QuickDash v5.2.4: Security Hardening, Contributor Recognition & UI Polish

What's Changed in QuickDash v5.2.4 (Build 526)

QuickDash v5.2.4 delivers critical security hardening, contributor recognition, seamless in-app APK updating, and refined UI ergonomics.

🛡️ Security Hardening & CodeQL Remediation

• Regex Log Sanitization: Hardened log entry sanitization in AppLogger.kt with regex newline stripping Regex("[\r\n]") to permanently eliminate Log Injection vulnerabilities (CodeQL Alert #66).
• Implicit Intent Chooser Guards: Shielded contact card creation, phone dialer, and email intent dispatches in QrActionHelper.kt with Intent.createChooser to prevent sensitive data leakage (CodeQL Alerts #67, #68).
• Privileged Path Execution: Enforced explicit absolute binary paths (/system/bin/sh) in ShizukuHelper.kt (CodeQL Alert #69).
• Supply Chain Audit: Cleared 12 Dependabot security advisories across Android libraries, web packages, and Cloudflare workers.

🔄 In-App APK Updater & Play Store Policy Compliance

• Seamless In-App Updates: Added dynamic ${installPermission} injecting android.permission.REQUEST_INSTALL_PACKAGES into standalone APK releases, resolving permission failures on Android 8.0+ when updating directly from GitHub or the website.
• Google Play Policy Shield: Automatically stripped REQUEST_INSTALL_PACKAGES from the Google Play .aab bundle to guarantee 100% compliance with Google Play Developer Program policies.
• Smart Source Redirection: Added automatic detection for installations sourced from com.android.vending, smoothly redirecting Play Store users to the Google Play Store update page.

🎨 UI Polish & Button Alignment

• About Screen Ergonomics: Re-architected legal and open-source actions in AboutLegalCard.kt into a balanced, symmetrical 2-row layout (50/50 License & Privacy buttons, followed by a prominent full-width Open Source Team & Contributors Hub), eliminating wrapped text and button height mismatch.
• Tactile Feedback: Integrated subtle haptic click vibrations across all About cards.

👥 Contributor Recognition & Transparency

• In-App Team & Credits Hub: Added a dedicated Open Source Team & Contributors hub button in the About screen connecting users directly to repository contributors.
• Developer Showcase Attribution: Added official Co-Developer badge in the developer profile acknowledging Mohith (@mohith-dev-m1).

⏰ Exact Alarm Reliability

• Android 12+ Alarm Fallback: Added runtime check for canScheduleExactAlarms() in QuickRemindersScreen.kt. If exact alarm scheduling isn't granted, alarms gracefully fall back to setAndAllowWhileIdle() to guarantee reminders are never dropped silently.

---

📦 Release Binaries & SHA-256 Checksums

File	Description	SHA-256 Checksum
app-universal-release.apk	Universal Standalone APK	55faf658fd06a6c5f147fb0c73200425f0641173bda52a7014c0bbf151464a58
app-foss-release.apk	F-Droid / IzzyOnDroid APK	55faf658fd06a6c5f147fb0c73200425f0641173bda52a7014c0bbf151464a58
app-arm64-v8a-release.apk	64-bit ARM APK	605308fcbb37d7d54e5e6ac666a665fd890767c0975bf520ea7839e360557593
app-armeabi-v7a-release.apk	32-bit ARM APK	11e2d1004d43a03b8c1352136088cf085a8d6d81b4dc1f6c38964977604dc282
app-release.aab	Google Play Store Bundle	31c5dbe99fc0f8f538cebf27866ef2ea40c636c62bf0f9f966a6ae6df925b95e

---

What's Changed

• chore(deps): bump the npm-workers group in /workers with 2 updates by @dependabot[bot] in #65
• chore(deps): bump io.mockk:mockk from 1.13.13 to 1.14.11 by @dependabot[bot] in #68
• chore(deps): bump com.google.zxing:core from 3.5.3 to 3.5.4 by @dependabot[bot] in #69
• chore(deps): bump the build-tools group across 1 directory with 6 updates by @dependabot[bot] in #75
• chore(deps): bump the npm-website group across 1 directory with 4 updates by @dependabot[bot] in #76
• chore(deps): bump qs from 6.15.3 to 6.16.0 in /website/server in the npm_and_yarn group across 1 directory by @dependabot[bot] in #78
• chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates by @dependabot[bot] in #79
• chore(deps): bump the androidx-compose group across 1 directory with 9 updates by @dependabot[bot] in #77
• chore(deps): bump app.cash.turbine:turbine from 1.2.0 to 1.2.1 by @dependabot[bot] in #71
• Dev by @Balajitechlabs in #80

Full Changelog: v5.2.3...v5.2.4
Verify checksums on macOS / Linux:

shasum -a 256 -c checksums.txt