fix: [marked] Upgrade marked from 0.3.5 to 0.3.6 to resolve CVE-2016-10531 (XSS)

[devin-ai-integration]

Summary

Resolves the highest-CVSS High (8.8) finding with a known non-breaking fix, surfaced by a Snyk SCA scan.

marked@0.3.5 is vulnerable to Cross-site Scripting (XSS) — CVE-2016-10531 / npm:marked:20150520 — via crafted markdown that bypasses sanitization. marked is a direct dependency used to render user-controlled todo content in app.js:

marked.setOptions({ sanitize: true });
// views/index.ejs: <%- marked(new String(todo.content)) %>

Fix = bump the direct dependency to the patched release (fixedIn: 0.3.6):

- "marked": "0.3.5"
+ "marked": "0.3.6"

0.3.6 keeps the setOptions({sanitize}) + marked(string) API used here, so no code changes are required.

Verification

snyk test after the upgrade confirms CVE-2016-10531 is resolved.

Note (out of scope): marked has additional, later-disclosed issues that are only fully cleared by a major upgrade (0.7+/4.x), which removes the sanitize option and changes the render API — requiring code changes. Tracked as a follow-up; this PR is scoped to the targeted CVE per one-vuln-per-PR.

One vulnerability per PR (Scheduled Snyk MCP scan, remediation phase).

Link to Devin session: https://app.devin.ai/sessions/3de7e286bad14ebb88618cf08a9489ab
Requested by: @hannahhuh-cog

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring