2026-01-05 patch level

Watermelon

Hello, @spring-onion suggested me to post this here:

Your new release, 2026010800, says you raised the patch level to 2026-01-05, but I don't see the Pixel Update Bulletin published yet, and I don't see an OTA update package for the stock Pixel OS published yet either. Is this a mistake or do you know that the Pixel Update Bulletin is going to be empty? (I now read that the stock Pixel OS has delays in updates recently — this explains why neither has been published yet for January 2026.)

I thought your OEM collaboration let's you get access to Android Security Bulletins since these are the ones distributed widely under an embargo, but Pixel Update Bulletins are exclusive to Google.

Edit: It's not such a big deal to me if the patch level is a mistake, because Google destroyed the usefulness of patch levels in last June, and it's only relevant for this month. But I'm still curious.

@GrapheneOS thank you

ron

Watermelon I thought your OEM collaboration let's you get access to Android Security Bulletins since these are the ones distributed widely under an embargo, but Pixel Update Bulletins are exclusive to Google.

GrapheneOS is based on the Android Open Source Project, not PixelOS. The Android Security Bulletin has already been published, but not the Pixel bulletin: https://source.android.com/docs/security/bulletin/2026/2026-01-01

Here is the latest PixelOS bulletin: https://source.android.com/docs/security/bulletin/pixel/2025-12-01

GrapheneOS

Watermelon Android security patch level has always been defined based on the Android Security Bulletin. We chose to wait for the Pixel Update Bulletin before raising it to 2026-01-05 but that was never a requirement for following the official Android security patch level definition. Due to their inconsistent releases for the stock Pixel OS which occur are increasingly unpredictable dates with a subset of the devices often skipped, it no longer makes sense to try to include it. We believe they're skipping updating 6th/7th gen Pixels for monthly updates once they passed the 3 year mark unless a security patch applies to them, but that's not written down anywhere. We'd have to somehow determine which change received the single Pixel CVE this month which may only impact 10th gen Pixels or another subset of the devices, then determine that it's not relevant for the skipped devices. Driver and firmware patches are required for Android security patch levels for the subset listed in the Android Security Bulletins but the Pixel Update Bulletins were always going beyond it. The field is called the Android security patch level, not the Pixel security patch level. We treated it as the broader Pixel security patch level up until they messed things up too much to always confidently know what that means anymore.

Watermelon

ron GrapheneOS is based on the Android Open Source Project, not PixelOS.

I know.

ron The Android Security Bulletin has already been published, but not the Pixel bulletin

This is the thing. The ASB includes patches for both the -01 patch level and -05 level of each month. The PUB has more patches for the -05 of each month. The GrapheneOS team always waits with raising the patch level to -05 until they have the complete -05 level (from both the ASB and PUB of the month), but this month they raised it to 2026-01-05 despite the PUB not published yet. And GrapheneOS has advance access to the ASBs because of their collaboration with the unnamed OEM, but PUBs are exclusive to Pixels so why would Google distribute them to other companies in advance? So either GrapheneOS has inside information from Google that the PUB is going to be empty, or they mistakenly set it to 2026-01-05 but should've set it to 2026-01-01 until the PUB is published.

ron

Watermelon but PUBs are exclusive to Pixels

Ahh I get it now. Yeah they wouldn't publish the PUBs to other companies.
Do the devs of GrapheneOS have a strict release scheme? Is it a locked rule that they have to call it the 2026-01-01? The Security bulletin was published on 2026-01-05. Even though it is not the full patch, it can still be named 2026-01-05, can't it?