Build1 publisher2 min readPublished
Google keeps Android 17 QPR1's 84 new APIs on Pixels until December
Google shipped Android 17 QPR1 to Pixels on September 15 with 84 new APIs and held its source back from AOSP until December. Non-Pixel fleets and custom ROMs wait a quarter for those APIs and, according to GrapheneOS, for fixes to shared Android code.
The Engineer · Build desk
Drafted by a language model from the sources cited here and checked against its claim ledger before publication. How we use AISend a correction
What happened
- Per GrapheneOS, Google has kept both QPR1 and QPR3 Pixel-only since Android 16, and Samsung, Motorola and custom ROMs get this round's APIs with QPR2.
- The release is API level 37.1 and went out with the September Pixel Drop to 25 Pixel models, the Pixel 6 through the Pixel 11 Pro Fold.
- Its largest addition, the android.hardware.hid package, lets apps talk directly to USB and Bluetooth HID peripherals through a new system service and permission, with no custom driver.
- GrapheneOS says the September Pixel bulletin fixes standard Android components that other OEMs build on, and those fixes appear in neither the public security bulletin nor partners' preview patches.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- constraint Controller and peripheral apps get driverless HID access only on Pixels until QPR2 ships, so the custom-driver path has to stay in the product for every other device.
- exposure For about a quarter, Samsung, Motorola and custom-ROM devices run shared Android code that Google has already fixed on its own phones, and their makers cannot take that fix from the public bulletin.
- precedent With QPR1 and QPR3 both held back, about six months of every year now have a newest Android API level that only Pixels run.
The schedule goes back to March 26, 2025. That day Google confirmed to Android Authority that all Android OS development was moving to its private internal branch [10]. It said it was "committed to publishing source code to AOSP after each release" [10]. The statement did not say how long after.
Android 16 QPR1 showed what that meant in practice. It reached Pixels on September 3, 2025, and its source landed in AOSP on November 11, 69 days later [11]. At the time Google told Android Authority it "typically publishes source within 24-48 hours" and that the code would come "in the coming weeks" [12]. The delay was about 34 times the 48-hour upper end of that norm [2]. The change in Android 17 QPR1, per the dev.to writeup, is that a Pixel-only release now adds public APIs for app developers [13].
The app-side gap only adds code. The 37 to 37.1 diff has 84 additions, 233 changes and zero removals, about 0.52% of the platform by Google's count [2]. So nothing an app already calls goes away on a Samsung or Motorola phone [2]. The additions index lists Context.HID_SERVICE and Manifest.permission.ACCESS_HID for the new HID service. It also lists InputManager.addPeripheralCustomization and ButtonCustomizationTrigger in android.hardware.input [8]. The release's version constant is Build.VERSION_CODES_FULL.CINNAMON_BUN_1 [8]. CINNAMON_BUN_1 is Android 17's internal dessert name, so the dessert names are back, inside a constant [9].
The patches are harder to plan around. According to GrapheneOS, other OEMs get the shared-component fixes with QPR2 in December [19]. Until then, anyone outside Google can see them only as a Pixel binary. Anyone can download it, and nobody outside Google can read the source [16]. I think holding the source back defeats its own purpose. Anyone who diffs a fix in a public image can recover it, and that includes someone hunting for the bug it closes [16]. GrapheneOS plans to do exactly that: reverse engineer the patches out of the binary and ship them early [17].
wps, who posted the top comment on the Hacker News thread, wrote: "Google simply regrets android being open source." [14] The writeup's author would not go that far, and neither would I. The yearly release and QPR2 still land in AOSP [15]. GrapheneOS compared the delay to Honeycomb, the tablet-only Android 3 release from 2011. Google held that code back until Ice Cream Sandwich, Android 4.0 [5]. Honeycomb was one release. The current schedule holds back two releases a year, for about three months each [18].
What to watch
- Whether the Android 17 QPR1 source reaches AOSP with QPR2 in December, as GrapheneOS expects, or arrives late the way Android 16 QPR1's did.
- Whether GrapheneOS ships fixes reverse engineered from the September Pixel binary before Samsung and Motorola devices receive them.
- Whether Google moves the shared-component fixes into the public Android Security Bulletin or the partner preview patches.