Conversation
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
The release tooling (update_swift_package.sh) edits Package.swift by hardcoded line numbers, which had drifted, so it overwrote the .binaryTarget boundaries with new url/checksum lines and left the old ones in place — producing an unparseable manifest that breaks every SwiftPM consumer of 5.5.2. Restore the correct structure (10 .binaryTarget entries) with each url bumped to 5.5.2 and the 5.5.2 checksums computed during this release. Verified with swift package dump-package. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
@claude review |
There was a problem hiding this comment.
Package.swift fix in 7a72ad8 resolves the SPM manifest issue I flagged earlier — the rest of the PR is a standard release version bump.
Extended reasoning...
Overview
This is the 5.5.2 release PR, bumping podspecs and ONESIGNAL_VERSION from 5.5.1 to 5.5.2, refreshing all 9 xcframework binaries and their checksums, and pointing Package.swift binary targets at the new 5.5.2 release URLs. Substantive code changes were already shipped via #1669 (prewarm identity fix) and #1667 (identifier-read refactor); this PR is just packaging.
Security risks
None specific to this change. The xcframework binaries are signed (CodeDirectory/CodeSignature updated alongside CodeResources), and the SPM consumers receive the binaries by URL pinned to a SHA-256 checksum that matches the released zip. No auth/crypto/permissions surface is touched here.
Level of scrutiny
Low-medium — release packaging changes are mechanical, but the SPM manifest is the documented integration path so it has to actually parse. My prior review caught a release-tooling bug that corrupted Package.swift (deleted ),\n .binaryTarget( separators between targets and left duplicate 5.5.1 url/checksum lines). Commit 7a72ad8 fixed it by restoring the in-place url/checksum update pattern that 5.5.1 and earlier releases used.
Other factors
I re-read Package.swift at HEAD: lines 110–117 close .target(name: "OneSignalLiveActivitiesWrapper", ..., path: "OneSignalLiveActivitiesWrapper") properly, and lines 118–167 are 10 well-formed .binaryTarget(name:, url:, checksum:) calls separated by commas, every URL now points at the 5.5.2 release and every checksum is the new 5.5.2 value with no leftover 5.5.1 lines. No outstanding reviewer comments.
2 participants
Channels: Current
🐛 Bug Fixes
✨ Improvements