This is probably where they got the 3 month number. It is fuckery and they are making the lives of custom rom developers more difficult than they need to be.
Over the last few years, AOSP has been shifting to a quarterly release cadence, meaning that new features and bug fixes are released every three months. link
They’re not releasing the list of vulnerabilities each month but instead doing it quarterly, so how are custom ROM devs supposed to patch vulnerabilities if google isn’t reporting them to manufacturers and developers like they’ve done for over a decade now?
Given how large and complex the Android operating system and its underlying components are, it’s not unusual to see a dozen or more vulnerabilities documented in a bulletin. However, the July 2025 bulletin broke this decade-long trend: out of the 120 bulletins published up to that point, it was the first ever to not list a single vulnerability.
Instead of bundling all available security patches into the next ASB, Google now prioritizes shipping only “high-risk” vulnerabilities in its monthly releases. The majority of security fixes, meanwhile, will be shipped in quarterly ASBs.
https://discuss.grapheneos.org/d/27068-grapheneos-security-preview-releases
This is probably where they got the 3 month number. It is fuckery and they are making the lives of custom rom developers more difficult than they need to be.
Here is a good information from LineageOS;
misinformation and grapheneos, again?
Wow you’re completely full of shit aren’t you
what do you mean?
https://www.androidauthority.com/android-risk-based-security-updates-3597466/
They’re not releasing the list of vulnerabilities each month but instead doing it quarterly, so how are custom ROM devs supposed to patch vulnerabilities if google isn’t reporting them to manufacturers and developers like they’ve done for over a decade now?
“Android Security Bulletins will still be released, and picked to all supported LineageOS versions monthly.” LineageOS
You are a slave