Update marked and js-yaml deps

See https://nodesecurity.io/advisories/JS-YAML_Deserialization_Code_Execution and https://nodesecurity.io/advisories/marked_multiple_content_injection_vulnerabilities