jadx 1.5.6 adds a call-graph module and Kotlin enum restoration fixes

What happened on this date

On 2026-07-10 (19:07 UTC), the Android decompiler jadx published v1.5.6 on GitHub. Per the release notes, new features include graph views with code-pane sync (PR #2784), a new module for working with call graphs (#2890), and UI improvements such as collapsing single-child directory chains in the resource tree. Fixes include enum restoration for the Kotlin 1.9+ $ENTRIES pattern (PR #2814) and for enums with argument-less constructors (#2821); broader SwitchOverString handling; hardening of the XML parser in FileTypeDetector against XML-bomb denial of service (PR #2851); safer Android manifest number parsing (#2857); support for files in XAPK sub-directories (#2834); and many smaller decompilation corrections.

What it means for protecting app logic

Each change is routine, but together they mean decompiled output keeps getting closer to how the source was written. Compiler-generated patterns such as Kotlin enums and switch-on-string are restored, so readers see higher-level structure, and call graphs make it faster to grasp how modules relate. Developers should assume that whatever survives R8, such as string constants, enum names that were not renamed and manifest data, will appear in fairly readable form, and that this output is well suited as input to AI-assisted analysis. The boundary is equally clear: a decompiler only sees the client, not server-side logic or data, and R8's renaming and optimization still remove many meaningful names.

Checks to run on your own builds

First, make opening your own release package with a current decompiler part of pre-release review; what you see is what others can see. Second, focus on keys, internal endpoint URLs and feature flags in string constants, and on enum and class names that describe business rules; rename what can be renamed and move secrets to the server. Third, confirm that mapping files such as mapping.txt are kept internal and not leaked in the package or a public repository. Fourth, review keep rules to avoid preserving more class names than necessary for convenience. Fifth, repeat the check after every AGP, R8 or Kotlin upgrade, since compiler-generated patterns change and decompilers keep pace.

Your checklist

• Review your own release package with a current decompiler before shipping
• Remove keys, internal URLs and flags from string constants
• Confirm mapping.txt never leaks
• Repeat the review after AGP/R8/Kotlin upgrades