v1.13.1: security update, local images fixed

Security update, and local images in Markdown finally work

Every open Dependabot alert resolved: sixty of them. They spanned the whole dependency tree: Electron/Chromium itself, electron-updater and its runtime, DOMPurify (the Markdown sanitiser), js-yaml, fast-uri, and electron-builder's toolchain. Every fix was available within the existing version ranges, so the application is otherwise unchanged. Electron 42.3.3 → 42.11.3, electron-updater 6.8.3 → 6.8.9, DOMPurify 3.4.8 → 3.4.15. npm audit reports zero findings. Please upgrade.

Local images in Markdown documents now load. They never did before. A relative image such as ![](docs/shot.png) was rewritten to fate-local:///C:/…, and Chromium collapses the empty authority of a standard scheme the way it does for http:///host: C: became the host, the drive letter vanished, and every local image failed with file not found while its src still looked right. Confirmed on the previous Electron too, so this was the URL shape, not a Chromium change. Filenames containing #, ? or % work as well.

Linux packages are real applications. The .deb and .rpm register FATE for Markdown, plain text and about sixty code MIME types, so it appears under Open With and can be made the default from your file manager (GNOME Files: Properties → Open With → Set as default; KDE: File Type Options) or with xdg-mime default FATE.desktop text/markdown, and ship AppStream metadata for GNOME Software / KDE Discover. A Fedora .rpm joins the AppImage and .deb. These first appeared on the v1.13.0 release after it was cut; this is the first version whose source ships them from the start.

Downloads

• Windows: FATE-Setup-1.13.1.exe (existing installs update themselves).
• Linux, any distro: FATE-1.13.1-x86_64.AppImage: chmod +x and run. Existing AppImages self-update.
• Ubuntu / Debian: FATE-1.13.1-amd64.deb: sudo apt install ./FATE-1.13.1-amd64.deb.
• Fedora / RHEL: FATE-1.13.1-x86_64.rpm: sudo dnf install ./FATE-1.13.1-x86_64.rpm.