Paka 0.15.3 makes scanning safer on documents that carry several barcodes, adds an optional discoverability aid for hidden gestures, and fixes 2FA parsing and key-handling findings from the 0.15.1 audit. These changes were prepared as 0.15.2, which was tagged but never published; 0.15.3 is the same source with the version bumped, so this release delivers everything since 0.15.1.
Which APK?
Paka-v0.15.3.apk— arm64. Light Phone III and every modern Android phone.Paka-v0.15.3-arm32.apk— 32-bit. Light Phone 2 and other older 32-bit devices. On Light Phone 2, manual pass entry, code display, 2FA, photo import, backups, and light mode work; scanning, in-app capture, and PDF passes need a camera and Android 11.
Highlights
- Capture only the code you aim at. The scanner previously accepted the first symbol decoded anywhere in the frame, so documents carrying more than one code could capture the wrong one. Readers now report every symbol in the frame; a lone symbol still scans instantly from anywhere, but with several visible exactly one symbol centre must sit inside the on-screen guide square before it is used.
- New developer setting: gesture hints, off by default. Long-press actions such as editing or deleting a pass from its displayed code are hard to discover; the setting shows a one-line dim caption on the pass, stack, PDF, and photo screens naming the hold action, in all supported languages. With the setting off every screen renders exactly as before.
Reliability and security
- Stop percent-decoding 2FA setup QR labels twice:
Uri.getPath()already decodes, so issuer and account names containing literal percent sequences were corrupted. Covered by new parse tests. - Zero decoded TOTP key bytes after code generation and validation instead of leaving them for garbage collection.
- Correct the stale supported-versions table in the security policy; 0.15.x is the current line.
Release verification
- Unit tests, localisation/resource tests, Android lint, detekt, debug, minified preview, and minified release builds passed on the release commit.
- APK:
Paka-v0.15.3.apk(arm64-v8a) - APK SHA-256:
e57dee0e0ccb864ee09b56a7ad66c87d0ed0a502dafcf90876b8ad6b90de9d18 - APK:
Paka-v0.15.3-arm32.apk(armeabi-v7a) - APK SHA-256:
db6135f6b68f1ab3b4d8709a69929b12d1063a862f2dee481429d242704d2a30 - Signing certificate SHA-256:
098fbb0a5455ec00dbafae93f16bff74b048e5bde7a824fac9ecf42effad0019 - Permissions:
android.permission.CAMERAonly
The complete chronological notes are in CHANGELOG.md.