This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
Affected surfaces
Summary
AI summaryUpdates β¨ Improvements, π Security & maintenance, and π Fixes across a mixed release.
Full changelog
ZenNotes 2.10.0 β Transclusion, Markdown-link backlinks, and reorderable database columns
Installers for macOS, Windows, and Linux are attached below once the build finishes. On macOS,
brew install --cask zennotes/tap/zennotes; on Arch,yay -S zennotes-bin.
β¨ Improvements
- Transclusion β embed notes with
![[Note]]: prefix a wikilink with!to inline the target note's rendered content in the reading view and PDF export, recursively and with cycle protection. A "master note" can pull in subβnotes and export to PDF as a single document β frontmatter is stripped, codeβfenced embeds stay literal, and image/asset embeds work as before. (Requested on YouTube by @hisky.) - Backlinks for Markdown links: the connections panel now counts standard Markdown links
[text](Note.md)β incoming and outgoing β not just[[wikilinks]], so notes stay connected even if you never use wikilinks. (Next: the MCPbacklinkstool + renameβrewriting follow.) (Requested on YouTube by @70dark.) - Excalidraw + the Space leader key play nice: inside an Excalidraw tab, tap Space for ZenNotes' leader menu and hold Space to pan the canvas with Excalidraw's Hand tool. The leader no longer swallows Space, so panning big boards works again β a quick tap still opens the leader. (#309, thanks @junereycasuga)
- Quick Note editor matches the main editor: in the Quick Note window,
j/know move by visual line through softβwrapped text (the #290 behavior), and the inlineβformat shortcuts work ββB/βI/βE(bold/italic/code),β§βS/β§βH/β§βM(strike/highlight/math),βK(link) β soβIitalicizes the selection instead of selecting the line. (#312, thanks @nianiam) - Reorder database columns: in a CSV/database table you can now reorder fields β drag a column header, press
H/Lon the focused column (vimβstyle; the cursor follows), or use Move left / Move right in the column's field menu. Previously a new field could only be appended to the end. (#317, thanks @bahaospanov) - CLI renamed
zenβzn: the optβin commandβline tool now installs asznso it stops colliding with Zen Browser'szenon your PATH (Linux, and macOS via Homebrew). Installing migrates an old ZenNoteszenfor you β and it never removes azenthat isn't ours β while the Raycast extension andzn mcpfollow along. Update any scripts or aliases fromzen β¦tozn β¦. (#126)
π Fixes
- Calendar counts
@waitingtasks consistently: a task with a due date and@waitingnow appears in the sidebar calendar too, not just the Tasks calendar β so the two views' perβday counts match again. (#311, thanks @npodoscope) - Relativeβnumber jumps respect wrapped lines: with relative line numbers on, a counted
{count}j/{count}k(e.g.3j) now jumps to the logical line the gutter shows β counting logical lines, not wrapped display rows β while a barej/kstill steps one visual row. (#314, thanks @npodoscope) - Sidebar keyboard nav works in Daily/Weekly Notes:
h/landβ/βnow expand/collapse the Daily Notes and Weekly Notes date groups (and their year/month subgroups) like any other folder, instead of doing nothing or snapping the selection back to the parent. (#301, thanks @uNyanda)
π Security & maintenance
- Docker image β updated Go runtime: the self-hosted server image now builds on Go 1.26.4 (was 1.22.12), clearing a critical plus 40+ high/medium stdlib CVEs that image scanners flagged, and bumps the
go-chi/chirouter to v5.2.5 (from v5.2.0). No behavior change β just a patched runtime. (#303, thanks @wedgen) - Docker β clearer
ZENNOTES_AUTH_TOKEN_FILEfailures: when the authβtoken file is set but missing, unreadable, or empty (wrong path, unmounted secret, permissions), the server now logs a precise reason βZENNOTES_AUTH_TOKEN_FILE "β¦" could not be read: β¦β instead of the misleading "ZENNOTES_AUTH_TOKENmissing", and the startup message lists the_FILEoption. The selfβhosting docs gained a Dockerβsecrets example and the common gotchas. (#304, thanks @wedgen) - Linux arm64 packages are back: the release build again produces the arm64
.deb/.pacman/.AppImage/.tar.gzβ v2.9.0 shipped without them because electronβbuilder's bundledfpmis x86βonly and errored on the native aarch64 runner (the AppImage/tar.gz built, then thedebstep killed the run). The arm64 release leg now installs a nativefpmand points electronβbuilder at it, scoped so x64 keeps the bundled binary. (#307 / #308, thanks @robwilkerson) - Persist selfβhosted sessions across restarts (optβin): browser logins were kept in memory, so restarting the Docker container made you reβenter the auth token every time. Set
ZENNOTES_PERSIST_SESSIONS=1to save sessions tosessions.jsonon the/datavolume (mode0600) and reload them on startup, so you stay logged in. Off by default since it writes session tokens to disk. (Asked on Discord by Dave.)
Keyboardβfirst and localβfirst, as always.
Breaking Changes
- CLI command renamed from `zen` to `zn`; update scripts and aliases accordingly.
Security Fixes
- Docker image updated Go runtime to 1.26.4 and chi router to v5.2.5, clearing critical plus >40 high/medium stdlib CVEs.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Beta — feedback welcome: [email protected]