fix: [marked] Upgrade marked from 0.3.5 to 0.3.6 to resolve CVE-2016-10531 (ReDoS)

[devin-ai-integration]

Summary

Fixes the Regular Expression Denial of Service (ReDoS) vulnerability in marked@0.3.5 (CVSS 8.8 — highest-CVSS High finding, CVE-2016-10531). A crafted heading in attacker-controlled markdown triggers catastrophic backtracking in marked's heading regex, hanging the event loop. marked is a direct dependency used to render markdown in the app.

-"marked": "0.3.5",
+"marked": "0.3.6",

0.3.6 is the Snyk-recommended patched release for this CVE and is a drop-in within the 0.3.x line (no API change to the marked(text) calls). package-lock.json regenerated → marked@0.3.6.

Verified locally: snyk test parses the lockfile and no longer reports CVE-2016-10531.

• Severity: High (CVSS 8.8) · CWE-400 (Uncontrolled Resource Consumption / ReDoS)
• CVE: https://nvd.nist.gov/vuln/detail/CVE-2016-10531
• Advisory: https://security.snyk.io/vuln/npm:marked:20150520
• Snyk scan: org 9e26acce-22c7-4efc-b470-21d9587f49fe, project goof (npm)

Note: marked@0.3.x carries additional later CVEs that need a marked 4.x major upgrade (breaking API); tracked as follow-up. This PR is scoped to the single targeted CVE. Part of a set of 5 fix PRs for the top findings.

Link to Devin session: https://app.devin.ai/sessions/d6b18d8e5ad94506b760971485ceb694
Requested by: @hannahhuh-cog

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring