Google mandates two years of Android security updates

Every month, a security team at Google releases a new set of patches for Android - and every month, carriers and manufacturers struggle to get them installed on actual phones. It's a complex, long-standing problem, but confidential contracts obtained by The Verge show many manufacturers now have explicit obligations about keeping their phones updated written into their contract with Google.

A contract obtained by The Verge requires Android device makers to regularly install updates for any popular phone or tablet for at least two years. Google's contract with Android partners stipulates that they must provide "at least four security updates" within one year of the phone's launch. Security updates are mandated within the second year as well, though without a specified minimum number of releases.

Be still my beating heart - four whole security updates in the first year, and "a" security update in the second year? How mightily generous.