Re-pin keep to the v0.9.1 release commit

[kwsantiago]

Summary

Moves keep.version from b06b61f to 739cf84, which is the commit keep v0.9.1 is tagged at.

Why

#471 pinned b06b61f and v1.2.0 was tagged there. Cutting keep v0.9.1 then required a workspace version bump, because release.yml refuses to build when Cargo.toml does not match the tag, so the release commit moved to 739cf84. That left b06b61f as v0.9.1's grandparent rather than the release commit, and the v1.2.0 release notes state that this app pins keep v0.9.1. Re-pinning is what makes that statement true.

739cf84 also carries a fix that b06b61f does not. The release CI run surfaced RUSTSEC-2026-0224, a signature-verification bypass in nostr-relay-pool v0.44.1 reached through nostr-sdk: the verification-cache entry was inserted before the signature check ran, so a first delivery with a bad signature created the entry and a later delivery of the same event ID with a forged signature skipped verification entirely and was persisted as validated. Fixed in 0.44.2, which is in the tree this now pins.

The v1.2.0 tag was deleted before publishing anything and will be re-cut on the merge of this PR. No release object or artifact was ever produced under the old pin.

Test plan

• verifyKeepVersion passes against a clean checkout of 739cf84
• That checkout reports workspace version 0.9.1 via the same expression release.yml uses
• nostr-relay-pool is 0.44.2 in the pinned tree
• check-release-changelogs.sh still passes; the versionCode 28 changelogs from Release v1.2.0 and re-pin keep to b06b61f #471 are unaffected
• CI build, lint and instrumented tests

No version change: versionCode stays 28 and versionName stays 1.2.0, both already on main from #471.

Summary by CodeRabbit

• Chores
  • Updated the pinned application version identifier.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f35998a9-e853-4c78-b69f-f62eac60156a

📥 Commits

Reviewing files that changed from the base of the PR and between a1b5e39 and b3b1029.

📒 Files selected for processing (1)

• keep.version

---

Walkthrough

The pull request updates the pinned Keep revision in keep.version from b06b61f71971a3fadc4acca1f340719138d4f8b8 to 739cf845a7b74451c51d109a6157d3ba14159c7b.

Changes

Version pin update

Layer / File(s)	Summary
Update Keep revision keep.version	The stored Keep commit identifier is updated to 739cf845a7b74451c51d109a6157d3ba14159c7b.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• privkeyio/keep-android#471: Updates the same keep.version pin.
• privkeyio/keep-android#465: Updates the pinned keep.version hash.
• privkeyio/keep-android#409: Updates the pinned keep.version commit SHA.

Suggested reviewers: wksantiago

Poem

I found a newer hash to bring,
A pinned revision, fresh as spring.
One line changed, the work is neat,
The Keep now tracks a newer beat.
— A rabbit hopping through the commit tree 🐇

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the re-pinning of keep to the v0.9.1 release commit.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch repin-keep-v0.9.1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}