ZenNotes/zennotes v2.67.0

ZenNotes v2.67.0

on GitHub

ZenNotes 2.67.0 makes Disconnect in Settings → Cloud end the app's access on ZenNotes Cloud, instead of only forgetting it on this computer.

Released from 58ba24ac through #924 on 2026-10-12. All installers are verified.

Fixes

• Disconnecting ends the app's access on ZenNotes Cloud. Disconnect in Settings → Cloud only forgot the sign-in on this computer. The device stayed listed under Connected apps on zennotes.org, with a token that still worked, until someone removed it there. Now the app asks ZenNotes Cloud to end this device's access first, then forgets the sign-in. Signing out never waits on the answer for more than five seconds: offline, or with the service unreachable, the app still signs out, and the device stays listed on the website, where Disconnect ends its access as before. The iPhone and Android apps get the same in their next updates.

For contributors

• Sign-out revoke: the desktop's CloudAuthManager sends DELETE /api/v1/devices/current with the stored token before it deletes the token, and the shared CloudAuthFlow (packages/shared-domain/src/cloud-auth-flow.ts) takes an optional revoke dependency so the phone apps do the same. A failure, a 401 (the token was already gone) or five seconds without an answer still signs out. The token goes only to an origin connect would accept, the desktop refuses redirects, and a legacy zennotes.laravel.cloud account asks zennotes.org, where its token moved. Service: ZenNotes/website 4b8f1cb.
• Ids without crypto.randomUUID: randomUUID() in packages/shared-domain/src/random-uuid.ts makes version 4 UUIDs from crypto.getRandomValues where crypto.randomUUID is missing (Safari and WebKit before 15.4, so iOS 15.0 to 15.3), and Cloud sync, backup restores, the conflict queue and the portable database and filesystem operations now use it. Nothing changes on the desktop, where Electron has crypto.randomUUID; the phone apps pick it up with their next core.

Verification

How to test locally: build and launch with isolated stores, npm run build --workspace @zennotes/desktop, then ZENNOTES_USER_DATA_PATH=$(mktemp -d) ZENNOTES_CONFIG_DIR=$(mktemp -d) npx electron apps/desktop/out/main/index.js, open a vault, and connect ZenNotes Cloud in Settings → Cloud.

1. Disconnect. On zennotes.org, open your account's Connected apps: this computer is listed. In the app, choose Disconnect in Settings → Cloud, then reload Connected apps. Before: the computer stayed listed and its token kept working. After: it is gone.
2. Disconnect offline. Connect again, turn off the network, and choose Disconnect. The app signs out within five seconds; once you are back online, the computer is still listed on the website, and Disconnect there ends its access as before.

Distribution channels

• GitHub release: installers for macOS (Apple silicon and Intel DMG and zip), Windows (x64 installer and zip) and Linux (x64 and arm64 AppImage, deb, rpm, pacman, tar.gz), with the four update manifests.
• AUR: zennotes-bin 2.67.0-1 (AUR clone fcfcc00, repo 3638966c), pinned to ZenNotes-2.67.0-linux-x64.tar.gz SHA-256 79eea21c…a0dd (GitHub's own digest for the asset), after the bump script checked the bundled CLI folder is world-readable; aur-check passed.
• Nix: packaging/nix/release-data.json lifted from the update workflow (run 38277657281, bot PR #927 closed) as e1af38b0; its desktopHash is the same digest as the AUR pin, and nix-build on main passed.
• nixpkgs: NixOS/nixpkgs#572180, which proposed 2.64.0 -> 2.66.0 and had not merged, now proposes 2.64.0 -> 2.67.0; the source hash comes from the tag tarball, and the same prefetch reproduces the 2.64.0 hash in nixpkgs today.
• Homebrew: zennotes 2.67.0 in the tap (754b33f), mirrored in e4875c50; both DMGs were downloaded and their SHA-256 matches the cask and GitHub's digest; brew style clean.
• Website: ZenNotes/website#68 merged at 0c8dfb03 with the releases page entry; its main tests and deploy passed, Laravel Cloud's deployment succeeded at 16:39 UTC, and zennotes.org/releases serves the 2.67.0 entry. The share viewer stays on 2.65.0: the 2.67.0 viewer artifact is published, but nothing a reader sees changed.
• zn CLI: unchanged; this release bundles 0.6.3, still the newest.
• Server: ZenNotes/znserver v2.67.0 pins the published web-2.67.0-web.h4db5a15773234ee6 browser artifact (nothing changes for self-hosters); Docker adibhanna/zennotes:2.67.0, 2.67 and latest (linux/amd64 and arm64, one digest cda965e9…).
• Phones: iPhone 1.23.0 (39) and Android 1.1.37 (40) on the published core-2.67.0-core.hb828dd60259bc376, with the same Disconnect behavior (and Cloud sync again on iOS 15.0 to 15.3). iPhone 1.23.0 is waiting for App Review (zennotesios#57, main d9e013d); Android 1.1.37 is merged (zennotesandroid#109, tag v1.1.37, merge b863e42 with the same tree as the uploaded bundle) and goes to Google Play review.

Release validation

Cycle checks:

• The sign-out revoke, in the built app against a local copy of the website: Disconnect revoked the device and deleted its token; against a server that accepts the connection and never answers, the app signed out after 5.06 seconds having sent the one request. Tests cover the revoke, a failure, the 401, the timeout, the origin check, the refused redirect and the legacy host on the desktop, and the revoke, a failed revoke and a sign-in still pending in the shared flow.
• The UUID fallback: tests run with crypto.randomUUID removed and check 200 distinct version 4 ids, the ids Cloud sync gives new items and operations, and a backup restore's idempotency key; with the fallback taken out, they fail.

Release-time gates on 58ba24ac:

• npm run typecheck 8/8 and npm run test:run 6/6 with no turbo cache: shared-domain 1,974, app-core 3,140, quicklook 15 and desktop 1,071 tests passed. npm audit --omit=dev --audit-level=high is clean (the same 15 low or moderate advisories remain, in dompurify, fast-uri, ip-address, katex, smol-toml and sprintf-js).
• npm run pack: build:prod passed and the app signed on the first try. codesign --verify --deep --strict passed, the log shows electron-builder's "skipped macOS notarization" (CI notarizes), and the app bundles zn v0.6.3 in a world-readable Resources/zn-cli and the Quick Look extension. Packaged launch check: a page target in 1.6 s reporting 2.67.0.
• Smoke suites on the built app: test:vim-editor (12 checks), test:sidebar-vim (12) and test:editor-improvements (19) passed on their first run.
• PR #924: all nine checks passed on 58ba24ac; main fast-forwarded to it and the annotated tag v2.67.0 started the release run.
• The release run published every platform in one pass (run 38273452908): Linux arm64 in 12 minutes, Linux x64 in 15, Windows in 21 and macOS in 27. Each Mac app was notarized once: the log shows electron-builder's "skipped macOS notarization" and then one [notarize] pass per architecture.
• All four update manifests and the 13 files they name passed size and downloaded SHA-512 verification. The apps in both DMGs passed notarization (Notarized Developer ID), staple and strict deep signature checks, report 2.67.0 and carry ZenNotesQuickLook.appex and a world-readable Resources/zn-cli (the arm64 zn reports v0.6.3). GitHub latest is v2.67.0, and verify:channels -- 2.67.0 passed for Homebrew, AUR, Nix and all seven website download routes.