chore: Release 1.0.3

[onesignal-deploy]

Channels: Current

🛠️ Native Dependency Updates

• Update Android SDK from 5.8.1 to 5.9.1
  • fix: SDK-4504 ConcurrentModificationException in Model.initializeFromModel (#2642)
  • feat: introduce SerialIO dispatcher + runOnSerialIOIfBackgroundThreading helper (#2643)
  • fix: offload every main-thread onFocus / onUnfocused handler behind sdk_background_threading FF (#2644)
  • fix: warm OneSignalDispatchers on init to avoid cold-start ANRs (#2645)
  • feat: Identity Verification release (#2640)
  • fix: SDK-4475 wait for in-flight init in initWithContextSuspend to avoid SessionService NPE (#2637)
  • fix: defensive JSON parsing for params + IAM (SDK-4478, SDK-4494) (#2638)

[claude]

Straightforward release bump: Android SDK 5.8.1→5.9.1 and version string updates to 1.0.3.

Extended reasoning...

Overview

This is a release PR for version 1.0.3 with four files changed: the Android libs.versions.toml bumps the OneSignal Android SDK from 5.8.1 to 5.9.1, the Android and iOS plugin files update their OneSignalWrapper.sdkVersion string from "010002" to "010003", and package.json bumps from 1.0.2 to 1.0.3. No logic changes.

Security risks

None identified. The changes are pure version bumps. The upstream Android SDK changelog lists defensive fixes (ConcurrentModificationException, NPE protection, defensive JSON parsing, ANR avoidance) and an Identity Verification feature — but evaluating the upstream SDK's safety is out of scope for this wrapper PR.

Level of scrutiny

Low. This is a mechanical version-bump release PR following an established pattern in the repo (matches the prior 1.0.2 release pattern in recent commits). The native SDK upgrade is the only meaningful behavioral change, and that lives in the consumed dependency, not in this repo's code.

Other factors

No bugs were found by the bug hunting system, no prior reviewer comments exist on the PR, and there are no outstanding concerns. The diff is small, mechanical, and follows the documented release process.