HTC began upgrading the One M9 to Android 7.0 Nougat in December, starting with unlocked models of the device, and said that carrier-locked models would "follow early next year". A few weeks ago, T-Mobile released the Nougat update for that device.
Now, four months after HTC's rollout began - and almost eight months after Google originally released Android 7.0 - the update is finally making its way to the One M9 on Sprint. The update is just over 1GB in size, and in addition to the various improvements that Nougat brings, Sprint's update also includes unspecified "system performance enhancements".
Unfortunately, the update doesn't include the latest Android security patches for April, which Google released last week. Instead, Sprint's One M9 is only getting the February patches with its Nougat rollout, leaving the device vulnerable to other security issues that have since been addressed in Google's more recent releases.
It's worth pointing out that Sprint isn't entirely to blame here, as HTC only released the March security update for the One M9 a few days ago, providing the carrier with little time to test those fixes and integrate them with its own release. But the fact that Android devices are still being left unprotected from known security flaws for weeks - or even months - at a time remains a problem, and it's one that Google is well aware of.
Source: Android Police