fix: [marked] Upgrade marked from 0.3.5 to 4.x to resolve CVE-2016-10531 (Cross-site Scripting)

[devin-ai-integration]

Summary

Resolves the highest-ranked High Snyk SCA finding (CVSS 8.8): Cross-site Scripting in the direct dependency marked.

• Vulnerability: Cross-site Scripting (XSS)
• CVE: CVE-2016-10531 · Snyk ID: npm:marked:20150520
• Severity: High (CVSS 8.8)
• Package: marked@0.3.5 (direct dependency)
• Fixed in: 0.3.6+ — but marked@0.3.x still carries several later XSS/ReDoS findings (npm:marked:20170112, npm:marked:20170815, CVE-2017-16114, CVE-2018-25110), so this PR upgrades to the maintained 4.x line which clears all marked findings.

Change

- "marked": "0.3.5"
+ "marked": "^4.3.0"

package-lock.json updated accordingly (lockfile version preserved at 2).

Compatibility

marked is not referenced anywhere in the application source (only declared in package.json), so the major-version bump carries no runtime risk for this app.

Verification

snyk test after the bump reports 0 remaining marked vulnerabilities (was 5).

Reference: https://security.snyk.io/package/npm/marked · https://nvd.nist.gov/vuln/detail/CVE-2016-10531

Generated by the scheduled Snyk MCP security scan (Snyk org 9e26acce…).

Link to Devin session: https://app.devin.ai/sessions/8d13ec8d010540e3b119dc5073862335
Requested by: @hannahhuh-cog

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring