v0.6.1 — Hardening Release (2026年06月15日)

Fixed — Resource leaks

• Fixed unclosed InputStream resource leak in XposedModuleInfo when parsing modern Xposed module properties from ZIP entries
• Fixed two unclosed InputStream resource leaks in ApkFile constructor when reading APKS/XAPK metadata and .idsig files — repeated APK scans could exhaust the ZipFile stream pool
• Modernized EglSurfaceBase.saveFrame() to try-with-resources

Fixed — Fatal-error swallowing

• Narrowed ~18 catch (Throwable) blocks to catch (Exception) across backup retention, changelog display, tracker window, locale reconciliation, component rule enumeration, process parsing, Settings.Global queries, activity launches, support-info bundle generation, MIME-type detection, and rule-storage initialization
• Prevents silent swallowing of OutOfMemoryError / StackOverflowError in standard library code

Changed — Docs & privacy rebaseline

• Rebased packaged manuals, build docs, and privacy policy for AppManagerNG identity
• Updated stale "App Manager" copy in support/settings strings

Install

Download AppManagerNG-v0.6.1-floss-release.apk below. This is the FLOSS (F-Droid compatible) flavor — no optional network features. Sideload via ADB or your preferred installer.

Full changelog: CHANGELOG.md

AppManagerNG v0.6.0 — Rootless Power

Signed with the same release key as v0.5.0, so it installs cleanly as an in-place update (and as a fresh install for new users). No special steps, no key issues — just download and install.

Highlights

• Package-filtered routine triggers — limit app install/update/uninstall triggers to a package glob (e.g. com.vendor.*).
• Backup/archive restore hardening — warning on weak (pre-v4) AES-GCM auth tags, decompression-bomb guard for zip/tar extraction, and the privileged root trampoline is now staged in internal device-protected storage.
• IPC binder-cache reliability — dead binders are evicted so privileged calls recover automatically instead of failing until the app restarts.
• Audit pass — batch-results crash guard, a resource leak fix, and microcopy/grammar polish.

Full details in CHANGELOG.md.

Which APK?

Both files are the same app and install on all devices (universal — arm64-v8a, armeabi-v7a, x86, x86_64).

• floss — fully offline build; optional online features are compiled out. Recommended for most users.
• full — adds opt-in online features (VirusTotal, Pithus, debloat-definition updates), each still gated behind its own toggle.

Verify (optional)

Signing certificate SHA-256:

21:5F:B4:70:63:2E:A6:CD:59:A4:BA:AB:35:0A:9E:0B:99:AD:11:0F:DD:FA:F5:A9:EA:64:61:E5:D0:C2:38:6C

Full Changelog: v0.4.2...v0.5.0

AppManagerNG v0.4.2 — Premium Polish

Premium polish release focused on trust, clarity, and feedback.

Highlights

• Refined first-run security handoff, warning tone, and shape consistency.
• Added contextual notification permission asks for wireless pairing, batch operations, and installer progress.
• Improved progress/completion visibility for long-running workflows.
• Includes recent security hardening and UX refinements from the post-v0.4.1 polish series.

Artifact

• AppManagerNG-v0.4.2.apk
• SHA-256: 30A5598D5DF3B7EC118D6940B9AD268F345B3FDA88F6B1887EB909F79D4761D9

Maintenance release. Concentrates 19 closed Now/Eng-Debt rows from the iter-19/iter-20 ROADMAP drains plus one CONFIRMED audit finding flagged for design (GCM cipher reuse — multi-file AES backups still unsafe).

Install

AppManagerNG-0.4.1-universal.apk — universal APK (all ABIs), signed with the AppManagerNG release certificate.

Signing certificate SHA-256: 21:5F:B4:70:63:2E:A6:CD:59:A4:BA:AB:35:0A:9E:0B:99:AD:11:0F:DD:FA:F5:A9:EA:64:61:E5:D0:C2:38:6C

To verify:

apksigner verify --print-certs AppManagerNG-0.4.1-universal.apk

What's new

Features

• Sui (Magisk-module Shizuku) detection in onboarding — surfaced as a "+ Sui" suffix on the Root status line (e.g. "Detected · KernelSU + Sui + ZygiskNext")
• AppOps row-tap 3-state cycle — ALLOWED → IGNORED → ERRORED, matching the Inure model. IGNORE silently no-ops the op without throwing SecurityException, the right move for apps that crash on hard DENY
• Cert fingerprint dialog now shows X.509 Subject + Issuer distinguished names alongside the SHA-256
• Per-OEM debloat risk ribbon — Samsung One UI 8.5 SmartSuggestions warning (UAD-NG #1394 verified field report)
• Backup-name dialog autocompletes from prior backup names (TextInputDropdownDialogBuilder with insertion-stable LinkedHashSet)
• Ops.isAdbShellRoot() detection helper — KernelSU v3.2.3+ ADB Root pathway, also covers APatch / Magisk-kang
• LocalServer bootstrap-failure signature — one-line Log.e capturing Build.MANUFACTURER/PRODUCT/DEVICE, SDK_INT, ro.lineage.version, exception class + cause chain. Targets the LineageOS 23.2 / Android 16 root-binder regression

Fixes

• A16 QPR2 silent clearApplicationUserData failure — PackageManagerCompat.clearApplicationUserData now snapshots IStorageStatsManager pre/post-clear and falls back to pm clear --user N <pkg> shell when the IPC silently lies (the QPR2 Poco F3 / Infinity-X 3.9 / Root-mode bug)

Compliance

• BouncyCastle 1.83 → 1.84 (CVE-2026-3505 / 5588 / 5598)
• Gson 2.13.2 → 2.14.0 (built-in java.time adapters, strict duplicate-JSON-key handling)
• Android 17 static-final reflection audit — 1 fix in TypefaceUtil, 1 deferred to targetSdk=37 bump
• Google Play Contacts/Location-Button policy audit (clean — NG declares neither permission)
• Android 17 System.load() read-only native audit (clean)
• libsu 6.0.0 Shell.cmd migration audit (clean)
• Zip-slip protection audit across extraction paths (clean — TarUtils and AndroidBackupExtractor both carry the canonical double-check guard)

Security advisory

• CVE-2026-0073 — May 2026 Android Security Bulletin patched a Critical zero-click proximal RCE in adbd. AppManagerNG itself is not vulnerable; ADB-mode and Shizuku-via-wireless-debug talk to the same daemon, so devices below patch level 2026年05月01日 carry residual risk. See docs/security-advisories/2026-05-08-cve-2026-0073-adb-mode.md

Documentation

• Sideloading verification position document — what the BR/ID/SG/TH Android Developer Verifier does and doesn't do for AppManagerNG users
• GrapheneOS A16 background-install fix patch reference — captures the isResumed + getCallingPackage() audit pattern for future port
• AOSP source-pull pinned to android-latest-release for hiddenapi/ stub harvesting

⚠️ Known issue: GCM cipher reuse on multi-file AES backups

AESCrypto.handleFiles() instantiates a single GCMBlockCipher once before the per-file loop and reuses it across every file with the same mIv. After file 0's doFinal(), the cipher is in finalized state and reused for file 1, with behavior that's either fail-fast or silent nonce-reuse depending on BouncyCastle's internals. Matches upstream AM #1958.

Multi-file AES-encrypted backups produced by v0.4.0 and v0.4.1 cannot be trusted to restore. OpenPGP / RSA / ECC backup modes are unaffected; single-file AES backups are unaffected.

Remediation requires a backup format version bump because the master-IV-only on-disk format can't represent per-file IVs. Three options laid out in docs/audits/2026-05-08-gcm-cipher-reuse-large-backup.md. The next release will pick a fix path and ship it behind a backup metadata version flag with a synthetic 4 GB blob round-trip regression test.

Full changelog: CHANGELOG.md (v0.4.1 section).