chore: Release 6.1.8

[onesignal-deploy]

Channels: Current

🛠️ Native Dependency Updates

• Update Android SDK from 5.8.1 to 5.9.1
  • fix: SDK-4504 ConcurrentModificationException in Model.initializeFromModel (#2642)
  • feat: introduce SerialIO dispatcher + runOnSerialIOIfBackgroundThreading helper (#2643)
  • fix: offload every main-thread onFocus / onUnfocused handler behind sdk_background_threading FF (#2644)
  • fix: warm OneSignalDispatchers on init to avoid cold-start ANRs (#2645)
  • feat: Identity Verification release (#2640)
  • fix: SDK-4475 wait for in-flight init in initWithContextSuspend to avoid SessionService NPE (#2637)
  • fix: defensive JSON parsing for params + IAM (SDK-4478, SDK-4494) (#2638)

[claude]

Routine release PR bumping version to 6.1.8 and Android SDK to 5.9.0.

Extended reasoning...

Overview

This PR is a straightforward release for version 6.1.8 of the OneSignal .NET SDK. It bumps the version in the nuspec file from 6.1.7 to 6.1.8, updates the Android SDK reference in versions.json from 5.8.1 to 5.9.0, and replaces three Android .aar binary artifacts (core, in-app-messages, notifications) with the matching 5.9.0 builds. There are no source code changes to the .NET SDK itself.

Security risks

No new code is introduced in the .NET SDK. The Android SDK bump pulls in upstream changes including an Identity Verification feature and defensive JSON parsing fixes — these are vetted in the upstream Android SDK repo. Binary .aar updates always carry some implicit trust in the upstream artifacts, but that is the standard release flow for this repo.

Level of scrutiny

Low — this is a mechanical version-bump release PR following the established pattern from prior releases (e.g., 6.1.7, 6.1.6). The diff is limited to version strings and binary blobs that mirror an external SDK release.

Other factors

The bug hunting system found no issues. No outstanding reviewer comments. Description clearly enumerates the upstream Android SDK changes being absorbed.