Ok, I see that it is imported once in spec, but the import is also unused.

marked was added in this commit (not part of a PR): 61651db and removed in #12903 (specifically here: diff, commit).

(I got this from trawling through the git blame (for example, here) of package.json and spec/atom-reporter.coffee...)

If I understand correctly, it was used to render some logging output as fancy markdown, which I presume was only seen while running the tests. But that's from just a quick look, so I might be wrong. In any case, all use of marked directly in Atom core (not as a sub-dependency of another package) does seem to have been removed.

Hmm, settings-view says ^1.2.0 but I wonder if 1.2.9 actually breaks settings-view somehow

Yeah, I just did some CI runs to test that, looks like it to me.

❌ This PR: https://dev.azure.com/DeeDeeG/b/_build/results?buildId=1189&view=results
✔️ This PR, but revert package-lock.json changes https://dev.azure.com/DeeDeeG/b/_build/results?buildId=1188&view=results

Given these results, I think reverting the change in package-lock.json should do it.

(Side note: I don't really understand how package.json can be updated by this PR and have no effect on package-lock.json, but it looks like that's correct somehow. Deduping is weird I guess? I ran npm install and apm install and both thought package-lock.json needed no changes, despite deleting marked as a top-level dependency from package.json.)