Darknetzz/jotty-android v1.3.1 on GitHub

Update channel (stable vs dev) — About → "Check for updates" can target either the latest stable GitHub release or the rolling dev-latest pre-release. The choice is persisted in DataStore. Dev checks compare the release Commit: line to the app's -dev+ SHA suffix; stable checks compare semver using the base version (dev suffix stripped).
Shared offline repository runtime — Introduced reusable OfflineRepositoryLifecycle and SyncStatusState to centralize connectivity callback wiring, coroutine scope ownership, sync state tracking, and lifecycle cleanup for offline repositories.
Checklist replay failure feedback — Checklist sync now tracks pending-operation replay failures (e.g. stale item paths) and surfaces a user-facing snackbar so silent skips are visible.
Checklist offline repository tests — Added focused JVM tests for checklist offline sync behavior, including offline failure and replay-failure counting paths.
CI hardening — CI now includes an Android instrumentation smoke-test job (emulator + MainActivitySmokeTest) and GitHub dependency vulnerability review on pull requests.

DRY offline architecture — Notes and checklists offline repositories now compose shared lifecycle/sync-state infrastructure instead of duplicating connectivity/scope/cleanup logic.
CI lint coverage — CI lint step now runs both debug and release variants (lintDebug + lintRelease) instead of a single generic lint invocation.

Legacy credentials migration — When encrypted API key storage (EncryptedSharedPreferences) is unavailable on a device, migrating from legacy server_url / api_key preferences no longer clears those keys while saving an empty instance API key (which would lock the user out). The key remains in DataStore plaintext in that rare fallback path, consistent with other non-encrypted flows.

Update-channel parser tests — UpdateCheckerTest covers parseUpdateChannel, base-version stripping, dev SHA extraction, dev release-body parsing, and local-vs-remote SHA matching used by the new update channel.

Encrypted API key storage, biometric note passphrase storage, XChaCha20 encryptor fix, and related changes were merged from #5. Thanks @Emilien-Etadam for driving the contribution.

Full changelog: CHANGELOG.md