chore(deps): update dependency zennotes/zennotes to v2.63.0

[renovate]

This PR contains the following updates:

Package	Update	Change
ZenNotes/zennotes	minor	2.62.0 → 2.63.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

ZenNotes/zennotes (ZenNotes/zennotes)

v2.63.0: ZenNotes v2.63.0

Compare Source

ZenNotes 2.63.0 answers this week's reports. An image on the clipboard now pastes through Vim's "+p, "*p and insert-mode Ctrl-R +, and through the editor's right-click Paste, not only with ⌘V. Typing - under a paragraph to start a list no longer turns that paragraph into a heading (#​898). A config.toml synced between a Mac and a Linux machine no longer changes just because the app was opened (#​901). And the app no longer ships two packages nothing uses, so it is 5.9 MB smaller.

Released from dc8fe105 through #​904 on 2026-10-06. All installers are verified.

Fixes

• An image on the clipboard pastes through Vim and the editor menu. A screenshot pasted only with ⌘V (Ctrl+V), or with a middle click on Linux. Right-click → Paste and "+p read only text from the clipboard, and "*p and insert-mode Ctrl-R + / Ctrl-R * did not read the system clipboard at all, not even its text. All of them now save an image into assets/ and embed it, exactly as ⌘V does, and paste text otherwise. A Vim put lands the image on a line of its own, below the cursor line for p and above it for P; Ctrl-R and the menu insert it at the cursor. With Sync clipboard with Vim registers on, p and P take images too. "* means the system clipboard, as it does in Vim on macOS and Windows; the Linux middle-click selection is not read.
• A line over a lone dash stays a paragraph. Markdown reads a single - under a line as a heading underline, so typing - under a paragraph to start a list turned the paragraph into a heading in the editor, the outline and the Preview, and the note kept it. A line over a lone - (spaces after it allowed) now stays a paragraph, with the dash as its last line, in the editor, the template editor, the outline, the Preview, and PDF, email and Word export. zn 0.6.3, which this release bundles, follows the same rule, and shared notes follow with the next viewer release. --, --- and === under a line still make a heading. Other Markdown apps, GitHub included, still show such a line as a heading; the note text is unchanged (#​898).
• A synced config.toml stays the same on every OS. Opening ZenNotes rewrote the commented keymap reference in config.toml with that platform's defaults, so a file shared between a Mac and a Linux machine through git or stow showed 14 changed lines every time it was opened on the other one. The reference now reads the same everywhere: each action shows its cross-platform default, and the 14 actions with their own Mac default note it, as in # "tabs.select1" = "Alt+1" # Go to tab 1 (macOS: "Ctrl+1"). The first launch of 2.63.0 rewrites the reference once on each machine; after that the file changes only when a setting does (#​901).
• The app no longer ships two unused packages. Since 2.62.0 the app carried sass and @​parcel/watcher (with its native binaries), which came along with an Excalidraw dependency and are never loaded. They are left out now: the app is 5.9 MB smaller, and the Nix package no longer has to remove the watcher's musl binary.

For contributors

• Clipboard: lib/editor-paste-images.ts adds readSystemClipboard() (the whole clipboard; an image comes back as a nameless file, so the vault names it "Pasted Image "), the editorImagePaste facet that EditorPane provides with its note import, and pasteImageFilesIntoEditor(view, files, at?). lib/cm-vim-clipboard.ts overrides codemirror-vim's paste and insertRegister actions for the + and * registers (installSystemClipboardRegisters, installed by vimClipboardPasteExtension); every other register keeps the plugin's behaviour, and editors without the facet (table cells) fall back to the clipboard text.
• Single-dash underline (#​898): one rule in four synced places. singleDashParagraphs in lib/cm-markdown-language.ts is a Lezer leaf parser ahead of the setext one that closes the paragraph where the setext heading would have closed, so later lines parse the same as in remark (the template editor gets it too). remarkSingleDashParagraph in @shared/single-dash-underline flags single-dash setext headings through a from-markdown extension and turns them back into paragraphs; the Preview, email and DOCX pipelines use it, and DOCX now runs its transformers (runSync). outline.ts needs -{2,} for a dash underline, as does the zn CLI's internal/vault/parse.go (ZenNotes/tui e608fe3). Any new parser of note headings must follow the rule.
• Config reference (#​901): keymapSectionLines in apps/desktop/src/main/app-config.ts no longer reads process.platform. Launch rewrites config.toml whenever serializeConfig disagrees with it, so anything platform-dependent in the serialized text makes a synced file churn; keep it out. app-config.test.ts renders as darwin, linux and win32 and requires identical bytes.
• Bundled CLI: apps/desktop/terminal-release.json pins ZenNotes/tui 0.6.3 (e608fe3), its signed terminal-release.json copied byte for byte after verifying against zn-release-1.pub; a desktop-managed zn updates itself to it within a day either way. The manual's CLI card and Vim clipboard entry are updated, and the website docs match.
• Packaging: the files list in apps/desktop/package.json excludes **/node_modules/sass/**, **/node_modules/@parcel/watcher/** and **/node_modules/@parcel/watcher-*/**. The Nix rm of the musl watcher (93934229) becomes a no-op once release-data.json points at 2.63.0; remove it then.

Demos

In docs/releases/v2.63.0/media/ (local), 1080p with captions burned in and a .vtt beside each. Each clip runs the same steps on the packaged 2.62.0 app, then on a 2.63.0 build, both on a scratch vault:

• clipboard-image-paste.mp4 (39 s): Vim mode on, a screenshot on the clipboard, then "+p in normal mode, o and Ctrl-R + in insert mode, and right-click → Paste. On 2.62.0 none of them pastes anything; on 2.63.0 the picture lands below the line, at the cursor, and after the right-clicked line.
• 898-lone-dash-paragraph.mp4 (34 s): Split view, "Things to buy:", Enter, -, then two items, then "Sunday" over ---. On 2.62.0 the dash turns "Things to buy:" into a heading in the editor and the Preview until an item is typed; on 2.63.0 it stays text. "Sunday" over --- is a heading on both.

Verification

How to test locally:

1. Build and launch with isolated stores: npm run build --workspace @zennotes/desktop, then ZENNOTES_USER_DATA_PATH=$(mktemp -d) ZENNOTES_CONFIG_DIR=$(mktemp -d) npx electron apps/desktop/out/main/index.js. Turn Vim mode on in Settings → Editor.
2. Clipboard images: copy a screenshot (⌘⌃⇧4 on macOS), open a note, put the cursor in the middle of a line in normal mode and press "+p. Before: nothing happens. After: the image appears on its own line below that line, and assets/ holds "Pasted Image .png". Then try "*P (the image lands above the line), o followed by Ctrl-R + (at the cursor), and right-click → Paste (at the cursor).
3. Clipboard text: copy a word in another app, then press "*p in normal mode, or o and Ctrl-R +. Before: nothing. After: the word is pasted.
4. Lone dash (#​898): type Some text, press Enter, then type -. Before: "Some text" turns into a heading in the editor, the outline lists it, and Split view's Preview shows a heading. After: it stays a paragraph in all three, and the Preview shows "Some text -". Change the dash line to --: it is a heading again.
5. Synced config (#​901): launch with an isolated ZENNOTES_CONFIG_DIR, quit, and look at config.toml: tabs.select1 reads "Alt+1" # Go to tab 1 (macOS: "Ctrl+1"). Change that line to the pre-fix Linux form, # "tabs.select1" = "Alt+1" # Go to tab 1, launch and quit again. Before: on a Mac the app rewrote 14 reference lines to Ctrl+... (a Linux machine flipped them back). After: it rewrites them once to the shared form, and the next launch leaves the file byte-identical. node docs/releases/v2.63.0/issue-901/repro.mjs <dir> runs the before case on a build of 2.62.x.
6. Package size: npm run pack, then npx @electron/asar list dist/mac-arm64/ZenNotes.app/Contents/Resources/app.asar | grep -c -E "node_modules/(sass|@parcel)/" in a scratch directory. Before (2.62.0): 15 sass and 40 @​parcel entries. After: 0.

Distribution channels

• GitHub release: installers for macOS (Apple silicon and Intel DMG and zip), Windows (x64 installer and zip) and Linux (x64 and arm64 AppImage, deb, rpm, pacman, tar.gz), with the four update manifests.
• AUR: zennotes-bin 2.63.0-1 (AUR clone 914850c, repo f1b8a585), pinned to ZenNotes-2.63.0-linux-x64.tar.gz SHA-256 11402f76…990ae, after the bump script checked the bundled CLI folder is world-readable; aur-check green.
• Nix: packaging/nix/release-data.json lifted from the update workflow (run 37536793466, bot PR #​905 closed) as 41a4a8f9; its desktopHash is the same digest as the AUR pin, and nix-build passed on main. 897a46c0 then dropped the 2.62.0 musl-watcher workaround, which no longer matched anything (nix-build passed).
• nixpkgs: NixOS/nixpkgs#570652 now proposes 2.61.0 -> 2.63.0 (source hash from the tag tarball; the same command reproduces master's 2.61.0 hash).
• Homebrew: zennotes 2.63.0 in the tap (acbc0d2), mirrored in 0918674f; both DMGs were downloaded and their SHA-256 matches the cask and GitHub's digest; brew style clean.
• Website: ZenNotes/website#63 merged at 327efd78: the releases page with both clips, the docs, and the share viewer moved from 2.51.0 to 2.63.0 so published notes follow #​898 too. Its main tests and deploy passed (run 37554917632), and zennotes.org serves the 2.63.0 release entry, both clips byte for byte, the CLI 0.6.3 and clipboard docs, and the 2.63.0 viewer next to the retained 2.51.0 one, each matching its pinned hash.
• zn CLI 0.6.3: ZenNotes/tui v0.6.3, released first with its signed update manifest; the zn formula moved to 0.6.3 in ZenNotes/tui and ZenNotes/homebrew-tap (708e88f). This release bundles it.
• Server: ZenNotes/znserver v2.63.0 pins the published web-2.63.0-web.h4816f798167f7361 browser artifact; Docker adibhanna/zennotes:2.63.0, 2.63 and latest (linux/amd64 and arm64, the image reports v2.63.0).
• Phones: iPhone 1.19.0 (35) and Android 1.1.33 (36) on core-2.63.0-core.hf5ca19182888aa46 (published), both in store review; Android's GitHub release v1.1.33 carries Play's signed universal APK.

Release validation

Cycle checks so far:

• The clipboard fix was driven in the built app over CDP on an isolated profile, with a real PNG and real text on the macOS clipboard: before, only ⌘V took an image (2 of 10 paste paths worked); after, "+p, "*p, "+P, visual "+p, Ctrl-R +, Ctrl-R *, synced p and a real mouse right-click → Paste all paste the image (the saved file byte-identical to the copied PNG), and the text paths paste text. Not run on Linux.
• #​898 was reproduced and then verified the same way: before, a line over - or - was highlighted as a heading in the editor, listed in the outline and rendered as a heading in the Preview; after, it is a plain paragraph in all three, typing a line, Enter, - leaves the line plain, and -- and --- still make headings.
• The packaging fix was verified on a packed build: no sass or @​parcel entries in app.asar or app.asar.unpacked, app.asar 5.9 MB smaller, the packaged launch check passed, and an Excalidraw drawing opened without renderer errors.
• Unit tests at the last commit: app-core 3,122, shared-domain 1,896 and desktop 1,050 passed; typecheck clean in all 8 packages.

Release-time gates on dc8fe105:

• npm run typecheck 8/8 and npm run test:run 6/6 with no turbo cache: shared-domain 1,896, app-core 3,122, quicklook 15 and desktop 1,052 tests passed. npm audit --omit=dev --audit-level=high is clean.

• The release PR's first production audit failed on three advisories published on 2026-10-05 and 06 (proxy-addr below 2.0.8, critical; @​modelcontextprotocol/sdk below 1.31.0, high; source-map-js below 1.2.2, high). dc8fe105 moves each to its first fixed version and nothing further; the MCP server built with SDK 1.31.0 was driven over stdio on a scratch vault (initialize, 34 tools, list_notes).

• npm run pack signed the app, codesign --verify --deep --strict passed, the bundled CLI in Resources/zn-cli is world-readable and reports zn v0.6.3, and the packaged launch check found a page target in 1.4 s reporting 2.63.0.

• Smoke suites on the built app: test:vim-editor and test:sidebar-vim passed. test:editor-improvements failed one check on its first run ("cursor position survives Preview and Edit mode switches" read the cursor as null before the switch, so it measured nothing) and passed all 19 checks on the re-run.

• CLI 0.6.3 was released first (ZenNotes/tui run 3753112), and its signed terminal-release.json verified against zn-release-1.pub before the desktop pinned it; its Homebrew formula moved to 0.6.3 in ZenNotes/tui and ZenNotes/homebrew-tap.

• PR #​904: all nine checks passed on dc8fe105 (macOS, Windows, Ubuntu x64 and arm64 builds, the installed-editor browser check, CodeQL and the production audit); main fast-forwarded to it and the annotated tag v2.63.0 points at it.

• Release run 37535181441 published Linux and Windows. Its macOS job sat in the build step for 95 minutes against about 40 for 2.60 to 2.62, with Apple and GitHub reporting no incident, and was cancelled. The cause showed in the first rebuild's log: every Mac app is notarized twice (electron-builder's own step, then scripts/notarize.cjs), as it was in 2.62.0, and Apple's notary was slow tonight (one pass took 29 minutes) and then answered the last pass with an empty "unexpected result", failing run 37545502434 after an hour. The macOS installers come from run 37551175526 (build and both notarization passes took about 40 minutes this time), a macOS-only dispatch from the tag that leaves every Linux and Windows file as published (the AUR and Nix pins are untouched). Dropping one of the two notarizations is the follow-up for 2.64.0.

• All four update manifests and the 13 files they name passed size and downloaded SHA-512 verification. The apps in both DMGs passed notarization (Notarized Developer ID), staple and strict deep signature checks, report 2.63.0 and carry ZenNotesQuickLook.appex; the arm64 app bundles zn v0.6.3 in a world-readable Resources/zn-cli. The Linux x64 tarball still carries the digest the AUR and Nix pin (uploaded at 21:50 UTC and never replaced). GitHub latest is v2.63.0, and verify:channels -- 2.63.0 passed for Homebrew, AUR, Nix and all seven website download routes.

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • Every minute (* * * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.