[Bug]: Push Notifications Fail When HMS-Related Classes Are Removed from OneSignal SDK

[arbyruns]

What happened?

I’m the developer of a production Android app, and I’m trying to reduce privacy tracking surfaces for users by removing Huawei Mobile Services (HMS) classes from the OneSignal SDK — specifically to avoid false positives flagged by tools like Exodus Privacy which detect any inclusion of HMS libraries, regardless of whether they’re used.

When I remove HMS-related classes from notifications.aar (used internally by OneSignal), push notifications stop working. OneSignal initializes, permissions are granted, but the device never becomes “subscribed”

As soon as I revert back to the full com.onesignal:OneSignal dependency, everything works again — but HMS classes return, and Exodus flags the build.

Steps to reproduce?

1. Run the below python script
2. Place the .aar files in app\libs folder (create libs folder)
2. Update `build.gradle.kts` with the following `implementations`


implementation("com.onesignal:core:5.1.24")
implementation("com.onesignal:in-app-messages:5.1.24") {
    exclude(group = "com.onesignal", module = "notifications")
}
implementation(mapOf("name" to "notifications-nohms", "ext" to "aar"))

3. Update dependencyResolutionManagement in `settings.gradle.kts` to include `flatDir`


dependencyResolutionManagement {
    repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)
    repositories {
        google()
        mavenCentral()
        maven {
            setUrl("https://jitpack.io")
        }
        flatDir {
            dirs("app/libs")
        }
    }
}


Python script to create custom aar

import zipfile
import os
import shutil

"remove HMS-related classes from OneSignal AAR file - Outputs notifications-nohms.aar"
# --- Config ---
original_aar_path = os.path.expanduser(
    "~/.gradle/caches/modules-2/files-2.1/com.onesignal/notifications/5.1.24")  # change if needed
output_dir = "onesignal-aar-clean"
output_aar_name = "notifications-nohms.aar"

# --- Locate the actual .aar file ---
def find_aar_file():
    for root, _, files in os.walk(original_aar_path):
        for f in files:
            if f.endswith(".aar"):
                return os.path.join(root, f)
    raise FileNotFoundError("OneSignal notifications.aar not found in Gradle cache.")

# --- Unzip .aar ---
def unzip_aar(aar_path, extract_to):
    with zipfile.ZipFile(aar_path, 'r') as zip_ref:
        zip_ref.extractall(extract_to)

# --- Remove HMS-related files ---
def strip_hms_classes(target_dir):
    hms_keywords = [
        "NotificationOpenedActivityHMS",
        "PushRegistratorHMS",
        "HmsMessageServiceOneSignal",
        "agconnect",
        "huawei"
    ]
    for root, _, files in os.walk(target_dir):
        for f in files:
            if any(keyword in f for keyword in hms_keywords):
                full_path = os.path.join(root, f)
                print(f"Removing {full_path}")
                os.remove(full_path)

# --- Re-zip cleaned directory ---
def zip_directory(source_dir, output_aar):
    with zipfile.ZipFile(output_aar, 'w', zipfile.ZIP_DEFLATED) as zipf:
        for root, _, files in os.walk(source_dir):
            for f in files:
                abs_path = os.path.join(root, f)
                arc_path = os.path.relpath(abs_path, source_dir)
                zipf.write(abs_path, arc_path)

# --- Main ---
def main():
    if os.path.exists(output_dir):
        shutil.rmtree(output_dir)
    os.makedirs(output_dir)

    aar_file = find_aar_file()
    print(f"Found AAR: {aar_file}")
    unzip_aar(aar_file, output_dir)
    strip_hms_classes(output_dir)
    zip_directory(output_dir, output_aar_name)
    print(f"✅ Clean AAR created: {output_aar_name}")

if __name__ == "__main__":
    main()

What did you expect to happen?

Users would be able to subscribe to notifications.

OneSignal Android SDK version

5.1.24

Android version

15

Specific Android models

Android Pixel8a

Relevant log output

2025-05-25 09:36:21.627 25078-25078 onesignal               com.rob.hotscots                     I  state isInitialized true permissions true
2025-05-25 09:36:21.627 25078-25078 OneSignal               com.rob.hotscots                     D  [main] Retrieving service interface com.onesignal.user.IUserManager
2025-05-25 09:36:21.627 25078-25078 OneSignal               com.rob.hotscots                     D  [main] Already instantiated: com.onesignal.user.internal.UserManager@dc29b37
2025-05-25 09:36:21.627 25078-25078 onesignal               com.rob.hotscots                     I  state consentGiven true optedIn false

Code of Conduct

• I agree to follow this project's Code of Conduct

[gitayam]

This issue needs to be prioritized as it is impacting several apps

[jinliu9508]

Hello @arbyruns, thank you for reporting this issue. We will look into this and keep you updated.

[arbyruns]

@jinliu9508 I was wondering if there was any update on this? Thanks in advance!

[arbyruns]

@jinliu9508 I wanted to check in to see if there’s been any progress or update on this issue. I completely understand that bugs and feature requests require planning and prioritization.

That said, due to the nature of this issue and the sensitivity of the government space we operate in, I’ll need to start exploring alternatives to OneSignal if a resolution isn’t likely in the near term. I’d also be obligated to advise others in similar contexts to proceed with caution.

Any update you can share would be greatly appreciated — thank you!