chore: upgrade to Unity 6000.5.5f1

[eordano]

Retargets the upgrade branch to Unity 6000.5.5f1 (d16e074b49fd, the latest 6000.5 release) and cleans up how the third-party packages are sourced. All prior fixes on the branch (URP 17.5 shader compat, font-atlas migration, prefab cleanups, Sentry 4.7.0) are unchanged.

Package sourcing changes

Package	Before	Now
com.alttester.sdk	vendored on #fix/unity-6000.5.4-api-compat	pinned to #vendor/alttester-2.3.0-entityid — a standing pin branch on main, now at upstream 2.3.2 and reproducible as upstream ⊕ patch (tools/revendor-alttester.sh --verify)
com.mackysoft.serializereference-extensions	vendored 1.3.1	upstream 1.7.0 from OpenUPM
com.brunomikoski.animationsequencer	vendored 0.5.4	removed — referenced by no code, asmdef, prefab or scene
AVPro / GPUI Pro / RenderFeatures / FileBrowserPro	#fix/unity-6000.5.4-api-compat	same branch, rebuilt lean (#60) — pins updated to 72f99c525

Why AltTester stays vendored: registry 2.3.0/2.3.2 cannot compile on any 6000.5.x — Object.GetInstanceID() is obsolete-as-error from 6000.5.0 and has no (UnityUpgradable) path, so 78 CS0619 errors survive even -accept-apiupdate (verified on Windows and macOS). Upstream has no EntityId release; the pin branch dies the day they ship one, and its patch is a committed 191-line diff rather than an opaque copy.

CI note: batch builds need -accept-apiupdate — SRE 1.7.0 ships one AdvancedDropdownItem.children usage that the API updater rewrites on first import.

Verification (both platforms, 6000.5.5f1)

• Builds: BuildWindows64Dev green on Windows 11/RTX (D3D12) and BuildMacUniversalDev green on macOS arm64 (Metal) — 0 compile errors, AltTester assemblies present in both players.
• AltTester runtime: a --alttester player run initialises AltRunner with zero missing-script errors. Worth knowing: upstream regenerates every .meta GUID between releases, so an unpinned 2.3.2 compiles perfectly while AltTesterPrefab's script references silently go missing — the vendor branch pins the 24 GUIDs the project binds and leaves the package's own asmdef references identical to upstream.
• Editmode tests (24k): macOS 24,035 passed / 1 failed — the single failure is an environmental GPUI worker-size assert (Max. Compute Work Group Size is: 0) in a headless batch worker, not a code regression.
• Earlier on this branch at 6000.5.2f1: full-suite runs of 24,037/24,048 passed, 0 failed (macOS) and 21,275/21,275 on Windows after installing ripgrep, plus player smoke runs (524 render signals on D3D12; full 3D pipeline on Metal), a 37-screen HUD atlas capture and a three-stop live-world fidelity tour.

Depends on decentraland/unity-explorer-packages#60 (lean EntityId compat for the four paid packages) and its vendor/alttester-2.3.0-entityid branch. CI for this PR also needs #9493 (the pinned GameCI image tag does not exist upstream, so any editor-version change misses the GHCR cache and cannot pull an image).

🤖 Generated with Claude Code

[github-actions]

New build in progress, come back later!

[github-actions]

Slack notification sent to #explorer-ext-contributions for external review.
To re-send, delete this comment and re-add the ext-contribution label.

[github-actions]

Test results not found — the test run likely crashed or timed out before producing results; check the Unity Tests checks.

[github-actions]

Lint did not finish (failure) — the warning ratchet could not be evaluated. See logs.

[claude]

Dependency security review — Unity 6000.5.5f1 upgrade

• Gather diff context (manifest, lockfile, asmdef, binaries)
• Enumerate every dependency change with source/pin/scope
• Look up registry metadata for new/changed packages
• Assess provenance, capability, shipping impact, transitive risk
• Post verdict

View job run

[claude]

Claude finished @eordano's task in 4m 56s —— View job

---

Dependency security review — re-run on push (b43443d3)

• Determine what changed since the previous review
• Re-enumerate dependency changes (manifest, lockfile, asmdef, binaries)
• Look up registry metadata — ⚠️ blocked again, see note
• Re-assess prior findings M1–M5
• Post updated verdict

Scope of this run. Re-review triggered by the push of b43443d3 (chore: upgrade to Unity 6000.5.5f1). origin/dev (2472a6069) has no merge base in this shallow checkout, so diffs are e900164f9..HEAD for the whole-PR view and a74d4808..b43443d3 for the delta.

⚠️ WebFetch and WebSearch were denied again in this job (they resolved as tools this time, but the permission prompt was not granted). Zero registry metadata was retrieved — no publisher, license, publish date, download counts, or advisory checks for any package. Step 1.5 remains unperformed. To get the registry half, grant WebFetch/WebSearch in --allowedTools, or add Bash(gh api:*).

Step W skipped — nothing under .github/workflows/ or .github/prompts/ changed.

---

1. What the new commit changed

a74d4808..b43443d3 touches only manifest.json, packages-lock.json, and ProjectVersion.txt. Net direction is an improvement on the prior state:

Change	Before (last review's HEAD)	Now	Effect
com.alttester.sdk	…/AltTester#fix/unity-6000.5.4-api-compat (6bc4241c)	…/AltTester#vendor/alttester-2.3.0-entityid (b6a3925c)	✅ purpose-named standing branch instead of a throwaway fix branch
com.brunomikoski.animationsequencer	vendored on #fix/unity-6000.5.4-api-compat	removed entirely	✅ one fewer vendored tree
com.mackysoft.serializereference-extensions	vendored on #fix/unity-6000.5.4-api-compat	OpenUPM registry 1.7.0	✅ back to an immutably-versioned public package
6 packages (avpro, gpui-pro ×2, gpui-assets, filebrowserpro, renderfeatures)	locked 6bc4241c	locked 72f99c52	↔ same branch, rebuilt head
Editor	6000.5.4f1 (d550df8bd089)	6000.5.5f1 (d16e074b49fd)	↔

No new files of any kind in this commit. Across the whole PR only three files are added — UIDesignGlyphs SDF.asset (+.meta) and PhysicsCoreProjectSettings2D.asset. No .dll / .so / .dylib / .bundle / .exe / .jar / .aar added anywhere.

---

2. Summary table (whole PR, e900164f9..HEAD)

Dependency / file	Version →	Source	Type	Scope	Risk	Confidence
com.alttester.sdk	2.3.0 registry → git#vendor/alttester-2.3.0-entityid (b6a3925c)	private git (decentraland, SSH)	source	runtime, define-gated	MEDIUM	HIGH (gating) / LOW (patch contents)
com.renderheads.avpro.video-ultra	unpinned → #fix/unity-6000.5.4-api-compat (72f99c52)	private git	source + native	runtime	MEDIUM	HIGH
com.gurbu.gpui-pro / .terrain / com.dcl.gpui-assets	unpinned → #fix/unity-6000.5.4-api-compat (72f99c52)	private git	source	runtime	MEDIUM	HIGH
com.decentraland.filebrowserpro	unpinned → #fix/unity-6000.5.4-api-compat (72f99c52)	private git	source	runtime	MEDIUM	HIGH
decentraland.renderfeatures	unpinned → #fix/unity-6000.5.4-api-compat (72f99c52)	private git	source	runtime	MEDIUM	HIGH
com.decentraland.unity-shared-dependencies	unpinned → #fix/unity-6000.5-shader-compat (52619333)	private git	source	runtime	MEDIUM	HIGH
com.cysharp.unitask	73d86259 → ceac8d69 (still unpinned)	github.com/Cysharp	source	runtime	MEDIUM	HIGH
decentraland.grassshader	c35c10aa → 53f8551a (still unpinned)	private git	source	runtime	MEDIUM	HIGH
superscrollview	8e1478ec → 53f8551a (still unpinned)	private git	source	runtime	MEDIUM	HIGH
com.mackysoft.serializereference-extensions	1.3.1 → 1.7.0	OpenUPM	source	editor tooling	MEDIUM	LOW (no registry data)
com.brunomikoski.animationsequencer	0.5.4 → removed	—	—	—	LOW (improvement)	HIGH
io.sentry.unity	#4.0.0 → #4.7.0 (2768f823)	getsentry/unity, tag + hash-locked	source + native	runtime	LOW	HIGH
com.coffee.softmask-for-ugui	#3.5.0 → #3.6.2 (5a568c41)	mob-sakai, tag + hash-locked	source	runtime	LOW	HIGH
com.unity.services.core	1.16.0 → 1.18.0 (pulls newtonsoft-json 3.2.1→3.2.2)	packages.unity.com	source	runtime	LOW	HIGH
Unity 1st-party (URP/VFX/shadergraph/core 17.4→17.5, collections 6.4→6.5, ugui 2.0→2.5, test-framework 1.6→1.7, test-framework.performance 3.2→3.5, ext.nunit 2.0.5→2.1.0, editorcoroutines 1.0.1→1.1.0, burst 1.8.28→1.8.29, cinemachine 2.10.6→2.10.7, localization 1.5.8→1.5.12, timeline 1.8.11→1.8.12, memoryprofiler, profile-analyzer 1.3.2→1.4.0, multiplayer.playmode)	various	packages.unity.com / builtin	source	mixed	LOW	HIGH
com.unity.mathematics 1.3.3→1.4.0	registry → builtin	Unity builtin	source	runtime	LOW (improvement)	HIGH
com.unity.modules.vr removed; com.unity.modules.xr promoted to direct; new transitive com.unity.modules.physicscore2d	—	builtin	—	runtime	LOW	HIGH
UIDesignGlyphs SDF.asset (+.meta)	new	in-repo bake	TMP asset w/ embedded SDF atlas	runtime	LOW	HIGH
PhysicsCoreProjectSettings2D.asset	new	Unity 6000.5 builtin	settings	runtime	LOW	HIGH

---

3. MEDIUM findings — status after this push

M1 — Eight dependencies still on mutable branch refs (unchanged)

[PR] Every git pin added by this PR is still a branch name, not a SHA:

com.alttester.sdk                           #vendor/alttester-2.3.0-entityid   → b6a3925c1f477231b25fcbc010be49dde4507028
com.renderheads.avpro.video-ultra           #fix/unity-6000.5.4-api-compat     → 72f99c525969d006faf15b0b55569e1a5e6458d9
com.gurbu.gpui-pro                          #fix/unity-6000.5.4-api-compat     → 72f99c52…
com.gurbu.gpui-pro.terrain                  #fix/unity-6000.5.4-api-compat     → 72f99c52…
com.dcl.gpui-assets                         #fix/unity-6000.5.4-api-compat     → 72f99c52…
com.decentraland.filebrowserpro             #fix/unity-6000.5.4-api-compat     → 72f99c52…
decentraland.renderfeatures                 #fix/unity-6000.5.4-api-compat     → 72f99c52…
com.decentraland.unity-shared-dependencies  #fix/unity-6000.5-shader-compat    → 52619333d46173c4f8258fe25c7ca1cec1bfa2cc

[Inference] packages-lock.json does hold the resolved SHAs and UPM honours them while the manifest string is unchanged, so day-to-day this behaves as pinned. The residual exposure:

• Any lockfile regeneration (dropped on a merge conflict, an Editor Resolve/Update, a clean CI bootstrap without the lock) silently takes whatever the branch head is at that moment. For code shipping in a desktop client, a SHA pin closes that window outright.
• fix/unity-6000.5.4-api-compat is a fix branch by name — when decentraland/unity-explorer-packages#60 lands and it is deleted, six manifest entries stop resolving. It is also named for 6000.5.4 while the project now targets 6000.5.5f1, which will read as stale to the next person.
• The #fix/… → #vendor/… rename for AltTester in this push is exactly the right instinct (a standing name, not a fix name). The same reasoning applies to the other six.

Recommendation: replace each #branch with the 40-char SHA already sitting in the lockfile. Same reachability, no mutability, survives branch deletion.

Fix this →

M2 — AltTester: public registry → private fork; the vendored patch is still not reviewable from this PR (refined)

[PR] com.alttester.sdk goes from 2.3.0 / source: registry / OpenUPM to source: git on a private SSH remote, now at vendor/alttester-2.3.0-entityid (b6a3925c). AltTester is the most privileged dependency in the tree — it embeds a WebSocket/TCP server inside the running client permitting remote object inspection, input injection, and static-method invocation.

Gating re-verified at this HEAD (this part is solid — double-gated):

• MainSceneLoader.cs:788-801 — InstantiateAltTester has a wholly #if ALTTESTER body, and MainSceneLoader.cs:250 only calls it when AppArgsFlags.ALTTESTER (--alttester) is present.
• CloudBuild.cs:65-70 — AltBuilder.RemoveAltTesterFromScriptingDefineSymbols(BuildTargetGroup.Standalone) runs when IS_RELEASE_BUILD == "true".
• SceneFacade.cs:82,104,148 and AlttesterSceneReadinessProbe.cs:1 are #if ALTTESTER-guarded throughout.

Residual concerns:

• [PR] Explorer/Assets/DCL/PluginSystem/DCL.Plugins.asmdef:69-70 references AltTester.AltTesterUnitySDK.Driver and AltTester.AltTesterUnitySDK with no defineConstraints. Whether those assemblies actually drop out of a release player depends on defineConstraints inside the vendored package's own asmdefs — [UNKNOWN], the package tree is private and not fetched here.
• [Inference, pre-existing — not introduced by this PR] MainSceneLoader.cs:85 declares [SerializeField] private GameObject altTesterPrefab outside any #if, so the AltTester prefab stays a hard scene reference and is pulled into every player's asset bundle regardless of the define. It is never instantiated without the define and the flag, so this is surface, not an active listener — but it means "stripped from release" is only true of the code path, not necessarily of the payload. Worth one look at a real release player's Managed/ folder and asset manifest to settle both this and the point above.
• [UNKNOWN] The PR body cites a "committed 191-line diff" and tools/revendor-alttester.sh --verify. Re-checked at b43443d3: neither exists in this repo — no tools/ directory, and find for revendor-alttester* returns nothing. Both live in decentraland/unity-explorer-packages#60, so the delta between upstream 2.3.2 and the shipped vendor copy cannot be reviewed from this PR. The claim is specific and plausible; it is simply unverified here.
• [Inference] Because the ref is a branch, a force-push to vendor/alttester-2.3.0-entityid changes what ships with no diff appearing in this repo.

Recommendation: pin to b6a3925c… (M1); confirm vendor/alttester-2.3.0-entityid is branch-protected against force-push and deletion in the packages repo; have a reviewer sign off on the 191-line patch inside unity-explorer-packages#60 rather than treating this PR as the review point. Optionally add defineConstraints: ["ALTTESTER"] on the DCL side so the reference is provably inert in release.

M3 — Three unpinned deps silently advanced their locked hashes (unchanged)

[PR] These have no #ref at all in manifest.json, yet their lockfile hashes moved in this PR without being mentioned in the description:

Package	hash before → after
com.cysharp.unitask	73d86259ce… → ceac8d6946…
decentraland.grassshader	c35c10aabe… → 53f8551aca…
superscrollview	8e1478ec9f… → 53f8551aca…

UniTask is a third-party upstream whose default branch moved — an unreviewed bump of a core runtime dependency riding along inside a Unity-version PR. The other two are decentraland-owned but sit in the same repo where six sibling entries just got explicit refs, so the omission reads as accidental rather than deliberate.

Recommendation: pin all three to the SHAs now in the lockfile, and call out the UniTask bump explicitly in the PR description so it gets its own set of eyes.

Fix this →

M4 — Dead OpenUPM scopes left behind, including a silent AltTester fallback (re-confirmed, with a correction)

[PR] Both files still carry scopes that no longer have a package behind them:

• Explorer/Packages/manifest.json:88,90 — com.brunomikoski, com.alttester.sdk
• Explorer/ProjectSettings/PackageManagerSettings.asset:42,44 — same two

The AltTester one is the one that matters: if the git entry is ever dropped or fails to resolve, UPM can silently satisfy com.alttester.sdk from the public registry again, quietly undoing the deliberate vendoring decision.

Correction to my previous comment. My earlier Fix this link implied the com.mackysoft scope situation was settled; to be explicit — keep com.mackysoft. It is now load-bearing again, because this push moved com.mackysoft.serializereference-extensions from the vendored git tree back to OpenUPM 1.7.0. Removing that scope would break resolution. Only com.brunomikoski and com.alttester.sdk are dead.

Fix this →

M5 — serializereference-extensions 1.3.1 → 1.7.0, still with no registry verification (unchanged)

[PR] Four minor versions on an OpenUPM package. The lockfile shows "dependencies": {}, so no new transitive deps, and it is now a plain immutable registry version rather than the vendored git tree it briefly was — that part is an improvement. It is SerializeReference dropdown tooling, so the capability is proportionate and predominantly editor-side.

[UNKNOWN] Publisher identity, license, publish date, advisories, and whether 1.7.0 added a runtime assembly — none could be checked (network denied, both runs). The PR notes 1.7.0 ships an AdvancedDropdownItem.children usage the API updater rewrites, which implies editor code. Please confirm the license is Apache-2.0-compatible and the publisher is still mackysoft before merge.

---

4. LOW-risk notes

• com.brunomikoski.animationsequencer removal is clean — grep over all .cs and .asmdef finds zero references. Net reduction in shipped surface. 👍
• com.unity.mathematics moved registry → builtin in 6000.5 — one fewer external registry fetch. Small improvement.
• New transitive com.unity.modules.physicscore2d (via com.unity.modules.physics2d), matching the new PhysicsCoreProjectSettings2D.asset. Builtin, consistent, expected.
• com.unity.services.core 1.16.0→1.18.0 drags com.unity.nuget.newtonsoft-json 3.2.1→3.2.2 — a JSON parser that is in the runtime path, but Unity-hosted and a patch bump. Fine.
• com.unity.ugui 2.0.0→2.5.0 newly declares audio, physics, and physics2d module deps; com.unity.modules.ai newly declares jsonserialize. Both are upstream manifest corrections, not new capability.
• New TMP font asset UIDesignGlyphs SDF.asset is YAML with an embedded SDF atlas bitmap (Texture2D at line 293, one long _typelessdata line at 332). Non-executable pixel data; I have not inspected it byte-for-byte and make no claim beyond its structure. Its m_SourceFontFileGUID: e942926d8b6dad246920ce7dd79a67d2 resolves to the in-repo NotoSansSC-SemiBold.otf — good provenance, though worth double-checking that's the intended source font given the asset is named "UI design glyphs", not Noto.
• dcl_exit_stopwatch.exe — a shipped native executable in StreamingAssets. Pre-existing; this PR only adds the DefaultImporter block to its .meta. Flagged only so it isn't mistaken for a new addition.
• asmdef GUID → name refs (DCL.Plugins.asmdef:69-70): functional, but name refs are the weaker form — they don't survive an assembly rename the way GUIDs do. Since the package is now vendored under your control, a stable .meta GUID would be preferable.
• packages-lock.json still lost its trailing newline (\ No newline at end of file).
• Version drift persists: Explorer/ProjectSettings/VirtualProjectsConfig.json still says 6000.5.4f1 while ProjectVersion.txt is now 6000.5.5f1. Stale leftover from the retarget — cheap to fix while you're here.
• URP / SoftMask / Sentry / Unity-module changes all read as ordinary consequences of the editor bump. m_PreLoadSettingsInBuild: 1 + 6 registered shader variants in UISoftMaskProjectSettings.asset is standard for SoftMask 3.6.x. Dropping com.unity.modules.vr in favour of direct com.unity.modules.xr slightly reduces shipped surface.
• The three C# behaviour changes (MetricsRegistry.IsAssignableSafe, FallbackFontsProvider awaited init, HomeMarkerController GetInstanceID → reference equality) are unchanged by this push and remain reasonable 6000.5 adaptations with no security relevance.

---

5. What I could not verify

1. All registry metadata — WebFetch/WebSearch denied in both review jobs; gh api not allowlisted. Publisher, license, advisories, and publish dates are unchecked for every package.
2. The AltTester vendor patch itself — lives in unity-explorer-packages#60; the --verify tooling is not in this repo.
3. Contents of the six #fix/unity-6000.5.4-api-compat package trees — private repo, not fetched.
4. Whether a real release player actually excludes the AltTester assemblies and prefab — the gating code is correct, but defineConstraints inside the vendored package and the IS_RELEASE_BUILD pipeline wiring were not exercised.

---

Verdict

No HIGH-risk item. No opaque native plugin added, no new dynamic or remote code loading, no unknown publisher gaining a privileged capability, and the one genuinely privileged dependency (AltTester) is both define-gated and flag-gated with release-time define removal wired up.

This push moved the branch in the right direction — one vendored package deleted outright, one returned to an immutable public registry version, and AltTester rehomed onto a durable branch name. The remaining concerns are the same two as before: mutable branch pinning (M1/M3) and vendored source that can't be reviewed from here (M2). Both want a human pass before merge.

DEPENDENCY_REVIEW: NEEDS_ATTENTION

No files were changed by this review — findings only, as requested by the review workflow.
· branch chore/unity-6000.5.2f1-upgrade