Magisk v31.0 pre-release: Zygisk supports Android 17, and what that means for device trust

What happened on this date

At 2026-09-04T16:56Z (UTC), the topjohnwu/Magisk repository published v31.0, marked as a pre-release on the release page. Notes include a Magisk app UI rebuilt with Jetpack Compose and Material 3, a built-in terminal emulator, and boot image extraction from remote OTA URLs; Zygisk support for Android 17 (API 37) and for Meta Quest (Horizon OS); webview_zygote added as a DenyList unmount target; a new resetprop option to compact property storage areas; and assorted fixes in MagiskBoot, MagiskPolicy and MagiskInit. This entry describes these changes only at the level of the release notes and does not cover how to use them.

Why it matters for protecting app logic

This release shows two things. First, root tooling tracks new Android versions quickly: Android 17 support appeared within the same release cycle. Second, extending DenyList to WebView-related processes shows that the scope of hiding root state from specific apps keeps shifting. For developers the conclusion is not that on-device root detection is useless, but that it can only be one risk signal: the user controls the device, and the environment an app observes on it may be adjusted. If core business logic or authorization decisions rest entirely on a local check, the security boundary sits on the side the other party controls. Note also that this is a pre-release with unknown adoption.

Checks you can run

First, list which features in your app depend on the assumption that the device is trustworthy, and estimate what you lose if that assumption fails. Second, keep final decisions on authorization, billing and key rules on the server, using local check results only as one input. Third, if you use a server-verifiable verdict such as Play Integrity, treat it as a signal rather than a substitute for obfuscation, and design a degradation path. Fourth, regression-test your own integrity checks on Android 17 devices to confirm they do not flag ordinary users. Fifth, add server-side rate limits and anomaly monitoring to limit the impact of any single manipulated client.

Your checklist

• List features that assume a trustworthy device and their failure impact
• Keep key decisions server-side; treat local checks as signals
• Regression-test your own integrity checks for false positives on Android 17