build(deps): bump marked from 15.0.12 to 18.0.11 in /client - #2253

Overview

The PR is a Dependabot-generated dependency bump limited to two files: client/package.json (bumping marked from ^15.0.8 to ^18.0.10) and client/package-lock.json (the corresponding lockfile resolution, tarball URL, integrity hash, and updated engines.node requirement for the marked package). No application source code, route handlers, authentication logic, or configuration schemas are touched.

Security risks

None identified. The change does not touch authentication, authorization, secret handling, or any server-side code path. marked is a client-side markdown rendering library; a supply-chain risk exists in principle with any dependency bump, but this is standard practice via Dependabot with lockfile integrity hashes updated correctly, and is not something this automated review can meaningfully further audit beyond checking the lockfile matches the intended version (which it does).

Level of scrutiny

This warrants low scrutiny: it is a mechanical, single-dependency version bump with an accompanying lockfile update, no other files changed, and no CODEOWNERS conflict for client/package.json. The major version jump (15→18) could in theory introduce markdown-rendering behavior changes (e.g., GFM handling, emphasis parsing edge cases per the release notes), but no application code depends on marked internals or renderer customization in this diff, so a full behavioral regression test is out of scope for this review and would fall to normal CI/QA rather than static code review.

Other factors

The Node engine requirement change (>= 18 to >= 20) is worth noting but is a transitive package-level requirement in the lockfile metadata, not a change to this repo's own engines field, and does not affect the ability to install/build unless the CI/build environment runs Node < 20, which is outside the scope of this diff. No test or config changes were needed for a pure dependency bump per repository conventions.