6

I've got a Pixel phone from Google, but it really doesn't matter, I guess the question would apply to any AOSP-based device. They state that they provide 3 years of version updates and security patches.

I've got an update notification on my phone that it's ready to update to the next Android version (11), but the point is that I don't want to switch, I want to stay on my beloved old version that I'm used to, yet still I want to get security patches to keep my phone safe and bug-free. When looking at Android security bulletin page I see a list of bugfixes and the Android versions they apply to, and some of them span as far as 4 versions back, which practically means the manufacturer is theoretically able to release a patch for my Android version. Thus, I'd like to understand:

What's the Android release lifecycle when it comes to pushing new Android versions and releasing security patches? What role does Google Play system update play in this?

My current situation: Android 10, security patch level - Aug 5, Google Play system update - Sep 1. When clicking on Pixel security bulletin link, nowhere is mentioned that the security patch would apply specifically to version 10 or 11, it just lists the bugfixes.

Does this mean that it's assumed the user would be running the latest Android version, and the patches are built against that latest version he was supposed to have, and he won't be able to receive those unless he upgrades the Android version?

Improve this question
2
  • This question was "downsized" without my approval. The original title of the question was: "Explain Android release lifecycle", which is more broad and demanding to answer. This question won't be marked as answered until at least 1 year has passed since the original post. You've got all the time required and I (and community) gratefully expecting the answer.
    – kotique
    Commented Oct 13, 2020 at 17:13
  • 1
    Sorry if you feel it's "downsized", I really didn't mean it, though both the answerers (including me) already focused on the security update only before it was edited. The reason I skipped about the complete Android release lifecycle because I remember it has been asked and explained before on Is there a technical reason Android update story is so bad? which would make this a duplicate instead. Feel free to clarify more if the answer is still not sufficient.
    – Andrew T. ♦
    Commented Oct 13, 2020 at 18:12

2 Answers 2

Reset to default
5

Google provides security updates for older AOSP major versions, but they do not provide updates for Pixel phones.

You can see this easily in the list of available Firmware images for Pixel devices:

Take for example the Pixel 3a:

  • The available Android 9 releases are dated from March 2019 to August 2019
  • The available Android 10 releases are dated from September 2019 to August 2020
  • The available Android 11 releases are dated from September 2020 to October 2020 (now)

As these are all factory images available for the Pixel 3a you can see that there are no (security) updates for Android 9 based images after Android 10 has been released and the same is true for Android 10 which stops after Android 11 has been released.

The provided images are not OTA updates received by regular bootloader locked devices, but I would assume that Google does provide the same versions as full firmware images and OTA updates.

Improve this answer
4

Security patches are (almost) always applied to the latest Android version.

It may be easier to imagine the Android version as codebase A and the security patch as codebase B. Each Android version can apply each relevant security patch if it's compatible, e.g.

  • Device X on Android 10 with September 2020 security patch (end of Android version + security update)
  • Device Y on Android 10 with October 2020 security patch (end of Android version update, still get security update)
  • Device Z on Android 11 with October 2020 security patch (still get both Android version + security updates)

However, the final ROM image is baked from a specific Android version codebase with a collection of security patches, which will be delivered through OTA or flashing the image file manually. Thus, end-users cannot selectively apply a newer security patch without updating the Android version.

This was the case back when Google's Nexus-line devices generally only provided 2 years of Android version updates but 3 years of security patch updates; a year-long security patch update without a new Android version.

However, custom ROMs with older Android versions can still apply the latest security patches if supported. For example: LineageOS 17.1 (based on Android 10) for Google Pixel (build 20201010) has applied security level for Oct 5, 2020 (which has been applied on AOSP version 8.0, 8.1, 9, 10, and 11).

a list of changes for LineageOS 17.1 build 20201010 for Google Pixel, including an update to the text for security patch level to "2020-10-05".

Regarding Google Play system update, it's not related to the Android version and security patch.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .