chore: Release 5.2.8#865
Conversation
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM — straightforward release PR bumping version 5.2.7→5.2.8 and Android SDK 5.8.0→5.8.1.
Extended reasoning...
Overview
This PR is a routine version bump for the OneSignal Unity SDK release 5.2.8. It updates the version string from 5.2.7 to 5.2.8 across all package.json files, asmdef versionDefines, the Version/VersionHeader constants in OneSignal.cs and OneSignalPlatform.cs, the iOS setSdkVersion call (050207 → 050208), the demo project bundleVersion, and the packages-lock.json. It also bumps the underlying Android native SDK dependency from 5.8.0 to 5.8.1 in OneSignalAndroidDependencies.xml, the demo's mainTemplate.gradle, and AndroidResolverDependencies.xml.
Security risks
None. Version bumps for a third-party native SDK and string constants do not introduce security-relevant logic. The Android SDK 5.8.1 changelog cited in the description (token-on-startup, login/logout race fix, listener replay queue clear) describes upstream behavior fixes, not security-sensitive code in this Unity wrapper.
Level of scrutiny
Low. Every change in this PR is mechanical and consistent — all version strings move in lockstep across the 14 modified files, the encoded version header (050207 → 050208) matches the semantic version, and dependency declarations agree between the package descriptor and the demo's resolver outputs. No logic or API surface changes.
Other factors
The bug hunting system found no issues. The PR follows the established pattern for prior release PRs (e.g., #864 for 5.2.7). No outstanding reviewer comments.
onesignal-deploy
force-pushed
the
rel/5.2.8
branch
2 times, most recently
from
ecf58b1 to
5096118
Compare
onesignal-deploy
force-pushed
the
rel/5.2.8
branch
from
f78ed0e to
3e66961
Compare
onesignal-deploy
force-pushed
the
rel/5.2.8
branch
from
1465ebf to
4bd0169
Compare
The E2E workflow installs the OneSignal Appium provisioning profiles into the runner keychain but the regenerated Unity Xcode project has no per-target PROVISIONING_PROFILE_SPECIFIER, so xcodebuild archive fails on rel/5.2.8 with "requires a provisioning profile" for the main target, the NSE, and the Live Activity widget. Extend SigningPostProcessor so every target is flipped to manual signing with the matching Appium profile (Main / NSE / Live Activity) when CI=true. Local Xcode auto-signing is unaffected for developers. Co-authored-by: Cursor <cursoragent@cursor.com>
The demo is a UI Toolkit app: no physics, audio, animator, particles, terrain, video, VR/XR, NavMesh, timeline, or AssetBundles. The manifest still pulled in all of those plus a handful of unused top-level packages, padding the IL2CPP managed surface and the final APK. Drop everything the demo never uses. The scenes' default NavMeshSettings block is tolerated by Unity without the AI module. Unity will regenerate packages-lock.json on the next import. This trims the rel/5.2.8 APK from ~23 MB toward the ~16-18 MB floor for a Unity 6 ARM64 IL2CPP build with managed stripping High. Co-authored-by: Cursor <cursoragent@cursor.com>
None are referenced by the demo:
- animation: no Animator/Animation/AnimationClip in scenes or scripts.
UI Toolkit transitions live in com.unity.modules.uielements.
- imageconversion: no Texture2D.LoadImage / EncodeToPNG / EncodeToJPG
calls; the demo never decodes PNG bytes at runtime now that
com.unity.modules.unitywebrequesttexture is gone.
- imgui: no OnGUI / GUI.* / GUILayout.* in any script.
If com.unity.ugui still declares imgui as a transitive dependency the
package manager will re-add it, which is fine; this commit just makes
sure we are not asking for it directly.
Co-authored-by: Cursor <cursoragent@cursor.com>
The demo is UI-Toolkit-only. No script references UnityEngine.UI, TMPro, Canvas, Image, Text, Button, GraphicRaycaster, EventSystem, CanvasScaler, or StandaloneInputModule. No scene contains a Canvas, CanvasRenderer, or RectTransform component. Dropping the package also pulls out the TextMeshPro runtime that ships with ugui 2.0 in Unity 6, and removes the transitive dependency that kept imgui in the player. Co-authored-by: Cursor <cursoragent@cursor.com>
Neither ships into the player, so the APK is unaffected. Removing them just keeps the manifest focused on what the demo actually uses and trims a few hundred MB out of Library/PackageCache on cold CI runners. - com.unity.ide.rider: Rider IDE integration, editor-only. Anyone using Rider locally can add it back to their own copy or rely on Rider's own Unity Editor plugin. - com.unity.test-framework: no [Test] / [UnityTest] / TestRunner / nunit references anywhere in the repo; demo has zero PlayMode or EditMode tests and no asmdef references the package. Co-authored-by: Cursor <cursoragent@cursor.com>
2 participants
Channels: Current
🐛 Bug Fixes
🛠️ Native Dependency Updates
login()is called beforerequestPermission()(#2627)