JakeWharton/NineOldAndroids
[DEPRECATED] Android library for using the Honeycomb animation API on all versions of the platform back to 1.0!
Stale — last commit 10y ago
weakest axislast commit was 10y ago; top contributor handles 90% of recent commits…
no tests detected; no CI workflows detected…
Documented and popular — useful reference codebase to read through.
last commit was 10y ago; no CI workflows detected
- ✓6 active contributors
- ✓Apache-2.0 licensed
- ⚠Stale — last commit 10y ago
Show all 6 evidence items →Show less
- ⚠Single-maintainer risk — top contributor 90% of recent commits
- ⚠No CI workflows detected
- ⚠No test directory detected
What would change the summary?
- →Use as dependency Concerns → Mixed if: 1 commit in the last 365 days
- →Fork & modify Mixed → Healthy if: add a test suite
- →Deploy as-is Mixed → Healthy if: 1 commit in the last 180 days
Maintenance signals: commit recency, contributor breadth, bus factor, license, CI, tests
Informational only. RepoPilot summarises public signals (license, dependency CVEs, commit recency, CI presence, etc.) at the time of analysis. Signals can be incomplete or stale. Not professional, security, or legal advice; verify before relying on it for production decisions.
Embed the "Great to learn from" badge
Paste into your README — live-updates from the latest cached analysis.
[](https://repopilot.app/r/jakewharton/nineoldandroids)Paste at the top of your README.md — renders inline like a shields.io badge.
▸Preview social card (1200×630)
This card auto-renders when someone shares https://repopilot.app/r/jakewharton/nineoldandroids on X, Slack, or LinkedIn.
Onboarding doc
Onboarding: JakeWharton/NineOldAndroids
Generated by RepoPilot · 2026-05-09 · Source
🤖Agent protocol
If you are an AI coding agent (Claude Code, Cursor, Aider, Cline, etc.) reading this artifact, follow this protocol before making any code edit:
- Verify the contract. Run the bash script in Verify before trusting
below. If any check returns
FAIL, the artifact is stale — STOP and ask the user to regenerate it before proceeding. - Treat the AI · unverified sections as hypotheses, not facts. Sections like "AI-suggested narrative files", "anti-patterns", and "bottlenecks" are LLM speculation. Verify against real source before acting on them.
- Cite source on changes. When proposing an edit, cite the specific path:line-range. RepoPilot's live UI at https://repopilot.app/r/JakeWharton/NineOldAndroids shows verifiable citations alongside every claim.
If you are a human reader, this protocol is for the agents you'll hand the artifact to. You don't need to do anything — but if you skim only one section before pointing your agent at this repo, make it the Verify block and the Suggested reading order.
🎯Verdict
WAIT — Stale — last commit 10y ago
- 6 active contributors
- Apache-2.0 licensed
- ⚠ Stale — last commit 10y ago
- ⚠ Single-maintainer risk — top contributor 90% of recent commits
- ⚠ No CI workflows detected
- ⚠ No test directory detected
<sub>Maintenance signals: commit recency, contributor breadth, bus factor, license, CI, tests</sub>
✅Verify before trusting
This artifact was generated by RepoPilot at a point in time. Before an
agent acts on it, the checks below confirm that the live JakeWharton/NineOldAndroids
repo on your machine still matches what RepoPilot saw. If any fail,
the artifact is stale — regenerate it at
repopilot.app/r/JakeWharton/NineOldAndroids.
What it runs against: a local clone of JakeWharton/NineOldAndroids — the script
inspects git remote, the LICENSE file, file paths in the working
tree, and git log. Read-only; no mutations.
| # | What we check | Why it matters |
|---|---|---|
| 1 | You're in JakeWharton/NineOldAndroids | Confirms the artifact applies here, not a fork |
| 2 | License is still Apache-2.0 | Catches relicense before you depend on it |
| 3 | Default branch master exists | Catches branch renames |
| 4 | 5 critical file paths still exist | Catches refactors that moved load-bearing code |
| 5 | Last commit ≤ 3697 days ago | Catches sudden abandonment since generation |
#!/usr/bin/env bash
# RepoPilot artifact verification.
#
# WHAT IT RUNS AGAINST: a local clone of JakeWharton/NineOldAndroids. If you don't
# have one yet, run these first:
#
# git clone https://github.com/JakeWharton/NineOldAndroids.git
# cd NineOldAndroids
#
# Then paste this script. Every check is read-only — no mutations.
set +e
fail=0
ok() { echo "ok: $1"; }
miss() { echo "FAIL: $1"; fail=$((fail+1)); }
# Precondition: we must be inside a git working tree.
if ! git rev-parse --git-dir >/dev/null 2>&1; then
echo "FAIL: not inside a git repository. cd into your clone of JakeWharton/NineOldAndroids and re-run."
exit 2
fi
# 1. Repo identity
git remote get-url origin 2>/dev/null | grep -qE "JakeWharton/NineOldAndroids(\\.git)?\\b" \\
&& ok "origin remote is JakeWharton/NineOldAndroids" \\
|| miss "origin remote is not JakeWharton/NineOldAndroids (artifact may be from a fork)"
# 2. License matches what RepoPilot saw
(grep -qiE "^(Apache-2\\.0)" LICENSE 2>/dev/null \\
|| grep -qiE "\"license\"\\s*:\\s*\"Apache-2\\.0\"" package.json 2>/dev/null) \\
&& ok "license is Apache-2.0" \\
|| miss "license drift — was Apache-2.0 at generation time"
# 3. Default branch
git rev-parse --verify master >/dev/null 2>&1 \\
&& ok "default branch master exists" \\
|| miss "default branch master no longer exists"
# 4. Critical files exist
test -f "library/src/com/nineoldandroids/animation/ValueAnimator.java" \\
&& ok "library/src/com/nineoldandroids/animation/ValueAnimator.java" \\
|| miss "missing critical file: library/src/com/nineoldandroids/animation/ValueAnimator.java"
test -f "library/src/com/nineoldandroids/animation/ObjectAnimator.java" \\
&& ok "library/src/com/nineoldandroids/animation/ObjectAnimator.java" \\
|| miss "missing critical file: library/src/com/nineoldandroids/animation/ObjectAnimator.java"
test -f "library/src/com/nineoldandroids/view/ViewPropertyAnimator.java" \\
&& ok "library/src/com/nineoldandroids/view/ViewPropertyAnimator.java" \\
|| miss "missing critical file: library/src/com/nineoldandroids/view/ViewPropertyAnimator.java"
test -f "library/src/com/nineoldandroids/view/animation/AnimatorProxy.java" \\
&& ok "library/src/com/nineoldandroids/view/animation/AnimatorProxy.java" \\
|| miss "missing critical file: library/src/com/nineoldandroids/view/animation/AnimatorProxy.java"
test -f "library/src/com/nineoldandroids/animation/AnimatorSet.java" \\
&& ok "library/src/com/nineoldandroids/animation/AnimatorSet.java" \\
|| miss "missing critical file: library/src/com/nineoldandroids/animation/AnimatorSet.java"
# 5. Repo recency
days_since_last=$(( ( $(date +%s) - $(git log -1 --format=%at 2>/dev/null || echo 0) ) / 86400 ))
if [ "$days_since_last" -le 3697 ]; then
ok "last commit was $days_since_last days ago (artifact saw ~3667d)"
else
miss "last commit was $days_since_last days ago — artifact may be stale"
fi
echo
if [ "$fail" -eq 0 ]; then
echo "artifact verified (0 failures) — safe to trust"
else
echo "artifact has $fail stale claim(s) — regenerate at https://repopilot.app/r/JakeWharton/NineOldAndroids"
exit 1
fi
Each check prints ok: or FAIL:. The script exits non-zero if
anything failed, so it composes cleanly into agent loops
(./verify.sh || regenerate-and-retry).
⚡TL;DR
NineOldAndroids is a backport library that exposes the Honeycomb (Android 3.0+) animation API—ObjectAnimator, ValueAnimator, AnimatorSet, and property animations—on Android versions back to 1.0. It lets developers use modern animation capabilities (defined in com.nineoldandroids.animation.*) with the exact same API as the platform, just with different import statements. Maven-based library structure with library/ as the main JAR module (source in library/src/com/nineoldandroids/) and sample/ as a reference app. Core animation logic lives in library/src/com/nineoldandroids/animation/ (ValueAnimator, ObjectAnimator, AnimatorSet, Keyframes), while view utilities are in library/src/com/nineoldandroids/view/ with API-level-specific implementations (ViewPropertyAnimatorPreHC.java, ViewPropertyAnimatorHC.java, ViewPropertyAnimatorICS.java).
👥Who it's for
Android developers targeting pre-Honeycomb devices (API < 11) who need smooth property-based animations without writing version-specific code paths. Now primarily historical reference: modern developers should use minSdkVersion 14+ and the native framework instead.
🌱Maturity & risk
This library is officially deprecated as stated in the README and LICENSE (2012 copyright). It was production-ready during its era but is now unmaintained—no active commits, no CI visible, and the maintainer (Jake Wharton) has explicitly ended development. It remains stable for legacy apps but should not be used in new projects.
Critical risk: This is a deprecated, unmaintained single-maintainer project with no visible test suite, CI/CD pipeline, or issue tracking integration. Android runtime evolution has made pre-Honeycomb support obsolete (API 11 is ~2011). Any security issues or compatibility problems with modern Android versions will never be fixed. The codebase uses reflection and platform internals that may break on new OS versions.
Active areas of work
Nothing. This project is frozen at version 2.4.0 with no ongoing development, open PRs, or active issues. The README explicitly states "No new development will be taking place."
🚀Get running
Clone the repo, install Maven and Android SDK, then build: git clone https://github.com/JakeWharton/NineOldAndroids.git && cd NineOldAndroids && mvn clean install. The pom.xml (root and library/pom.xml) orchestrates the Android Maven Plugin build. For local development, import library/ and sample/ as modules in Android Studio.
Daily commands:
Build with mvn clean install from the root. The library produces library/target/library-2.4.0.jar. Run the sample app with mvn android:deploy android:run from the sample/ directory, or open sample/AndroidManifest.xml in Android Studio and run it as a normal app.
🗺️Map of the codebase
library/src/com/nineoldandroids/animation/ValueAnimator.java— Core animation engine that drives all timing, interpolation, and value calculations—the foundation for all animation types in the library.library/src/com/nineoldandroids/animation/ObjectAnimator.java— Primary public API for animating object properties; delegates to ValueAnimator and uses reflection to set property values on targets.library/src/com/nineoldandroids/view/ViewPropertyAnimator.java— High-level fluent API for animating View properties; routes to version-specific implementations (HC, ICS, or PreHC).library/src/com/nineoldandroids/view/animation/AnimatorProxy.java— Enables View animation on pre-Honeycomb devices by intercepting draw operations and applying transformation matrices.library/src/com/nineoldandroids/animation/AnimatorSet.java— Orchestrates sequential and parallel execution of multiple animators; implements complex animation choreography patterns.library/src/com/nineoldandroids/animation/PropertyValuesHolder.java— Encapsulates property-to-value mappings for multi-property animations; manages keyframes and evaluators per property.library/src/com/nineoldandroids/animation/PreHoneycombCompat.java— Compatibility shim providing fallback animation logic for Android versions below 3.0 using reflection and frame-based timing.
🛠️How to make changes
Add a new Property type for custom object animation
- Create a new evaluator by extending TypeEvaluator<YourType> in library/src/com/nineoldandroids/animation/ (
library/src/com/nineoldandroids/animation/TypeEvaluator.java) - Implement evaluate() to interpolate between start and end values (
library/src/com/nineoldandroids/animation/FloatEvaluator.java) - Pass the evaluator to ObjectAnimator.ofObject(target, propertyName, evaluator, values...) (
library/src/com/nineoldandroids/animation/ObjectAnimator.java) - Test with sample code in sample/src/com/jakewharton/nineoldandroids/sample/apidemos/CustomEvaluator.java (
sample/src/com/jakewharton/nineoldandroids/sample/apidemos/CustomEvaluator.java)
Animate a View property across Android versions
- Use ViewPropertyAnimator.animate() on your View for simplest API (
library/src/com/nineoldandroids/view/ViewPropertyAnimator.java) - Library automatically routes to HC native implementation or PreHC AnimatorProxy based on API level (
library/src/com/nineoldandroids/view/ViewPropertyAnimatorHC.java) - For pre-HC devices, verify AnimatorProxy.wrap() is applied to transform the View (
library/src/com/nineoldandroids/view/animation/AnimatorProxy.java) - Chain property animations: view.animate().translationX(100).rotationY(360).duration(500).start() (
sample/src/com/jakewharton/nineoldandroids/sample/VPADemo.java)
Orchestrate multiple animators with precise timing
- Create individual ObjectAnimator or ValueAnimator instances for each property/object (
library/src/com/nineoldandroids/animation/ObjectAnimator.java) - Add them to AnimatorSet using playTogether(), playSequentially(), or play().with/before/after() (
library/src/com/nineoldandroids/animation/AnimatorSet.java) - Set timing constraints: set.setDuration(ms) or per-animator via PropertyValuesHolder keyframes (
library/src/com/nineoldandroids/animation/PropertyValuesHolder.java) - Example: sample demonstrates animation choreography in BouncingBalls.java (
sample/src/com/jakewharton/nineoldandroids/sample/apidemos/BouncingBalls.java)
Add support for animating a custom View property
- Create a custom Property<MyView, MyType> class extending Property in library/src/com/nineoldandroids/util/ (
library/src/com/nineoldandroids/util/Property.java) - Override get() and set() to read/write the property via public getters/setters (
library/src/com/nineoldandroids/util/ReflectiveProperty.java) - Pass the Property to ObjectAnimator.ofObject(view, property, evaluator, ...values) (
library/src/com/nineoldandroids/animation/ObjectAnimator.java) - Verify on pre-HC devices that the property setter triggers invalidate() to refresh the View (
library/src/com/nineoldandroids/view/animation/AnimatorProxy.java)
🔧Why these technologies
- Java reflection (PropertyValuesHolder, ReflectiveProperty) — Enables generic property animation without compile-time knowledge of target objects; allows ObjectAnimator.ofFloat(obj, "propertyName", ...) syntax
- Transform matrices (AnimatorProxy) — Pre-Honeycomb devices lack native View property animation; matrix transforms applied at draw-time simulate rotation, scaling,
🪤Traps & gotchas
This is a deprecated project—use at your own risk. Specific gotchas: (1) The library targets old Android platforms and uses deprecated Android APIs (e.g., reflection on pre-Honeycomb APIs that may not exist); (2) sample/project.properties and library/project.properties hardcode target=android-15, which will not work with modern Android SDK layouts—you may need to update to a newer API level; (3) AnimatorProxy.java uses View.setDrawingCacheEnabled() and matrix operations that have performance implications; (4) The Checkstyle rules (checkstyle.xml) enforce strict formatting that may conflict with modern IDE auto-format; (5) No unit tests are visible in the file list, making changes risky. Building requires android-maven-plugin and Maven 2+, both effectively abandoned.
🏗️Architecture
💡Concepts to learn
- API backporting via composition and reflection — NineOldAndroids demonstrates the core pattern of backporting: use reflection to detect native APIs at runtime (Honeycomb+), delegate to them if present, or use custom implementations (PreHoneycombCompat) otherwise. Understanding this is critical for maintaining legacy code or porting modern APIs to old platforms.
- Property-based animation via Reflection — ObjectAnimator uses reflection (ReflectiveProperty.java) to discover and invoke setter methods by name at runtime (e.g., setAlpha, setRotation). This is how animations bind to arbitrary object properties without boilerplate—a pattern still used in modern Android frameworks.
- Evaluators and interpolation — ArgbEvaluator, FloatEvaluator, and IntEvaluator convert animation progress [0, 1] into concrete property values. Understanding how to chain evaluators and time interpolation is essential for custom animations and modern tweening libraries.
- View transformation via matrix operations (AnimatorProxy pattern) — AnimatorProxy.java animates Views on pre-Honeycomb by overriding draw() and applying Matrix transforms (scale, rotate, translate). This demonstrates the cost of animation on older platforms and why native support was critical—relevant for understanding performance on legacy devices.
- Keyframe-based animation (KeyframeSet, FloatKeyframeSet, IntKeyframeSet) — Keyframes allow defining multiple animation segments (e.g., animate to 50% at 500ms, then to 100% at 1000ms). This is how complex multi-stage animations are built in both legacy and modern Android—critical for understanding timeline-based animations.
- Version detection and abstraction (PreHoneycombCompat, ViewPropertyAnimatorHC/ICS/PreHC) — The library uses strategy pattern to swap implementations based on API level (e.g., ViewPropertyAnimator delegates to ViewPropertyAnimatorHC on 3.0+, or ViewPropertyAnimatorPreHC on older versions). This is a textbook example of version-aware API design in mobile frameworks.
- AnimatorSet composition (sequential and parallel execution) — AnimatorSet.java demonstrates how to compose multiple animators with playTogether() and playSequentially(). This pattern is foundational for choreographing complex UI transitions and is still used in Jetpack Compose animations.
🔗Related repos
android/platform_frameworks_base— The authoritative source for the native android.animation.* package that NineOldAndroids backports; essential reference for understanding the original API designJakeWharton/butterknife— Companion library by the same author for view binding; often used alongside NineOldAndroids in legacy Android apps for cleaner property accessairbnb/lottie-android— Modern animation library that supersedes NineOldAndroids; handles JSON animation files and works on all API levels without legacy backporting painandroid/androidx-animations— Official AndroidX animation utilities; the modern replacement for NineOldAndroids on current Android versions (API 14+)JakeWharton/salvage— Archive of other pre-Honeycomb compatibility libraries by Jake Wharton; historical context for API backporting patterns in early Android
🪄PR ideas
To work on one of these in Claude Code or Cursor, paste:
Implement the "<title>" PR idea from CLAUDE.md, working through the checklist as the task list.
Add unit tests for ObjectAnimator and ValueAnimator core functionality
The repo lacks visible test coverage despite containing complex animation logic. ObjectAnimator.java and ValueAnimator.java are critical core classes that handle property animation, timing, and interpolation across Android versions 1.0+. Adding comprehensive unit tests would ensure backward compatibility doesn't regress and catch edge cases in the pre-Honeycomb compatibility layer.
- [ ] Create library/src/test/ directory structure mirroring library/src/com/nineoldandroids/
- [ ] Add unit tests for ValueAnimator.java covering frame timing, listener callbacks, and pause/resume functionality
- [ ] Add unit tests for ObjectAnimator.java covering property reflection, multi-property animation, and PreHoneycombCompat code paths
- [ ] Add unit tests for PropertyValuesHolder.java covering type evaluation and keyframe interpolation
- [ ] Configure maven-surefire-plugin in library/pom.xml to run tests during build
- [ ] Update CHANGELOG.md documenting test coverage additions
Add AnimatorProxy.java compatibility layer tests and document version-specific behavior
AnimatorProxy.java is a critical compatibility shim that handles view animation on pre-Honeycomb devices. There are separate implementations (ViewPropertyAnimatorPreHC.java, ViewPropertyAnimatorHC.java, ViewPropertyAnimatorICS.java) but no documentation or tests clarifying which class handles which Android version. This creates maintenance risk when contributors modify these files.
- [ ] Create sample/src/com/jakewharton/nineoldandroids/tests/ directory for instrumentation tests
- [ ] Add instrumentation tests in AnimatorProxyTest.java covering transformation (rotation, scale, alpha) on API levels 1-10 (pre-HC)
- [ ] Add documentation block in library/src/com/nineoldandroids/view/animation/AnimatorProxy.java explaining version delegation logic
- [ ] Document in README.md which ViewPropertyAnimator* class is used for each Android version range
- [ ] Add inline comments in ViewPropertyAnimator.java explaining the version detection and delegation pattern
Add missing documentation for Property and ReflectiveProperty reflection mechanism
The library's core innovation is enabling pre-Honeycomb property animation through reflection-based property access (Property.java, ReflectiveProperty.java, FloatProperty.java, IntProperty.java). This mechanism is non-obvious and undocumented, making it difficult for contributors to understand or extend. Adding API documentation with examples would reduce confusion.
- [ ] Add comprehensive Javadoc to library/src/com/nineoldandroids/util/Property.java explaining the generic property contract and reflection strategy
- [ ] Add Javadoc to library/src/com/nineoldandroids/util/ReflectiveProperty.java documenting the reflection-based getter/setter discovery and caching
- [ ] Add Javadoc to library/src/com/nineoldandroids/util/FloatProperty.java and IntProperty.java with concrete examples
- [ ] Create a new PROPERTY_USAGE.md document explaining how to use custom Property subclasses in ObjectAnimator with code examples
- [ ] Add a sample in sample/src/ demonstrating custom Property implementation for a non-standard view attribute
🌿Good first issues
- Add unit tests for ValueAnimator.java (none visible in repo). Start with basic timing tests: verify that an animator completes in the expected duration, that listeners fire at start/end, and that frame rates are respected. This would catch regressions if anyone attempts to maintain the library.
- Document the API differences between com.nineoldandroids.* and the native android.animation.* packages in the README. For example, clarify which methods are missing, which have different signatures, and which classes have performance caveats (e.g., AnimatorProxy overhead). Link to sample code in sample/src for each major class.
- Add missing Javadoc comments to PropertyValuesHolder.java and KeyframeSet.java. These classes are complex and have no class-level or method-level documentation, making them hard for new contributors to understand. Use the native Android source as reference.
⭐Top contributors
Click to expand
Top contributors
- @JakeWharton — 90 commits
- @fpillet — 4 commits
- @SimonVT — 2 commits
- [@Beowulf Bjornson](https://github.com/Beowulf Bjornson) — 2 commits
- @jpmcosta — 1 commits
📝Recent commits
Click to expand
Recent commits
d582f0e— Deprecate. (JakeWharton)9f20fd7— [maven-release-plugin] prepare release 2.4.0 (JakeWharton)c846792— Ensure ViewHelper has all methods. Consolidate helpers into single class. (JakeWharton)deb42c8— Update android maven plugin version. (JakeWharton)cc9a6bc— Bump version to 2.4.0. Update manifest a bit. (JakeWharton)da9dd5c— Clean up pivot math for scaling. (JakeWharton)04629aa— Next version will be 2.4.0. (JakeWharton)85c0394— Start adding change log. (JakeWharton)cfcee0b— Complete helper class for delegating to native when available. (JakeWharton)c9f3ff9— Do not invalidate parent if view is not attached to anything. (JakeWharton)
🔒Security observations
NineOldAndroids is a deprecated library with no active maintenance, which is the primary security concern. While the codebase itself appears relatively simple and focuses on animation APIs without obvious injection vulnerabilities (SQLi/XSS risks are minimal in this animation-focused library), the lack of ongoing security updates poses a significant risk. Secondary concerns include reflection-based property access that could be exploited if improperly used, and XML parsing in AnimatorInflater that should be verified for XXE protection. The library should not be used in new projects; existing projects should migrate to native Android APIs with proper version support and ongoing security maintenance.
- High · Deprecated Library with No Maintenance —
README.md, Project metadata. NineOldAndroids is explicitly marked as deprecated with no ongoing development. The README states 'No new development will be taking place.' This means security vulnerabilities discovered in the future will not be patched, and the library uses outdated Android APIs that may have known security issues. Fix: Migrate to native Android animation APIs available in Android 3.0+ (API level 14). Update minSdkVersion to 14 or higher to use the platform's built-in animation framework, which receives security updates from Google. - Medium · Reflection-Based Property Access —
library/src/com/nineoldandroids/util/ReflectiveProperty.java, library/src/com/nineoldandroids/animation/PropertyValuesHolder.java. The codebase includes ReflectiveProperty.java and uses reflection extensively (evident from PropertyValuesHolder.java, ObjectAnimator.java, ViewPropertyAnimator.java). Reflection can bypass certain security checks and may be exploited if property names come from untrusted sources. The ReflectiveProperty class uses reflection to dynamically access object properties. Fix: Audit reflection usage to ensure property names cannot be influenced by untrusted input. Use proper input validation and whitelisting for any dynamic property access. Consider using type-safe alternatives where possible. - Medium · XML-Based Animation Loading Without Validation —
library/src/com/nineoldandroids/animation/AnimatorInflater.java, sample/res/anim/. AnimatorInflater.java parses XML animation definitions from res/anim/ directory. While resource files are less vulnerable than external sources, improper XML parsing could potentially lead to XML External Entity (XXE) attacks or resource exhaustion if the XML parser is not properly configured. Fix: Verify that XML parsing disables external entity processing and XXE protection is enabled. Use Android's secure XML parsing APIs. Ensure parser timeout limits are set to prevent denial-of-service attacks. - Low · Outdated Android SDK Dependency —
library/pom.xml, pom.xml (parent). The project depends on com.google.android:android which is an older Android SDK dependency format. Modern Android projects should use the Android Gradle Plugin with versioned SDKs. The specific version of the Android SDK dependency is not pinned in the visible pom.xml. Fix: Update to use the modern Android Gradle build system with explicitly versioned dependencies. Pin the Android SDK version to a known, patched release. - Low · Missing Security-Related Manifest Attributes —
library/AndroidManifest.xml, sample/AndroidManifest.xml. The AndroidManifest.xml file is not visible in the provided content, but legacy Android projects may lack modern security attributes like android:usesCleartextTraffic restrictions, proper permission declarations, or backup allowlisting that should be reviewed. Fix: Review AndroidManifest.xml files for: proper android:usesCleartextTraffic=false, appropriate permission declarations, android:allowBackup configuration, and other modern security attributes.
LLM-derived; treat as a starting point, not a security audit.
👉Where to read next
- Open issues — current backlog
- Recent PRs — what's actively shipping
- Source on GitHub
Generated by RepoPilot. Verdict based on maintenance signals — see the live page for receipts. Re-run on a new commit to refresh.