals Your Impending Doom

You can now find out when you are nearing your ANR timeout. Your job is to head to the escape pods before your process is terminated.

What’s Going… Going… Gone

As part of the “extensive features and refinements from OpenJDK 21 and OpenJDK 25”, Google got rid of getChars() from String. That had trickle-down effects, with getChars() being removed from SpannedString and SpannableStringBuilder, among other places.

ACTION_TAG_DISCOVERED is deprecated in favor of ACTION_NDEF_DISCOVERED, ACTION_TECH_DISCOVERED, or other approaches for NFC integration.

getInstance() on DnsResolver was removed, replaced by an equivalent constructor.

What Else is Curious

Android finally has a FileManager. However, in this case, it is not an app, but instead is a “system service manager for handling privileged, long-running file operations”. It would appear that they are trying to give us better options for background disk I/O that do not require WorkManager. See also the requests and results that it appears that you can use.

DocumentsContract defines a CATEGORY_APPROVED_DOCUMENT_HANDLER. You add this to the <intent-filter> of ACTION_SEND and/or ACTION_SEND_MULTIPLE activities that are capable of handling document intents. The system might surface your activity in new and exciting places, as the user tries sharing documents.

StrictMode now has policies tied to implicit Uri permission grants. That capability is going away with Android 18. Strangely, this policy seems to be on the recipient of the Uri, even though the bug is in the sender of the Uri for not explicitly granting permission.

getByteArray() and putByteArray() moved from Bundle to BaseBundle. If you are using PersistableBundle, this change might be very useful, if you were using hacks to get around the lack of ByteArray support previously.

Android 17 supports bridged notifications, which is “a notification sent from another device via a bridging application. The notification is displayed with customized content to differentiate it to the user from a local notification.” It is unclear what differs “bridged notifications” from notifications displayed on a projected device, though.

There is now a way to get an attribution for the source of an app interaction, though it is unclear if this is something that ordinary Android app developers might be able to leverage.

Android 17 has a new framework for supporting sending SMS-style messages over alternative transports, such as RCS or carrier pigeons or whatever.

What Ends the Annual Gaslighting

The version code for Android 17 now officially is 37, not 10000.

Mar 27, 2026


25 March 2026 Artifact Wave

Room3 Paging got more multiplatform targets:

  • androidx.room3:room3-paging-js
  • androidx.room3:room3-paging-tvossimulatorarm64
  • androidx.room3:room3-paging-wasm-js
  • androidx.room3:room3-paging-watchosarm32
  • androidx.room3:room3-paging-watchosarm64
  • androidx.room3:room3-paging-watchosdevicearm64
  • androidx.room3:room3-paging-watchossimulatorarm64

Also, we got a new artifact group, androidx.wear.compose.remote, containing a single artifact, androidx.wear.compose.remote:remote-material3. It is unclear if this is tied to Remote Compose, using a wearable as a remote control, or something else.

In addition, we got androidx.xr.runtime:runtime-interfaces as a new artifact.

The roster of 900+ updated artifacts can be found here.

Mar 25, 2026


18 March 2026 Artifact Wave

This week, we got patch releases and an RC for Media3:

  • androidx.gradle:gradle-version-catalog:2026.03.00
  • androidx.gradle:gradle-version-catalog-alpha:2026.03.00
  • androidx.gradle:gradle-version-catalog-beta:2026.03.00
  • androidx.media3:media3-cast:1.10.0-rc02
  • androidx.media3:media3-cast:1.9.3
  • androidx.media3:media3-common:1.10.0-rc02
  • androidx.media3:media3-common:1.9.3
  • androidx.media3:media3-common-ktx:1.10.0-rc02
  • androidx.media3:media3-common-ktx:1.9.3
  • androidx.media3:media3-container:1.10.0-rc02
  • androidx.media3:media3-container:1.9.3
  • androidx.media3:media3-database:1.10.0-rc02
  • androidx.media3:media3-database:1.9.3
  • androidx.media3:media3-datasource:1.10.0-rc02
  • androidx.media3:media3-datasource:1.9.3
  • androidx.media3:media3-datasource-cronet:1.10.0-rc02
  • androidx.media3:media3-datasource-cronet:1.9.3
  • androidx.media3:media3-datasource-okhttp:1.10.0-rc02
  • androidx.media3:media3-datasource-okhttp:1.9.3
  • androidx.media3:media3-datasource-rtmp:1.10.0-rc02
  • androidx.media3:media3-datasource-rtmp:1.9.3
  • androidx.media3:media3-decoder:1.10.0-rc02
  • androidx.media3:media3-decoder:1.9.3
  • androidx.media3:media3-effect:1.10.0-rc02
  • androidx.media3:media3-effect:1.9.3
  • androidx.media3:media3-effect-lottie:1.10.0-rc02
  • androidx.media3:media3-exoplayer:1.10.0-rc02
  • androidx.media3:media3-exoplayer:1.9.3
  • androidx.media3:media3-exoplayer-dash:1.10.0-rc02
  • androidx.media3:media3-exoplayer-dash:1.9.3
  • androidx.media3:media3-exoplayer-hls:1.10.0-rc02
  • androidx.media3:media3-exoplayer-hls:1.9.3
  • androidx.media3:media3-exoplayer-ima:1.10.0-rc02
  • androidx.media3:media3-exoplayer-ima:1.9.3
  • androidx.media3:media3-exoplayer-midi:1.10.0-rc02
  • androidx.media3:media3-exoplayer-midi:1.9.3
  • androidx.media3:media3-exoplayer-rtsp:1.10.0-rc02
  • androidx.media3:media3-exoplayer-rtsp:1.9.3
  • androidx.media3:media3-exoplayer-smoothstreaming:1.10.0-rc02
  • androidx.media3:media3-exoplayer-smoothstreaming:1.9.3
  • androidx.media3:media3-exoplayer-workmanager:1.10.0-rc02
  • androidx.media3:media3-exoplayer-workmanager:1.9.3
  • androidx.media3:media3-extractor:1.10.0-rc02
  • androidx.media3:media3-extractor:1.9.3
  • androidx.media3:media3-inspector:1.10.0-rc02
  • androidx.media3:media3-inspector:1.9.3
  • androidx.media3:media3-inspector-frame:1.10.0-rc02
  • androidx.media3:media3-muxer:1.10.0-rc02
  • androidx.media3:media3-muxer:1.9.3
  • androidx.media3:media3-session:1.10.0-rc02
  • androidx.media3:media3-session:1.9.3
  • androidx.media3:media3-test-utils:1.10.0-rc02
  • androidx.media3:media3-test-utils:1.9.3
  • androidx.media3:media3-test-utils-robolectric:1.10.0-rc02
  • androidx.media3:media3-test-utils-robolectric:1.9.3
  • androidx.media3:media3-transformer:1.10.0-rc02
  • androidx.media3:media3-transformer:1.9.3
  • androidx.media3:media3-ui:1.10.0-rc02
  • androidx.media3:media3-ui:1.9.3
  • androidx.media3:media3-ui-compose:1.10.0-rc02
  • androidx.media3:media3-ui-compose:1.9.3
  • androidx.media3:media3-ui-compose-material3:1.10.0-rc02
  • androidx.media3:media3-ui-compose-material3:1.9.3
  • androidx.media3:media3-ui-leanback:1.10.0-rc02
  • androidx.media3:media3-ui-leanback:1.9.3

Mar 18, 2026


Coding Agents and Developer Security

Coding agents — Claude Code, OpenAI Codex, Mistral Vibe, etc. — are all the rage, and with good reason. At the same time, developers might chuckle at the various stories about people using OpenClaw-type personal agents and running into catastrophic problems, like the agent deleting whole directories unexpectedly. Surely, as we are experienced users of technology, we will not let our agents do silly things like that, right?

Right?!?

Particularly with the current generation of coding agent technology, bear in mind that it is not just you and the agent in the mix. It is also whoever developed the skills, plugins, MCP servers, etc. that you are employing.

It is easy to look at something like a SKILL.md file and conclude “it’s just Markdown”. However, to a coding agent, Markdown is executable code. If the skill convinces the agent to invoke a tool that will delete the contents of your C: drive, your protections are down to:

  • Any “that tool request looks sketchy” defenses that the agent harness (e.g., Codex) has

  • Your own inspection of the tool request, if you have “Ask permission”-style settings enabled

  • The fact that, for the love of $DEITY, hopefully you are not running Windows and therefore have no C: drive

Those first two bullets are weaker protections than you might think. For example, in my light Claude Code experiments, Sonnet 4.6 is more than willing to code-generate a chunk of Python, then ask to invoke python3 to execute it. It is unlikely that the agent harness will intuit whether or not some random block of Python is harmful. So now we’re down to my ability to grok a random block of Python and determine conclusively what it does. 😑

Also, bear in mind:

  • Skills can include “executable code that agents can run”

  • Plugins can register hooks that run JavaScript when the agent harness starts up, at least on some harnesses like Claude Code and OpenCode

  • While a skill may be static, a skill in conjunction with an MCP server or tool execution can be dynamic, reacting to what it sees in your environment (since, at present, MCP is largely limited to locally-run servers)

From a developer security standpoint, it is a scary time. Built-in “Web fetch”-style tools give rogue Markdown the ability to exfiltrate something from your developer machine… which is a statement that would have seem farcical just a couple of years ago. And, once MCP gets expanded to support remote-hosted servers, even more avenues open up for agents to be coerced into sending data from your developer machine to semi-arbitrary hosts.

As I continue experimenting with this technology, I will be trying to keep one eye out for these sorts of security concerns. Hopefully, you will too.

Mar 17, 2026


11 March 2026 Artifact Wave

We got a lot this time around!

The biggest news is that we appear to be getting a third Room, as androidx.room3 is a new artifact group with a long list of multiplatform artifacts:

  • androidx.room3:androidx.room3.gradle.plugin
  • androidx.room3:room3-common
  • androidx.room3:room3-common-iosarm64
  • androidx.room3:room3-common-iossimulatorarm64
  • androidx.room3:room3-common-js
  • androidx.room3:room3-common-jvm
  • androidx.room3:room3-common-linuxarm64
  • androidx.room3:room3-common-linuxx64
  • androidx.room3:room3-common-macosarm64
  • androidx.room3:room3-common-tvosarm64
  • androidx.room3:room3-common-tvossimulatorarm64
  • androidx.room3:room3-common-wasm-js
  • androidx.room3:room3-common-watchosarm32
  • androidx.room3:room3-common-watchosarm64
  • androidx.room3:room3-common-watchosdevicearm64
  • androidx.room3:room3-common-watchossimulatorarm64
  • androidx.room3:room3-compiler
  • androidx.room3:room3-compiler-processing
  • androidx.room3:room3-compiler-processing-testing
  • androidx.room3:room3-external-antlr
  • androidx.room3:room3-gradle-plugin
  • androidx.room3:room3-guava
  • androidx.room3:room3-livedata
  • androidx.room3:room3-migration
  • androidx.room3:room3-migration-iosarm64
  • androidx.room3:room3-migration-iossimulatorarm64
  • androidx.room3:room3-migration-js
  • androidx.room3:room3-migration-jvm
  • androidx.room3:room3-migration-linuxarm64
  • androidx.room3:room3-migration-linuxx64
  • androidx.room3:room3-migration-macosarm64
  • androidx.room3:room3-migration-tvosarm64
  • androidx.room3:room3-migration-tvossimulatorarm64
  • androidx.room3:room3-migration-wasm-js
  • androidx.room3:room3-migration-watchosarm32
  • androidx.room3:room3-migration-watchosarm64
  • androidx.room3:room3-migration-watchosdevicearm64
  • androidx.room3:room3-migration-watchossimulatorarm64
  • androidx.room3:room3-paging
  • androidx.room3:room3-paging-android
  • androidx.room3:room3-paging-guava
  • androidx.room3:room3-paging-iosarm64
  • androidx.room3:room3-paging-iossimulatorarm64
  • androidx.room3:room3-paging-jvm
  • androidx.room3:room3-paging-linuxarm64
  • androidx.room3:room3-paging-linuxx64
  • androidx.room3:room3-paging-macosarm64
  • androidx.room3:room3-paging-rxjava3
  • androidx.room3:room3-runtime
  • androidx.room3:room3-runtime-android
  • androidx.room3:room3-runtime-iosarm64
  • androidx.room3:room3-runtime-iossimulatorarm64
  • androidx.room3:room3-runtime-js
  • androidx.room3:room3-runtime-jvm
  • androidx.room3:room3-runtime-linuxarm64
  • androidx.room3:room3-runtime-linuxx64
  • androidx.room3:room3-runtime-macosarm64
  • androidx.room3:room3-runtime-tvosarm64
  • androidx.room3:room3-runtime-tvossimulatorarm64
  • androidx.room3:room3-runtime-wasm-js
  • androidx.room3:room3-runtime-watchosarm32
  • androidx.room3:room3-runtime-watchosarm64
  • androidx.room3:room3-runtime-watchosdevicearm64
  • androidx.room3:room3-runtime-watchossimulatorarm64
  • androidx.room3:room3-rxjava3
  • androidx.room3:room3-sqlite-wrapper
  • androidx.room3:room3-testing
  • androidx.room3:room3-testing-android
  • androidx.room3:room3-testing-iosarm64
  • androidx.room3:room3-testing-iossimulatorarm64
  • androidx.room3:room3-testing-js
  • androidx.room3:room3-testing-jvm
  • androidx.room3:room3-testing-linuxarm64
  • androidx.room3:room3-testing-linuxx64
  • androidx.room3:room3-testing-macosarm64
  • androidx.room3:room3-testing-tvosarm64
  • androidx.room3:room3-testing-tvossimulatorarm64
  • androidx.room3:room3-testing-wasm-js
  • androidx.room3:room3-testing-watchosarm32
  • androidx.room3:room3-testing-watchosarm64
  • androidx.room3:room3-testing-watchosdevicearm64
  • androidx.room3:room3-testing-watchossimulatorarm64

In possibly-related news, we have more Web support for SQLite:

  • androidx.sqlite:sqlite-js
  • androidx.sqlite:sqlite-wasm-js
  • androidx.sqlite:sqlite-web
  • androidx.sqlite:sqlite-web-js
  • androidx.sqlite:sqlite-web-wasm-js

Beyond that, we got:

  • androidx.camera:camera-common
  • androidx.camera:camera-common-testing
  • androidx.datastore:datastore-tink
  • androidx.datastore:datastore-tink-android
  • androidx.datastore:datastore-tink-jvm
  • androidx.lifecycle:lifecycle-viewmodel-navigation3-desktop
  • androidx.lifecycle:lifecycle-viewmodel-navigation3-iosarm64
  • androidx.lifecycle:lifecycle-viewmodel-navigation3-iossimulatorarm64
  • androidx.lifecycle:lifecycle-viewmodel-navigation3-js
  • androidx.lifecycle:lifecycle-viewmodel-navigation3-linuxarm64
  • androidx.lifecycle:lifecycle-viewmodel-navigation3-linuxx64
  • androidx.lifecycle:lifecycle-viewmodel-navigation3-macosarm64
  • androidx.lifecycle:lifecycle-viewmodel-navigation3-mingwx64
  • androidx.lifecycle:lifecycle-viewmodel-navigation3-tvosarm64
  • androidx.lifecycle:lifecycle-viewmodel-navigation3-tvossimulatorarm64
  • androidx.lifecycle:lifecycle-viewmodel-navigation3-wasm-js
  • androidx.lifecycle:lifecycle-viewmodel-navigation3-watchosarm32
  • androidx.lifecycle:lifecycle-viewmodel-navigation3-watchosarm64
  • androidx.lifecycle:lifecycle-viewmodel-navigation3-watchosdevicearm64
  • androidx.lifecycle:lifecycle-viewmodel-navigation3-watchossimulatorarm64
  • androidx.navigation:navigation-common-js
  • androidx.navigation:navigation-common-wasm-js
  • androidx.navigation:navigation-runtime-js
  • androidx.navigation:navigation-runtime-wasm-js
  • androidx.navigation:navigation-testing-js
  • androidx.navigation:navigation-testing-wasm-js

The roster of 1200+ updated artifacts can be found here!

Mar 11, 2026


Older Posts