Release v0.9.1

[kwsantiago]

Summary

Bumps the workspace version from 0.9.0 to 0.9.1 and refreshes Cargo.lock, matching the shape of the v0.9.0 release commit (Cargo.toml 2 lines, Cargo.lock 22).

Required before tagging: release.yml gates every build job on

v=$(sed -n '/^\[workspace\.package\]/,/^\[/s/^version *= *"\(.*\)"/\1/p' Cargo.toml)
if [ "$v" != "${GITHUB_REF_NAME#v}" ]; then exit 1; fi

so a v0.9.1 tag on a tree that still says 0.9.0 fails build-deb and skips the release job entirely. That is the correct behavior and it is what caught this.

Release contents

Six commits since v0.9.0. The two that matter:

• Mark a FROST nonce used when it is claimed, not never #933 the FROST nonce replay guard never fired. mark_nonce_used had no callers anywhere in the workspace, so no entry was ever marked used, the reject branch was unreachable, and a repeated round-1 commitment fell through and was signed. Two signature shares over one nonce under different challenges give s = (z1 - z2) / (c1 - c2), the signer's key share. Commitments are now claimed where they are handed to the signing path, the store writes via temporary file plus fsync plus rename rather than leaving a claim in the page cache, and a versionless store is refused rather than silently trusted.
• Never let a degraded RNG path succeed quietly #932 entropy health checks ran only on mixed output. The mix folds in a monotonic counter, timing deltas and live heap and stack addresses, so post-mix samples look healthy even when the OS source writes a constant. The OS source is now sampled directly before mixing, with the mixed output still checked separately.

Also #929 and #930 (request label carried through to the approval prompt, and marked when unverified), #934 (CI job token kept out of a PR-controlled tree), #931 (rate-limit test race).

Neither of the first two is known to have been exploited, and no evidence of exploitation was sought. Both are guards that were not doing what they were written to do.

Test plan

• The version expression release.yml uses returns 0.9.1 against the new Cargo.toml
• cargo update --workspace refreshes the five workspace members to 0.9.1 with no dependency changes
• keep-core entropy suite: 12 passed, including mixing_hides_a_dead_os_source
• keep-cli nonce store suite: 8 passed, including a_repeated_commitment_is_rejected, a_legacy_store_fails_closed, the_rejection_survives_a_reopen
• Full CI on this PR

Summary by CodeRabbit

• Chores
  • Updated the workspace version from 0.9.0 to 0.9.1.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ffc6eb46-6759-4a94-8151-c050cd45682d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Walkthrough

The workspace package version in Cargo.toml changes from 0.9.0 to 0.9.1.

Changes

Release version

Layer / File(s)	Summary
Workspace version update Cargo.toml	The workspace package version changes from 0.9.0 to 0.9.1.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• privkeyio/keep#65: Updates the workspace package version in Cargo.toml.
• privkeyio/keep#606: Updates only the workspace version in Cargo.toml.
• privkeyio/keep#928: Performs the preceding workspace version bump from 0.8.0 to 0.9.0.

Poem

A rabbit checks the version line,
From zero-nine to zero-nine-one.
The workspace wears its release sign,
A tiny hop, and the bump is done! 🐇

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the release version and matches the primary change, which is the workspace version update to v0.9.1.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch release-v0.9.1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[kwsantiago]

CI surfaced a live advisory that belongs in this release rather than after it.

deny failed on RUSTSEC-2026-0224, a signature-verification bypass in nostr-relay-pool v0.44.1, reached here through nostr-sdk v0.44.1. The crate inserted its verification-cache entry before running the check, so a first delivery whose signature failed still recorded the entry; a subsequent delivery of the same event ID carrying a forged signature hit that cache, skipped verification entirely, and was handed to NostrDatabase::save_event() as though validated. The practical effect is that an application connecting to an untrusted or compromised relay can have unsigned events attributed to any public key written into its trusted store.

Updated to 0.44.2, where the cache entry is only created after verification succeeds.

Deliberately folded into this PR rather than filed as follow-up: tagging v0.9.1 with a known signature-bypass in the dependency tree would put it in the released artifacts, and the whole point of the release gate is to stop exactly that.

Verified locally:

• cargo deny check advisories reports advisories ok
• cargo update -p nostr-relay-pool moved only that crate, 0.44.1 to 0.44.2, with no other dependency changes
• cargo check --workspace --all-targets --features testing succeeds

One note on the bare cargo check --workspace --all-targets: it fails on keep-frost-net's ecdh_memory_test and nonce_pool_signing_memory_test with no function or associated item named with_transport``. That is the pre-existing testing feature gate, not this change; the same command with `--features testing` is clean.

The remaining deny output is yanked-crate warnings for async-utility, spin and nostr-relay-pool's prior version, which are warnings rather than errors and do not gate the build.