Upgrade marked from 4.3.0 to 18.0.11

Our single call site parses plain GFM and sanitises with DOMPurify, so
the intervening majors' breaking changes (removed sanitize/headerIds/
mangle options, the renderer token API rework) don't affect us.

- Drop @types/marked: marked ships its own types since v6.
- Pass async: false so parse() types as returning string rather than
  string | Promise<string>.

Author: microbit-matt-hillsdon

package-lock.json

@@ -29,7 +29,6 @@
     "@testing-library/react": "^14.0.0",
     "@testing-library/user-event": "^14.4.3",
     "@types/lunr": "^2.3.4",
-    "@types/marked": "^4.0.1",
     "@types/node": "^24.12.0",
     "@types/react": "^18.3.3",
     "@types/react-dom": "^18.3.0",
@@ -40,7 +39,7 @@
     "lunr": "^2.3.9",
     "lunr-languages": "^1.14.0",
     "lzma": "^2.3.2",
-    "marked": "^4.0.15",
+    "marked": "^18.0.11",
     "mobile-drag-drop": "^2.3.0-rc.2",
     "react": "^18.3.1",
     "react-aria": "^3.50.0",

package.json

@@ -77,7 +77,10 @@ export const renderMarkdown = (
   parts: DocSections = DocSections.All
 ): SanitisedHtml => {
   const html = DOMPurify.sanitize(
-    marked.parse(fixupMarkdown(subsetMarkdown(markdown, parts)), { gfm: true })
+    marked.parse(fixupMarkdown(subsetMarkdown(markdown, parts)), {
+      gfm: true,
+      async: false,
+    })
   );
   return {
     __html: html,