Android 3.27.0

• Stored data is protected by a hardware-backed key. The SDK now checks that the key encrypting its local storage is backed by secure hardware (TEE or StrongBox). In release builds, a software-backed key (for example on a rooted device or custom ROM) is rejected and the SDK stops storing data on that device. Debuggable builds, including emulators, log a warning and keep working.

• Added TransactSession, a session-based way to configure and present Transact, alongside the existing Transact.present API
• Released Transact sessions that ended without cleanup, and reported background launches through onClose instead of throwing; added PausedTransactRef.tryResume()
• Required a hardware-backed key for the SDK's encrypted storage in release builds
• Recorded which launch API opened Transact in SDK telemetry
• Updated the internal WebView library so a stalled page handler can no longer stop page events or lose a page close (Latest variant only)

• Deposit
• Switch
• Manage

• Kotlin: 2.1+ (build version 2.2.21)
• Gradle: 8.11.1+ (build version 8.14.2)
• AGP: 8.9.1+ (build version 8.13.2)
• Compile SDK: 36+ (build version 36)
• Min SDK: 23 (build version 23)
• Tested Target SDK: 36 (build version 36)

• Kotlin: 1.9.x (build version 1.9.25)
• Gradle: 8.7+ (build version 8.14.2)
• AGP: 8.6+ (build version 8.6.1)
• Compile SDK: 35+ (build version 35)
• Min SDK: 23 (build version 23)
• Tested Target SDK: 36 (build version 36)

JetBrains tests Kotlin 1.9.x only through AGP 8.1, so the Kotlin Gradle plugin warns that AGP 8.6+ is above its tested range. The warning is expected. The build works, and CI verifies the legacy artifact against it.