Android Developers Blog
Follow
Introducing the AndroidX Security State Libraries: A Unified View of Device Security
Android is releasing new libraries to improve device security transparency. The AndroidX Security State version 1.1.0 and Security State Provider version 1.0.0 libraries offer a centralized way to understand device security postures and pending updates. These tools allow developers to verify security at a component level, moving beyond the old single Security Patch Level. The libraries introduce three new patch levels: Device SPL (DSPL) for the installed level, Published SPL (PSPL) for the latest bulletin level, and Available SPL (ASPL) for ready downloads. These levels are tracked for the system, system modules, and the kernel. This granular data enables developers and enterprises to make informed security decisions based on actual protection and pending updates. For instance, banking apps can check ASPL before high-value transactions and prompt users to update if needed. The Security State Provider library standardizes how update clients report availability, making ASPL accessible via a unified API. This integration with the Open Source Vulnerabilities database provides a more accurate "effective" security state. Additionally, OEMs can now declare supplemental patch information to receive immediate credit for backported fixes. Developers can explore guides and documentation to begin using these new security libraries. Feedback on the libraries can be provided through the Android Issue Tracker.