pin marked devDep to protect out tests

marked has shown that it cannot be trusted with patch level changes!