chore: Release 5.5.5

[onesignal-deploy]

Channels: Current

🛠️ Native Dependency Updates

• Update Android SDK from 5.8.1 to 5.9.0
  • feat: Identity Verification release (#2640)
  • fix: SDK-4475 wait for in-flight init in initWithContextSuspend to avoid SessionService NPE (#2637)
  • fix: defensive JSON parsing for params + IAM (SDK-4478, SDK-4494) (#2638)

[claude]

LGTM — straightforward release: version bump to 5.5.5 and Android native SDK bump to 5.9.0.

Extended reasoning...

Overview

This is a release PR that bumps the Flutter SDK version from 5.5.4 to 5.5.5 across pubspec.yaml, android/build.gradle, and ios/onesignal_flutter.podspec, updates the SDK version string from "050504" to "050505" in both OneSignalPlugin.java and OneSignalPlugin.m, and bumps the Android native dependency com.onesignal:OneSignal from 5.8.1 to 5.9.0. The iOS OneSignalXCFramework pin remains at 5.5.1 (unchanged).

Security risks

None introduced by this PR. The Android SDK 5.9.0 release notes referenced in the description include defensive JSON parsing fixes (SDK-4478, SDK-4494) and an init race fix (SDK-4475), which are improvements over 5.8.1. Identity Verification is a new feature in the upstream SDK but is not surfaced through any new bridge code in this PR.

Level of scrutiny

Low. This is a mechanical version-bump release PR matching the exact pattern used in prior releases (e.g. dda93a9 "Release 5.5.5" predecessor, b4c2ea5 "Update Android SDK to 5.9.0"). All five touched files contain only string/version changes — no new logic, no API surface changes on the Flutter side. The native SDK bump is the substantive change, but its risk is owned by the OneSignal-Android-SDK repo's own review process.

Other factors

The version strings are kept in sync as required by the in-source comment ("Keep in sync with pubspec.yaml version"). All five locations were updated consistently. No outstanding reviewer comments or unresolved discussion in the timeline.