chore: Release 5.5.1

[github-actions]

Channels: Current

🐛 Bug Fixes

• fix: update unattributed outcomes to match attributed outcomes and Android SDK (fix: update unattributed outcomes to match attributed outcomes and Android SDK #1655)

[claude]

LGTM — straightforward 5.5.1 release: version bumps + rebuilt XCFramework binaries; the underlying fix was already reviewed in #1655.

Extended reasoning...

Overview

This is a release PR for OneSignal iOS SDK v5.5.1. The substantive source-level changes are tiny and mechanical: OneSignal.podspec and OneSignalXCFramework.podspec bump from 5.5.0 to 5.5.1; OneSignalCommonDefines.h updates ONESIGNAL_VERSION from @"050500" to @"050501"; and Package.swift updates the binary target URLs to the new release tag with new checksums. The remaining ~185 files are pre-built XCFramework artifacts (binaries, dSYMs, Info.plists, _CodeSignature manifests, relocation YAMLs) that are regenerated by the release build process. The actual behavioral change shipped in 5.5.1 (unattributed outcomes alignment with attributed/Android) was merged separately as #1655 and is already reviewed.

Security risks

No meaningful security risk. The diff does not touch auth, crypto, permissions, or network code paths at the source level. The Package.swift checksum updates are exactly what you'd expect for a binary release — the checksums pin the artifact integrity for SwiftPM consumers. There is some inherent supply-chain trust assumption around the prebuilt binaries, but that's the standard release process for this repo and isn't unique to this PR.

Level of scrutiny

Low. This is a routine version-bump release matching the pattern of prior releases (the recent commits include chore: build binaries, chore: bump version to 5.5.1, chore: update Swift package). The Info.plist reorderings of ios-arm64 / maccatalyst / simulator slices are non-semantic shuffles produced by the build tooling. No source logic changes are introduced here that haven't already been independently reviewed.

Other factors

No bugs were flagged by the bug hunting system, no outstanding reviewer comments, and no prior reviews on the timeline. The PR description correctly attributes the only behavioral change to the already-merged #1655. Safe to shadow-approve.