September's security updates have been posted for most of the Nexus family, although a few devices are still mysteriously lagging behind on official Nougat images. The source code for most of the changes has been uploaded to the Android Open Source Project (AOSP) and we've generated a list of those changes for quick and easy viewing. The security bulletin already details most of the issues resolved this month, but there may be additional details lurking behind the code, so feel free to take a look around.

There are currently five new builds posted: three for Marshmallow (MMB30W, MOB31E, MTC20K) and two for Nougat (NRD90R, NRD90S). I'll save everybody a couple moments of page loads to say that each changelog for Marshmallow is basically identical, except for MTC20K, which also adds a single CTS test. The changelogs for Nougat include a few more fixes distinct from those on 6.0.1.

Most of the changes will probably only make sense to people with some experience or familiarity with particular projects. However, this patch appears to prevent the Settings app from being started during device setup, a step that's usually necessary to bypass factory reset protection on Marshmallow. If anything else interesting turns up, drop a line in the comments.

The MTC20L version tag (for the Nexus 6P) is still missing from AOSP, and there are still three devices completely without Nougat firmware builds or version tags. We'll keep an eye out for those and update this post when changelogs are ready.

Changelogs for the 6P are now available

A code drop for the Nougat and Marshmallow builds with September's security updates came last night, shortly after the factory image and full OTA were posted. Unfortunately, both changelogs are very sparse, containing only a single change each. Neither explains the long-delay in posting the 6P firmware. That may be further evidence to suggest the cause was related to proprietary binaries (drivers), but there are still many possible explanations. There are still no signs of Android 7.0 Nexus 6 or Nexus 9 LTE changelogs or firmware images.

Reading the changelogs?

There are a lot of questions and confusion surrounding changelogs, so here are a few reminders and tips that might clear some things up.

To begin with, all changelogs are named with their starting and ending tags. That's because changelogs pick up where previous changelogs left off, but the names and numbers aren't necessarily sequential. For example, 6.0.1_r56 is based on r48, not on r55. Changelogs always build off of another changelog, sometimes even in the same month. Also remember that while most patches are only written once, they may be copied across multiple development branches running in parallel, so a single patch may appear in more than one changelog.

Also remember that these changelogs only list changes uploaded to the Android Open Source Project. They do not include changes made to the closed source proprietary binaries used to build the final firmware for a device. Sometimes a new tag and build number are created for updates where only those binaries have been replaced, which usually results in a virtually empty changelog.

Finally, changelogs for developer previews contain only a short list of changes. This is because Google does not post the full code for a new version of Android until the OS is final. Most of the code disclosed prior to a final OS release is usually for compliance with the GPL or similarly licensed projects, or belonging to projects Google itself chooses to make available in advance.

September security updates: (Sept 6)

(Sept 9)

(Sept 16)