play store rejected our app 3 times for a permission we never asked for

small story that cost us almost two weeks, maybe it saves someone

we submitted an update for a client's fintech app and google play rejected it for using QUERY_ALL_PACKAGES without a valid reason. problem: we never added that permission. i searched the whole codebase, not there. resubmitted with an explanation, rejected again. the client is calling me every morning at this point

turns out android builds your final manifest by merging your manifest with the manifest of EVERY library you depend on. one of the SDKs we added (a device fingerprinting thing for fraud checks) declared QUERY_ALL_PACKAGES in its own manifest, and the manifest merger happily pulled it into our app

how to see it: in android studio open AndroidManifest.xml and click the "Merged Manifest" tab at the bottom. it shows every permission and which library it came from. for flutter or react native just open the android folder as a project and you get the same tab

how to remove it if you dont need it:

<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    xmlns:tools="http://schemas.android.com/tools">
    <uses-permission
        android:name="android.permission.QUERY_ALL_PACKAGES"
        tools:node="remove" />
</manifest>

(check the SDK still works without it first. ours did, it only used it for an optional check)

now we look at the merged manifest every time we add or update a dependency, its in our PR checklist. third submission went through in 2 days. the client now calls me only every other morning, progress