DOS vulnerability in dependencies

[JimMadge]

The package markdown-it-py < 2.2.0 has a local denial of service vulnerability.
There are two dependabot alerts.

• https://github.com/the-turing-way/the-turing-way/security/dependabot/4
• https://github.com/the-turing-way/the-turing-way/security/dependabot/5

These suggest the package cannot be updated because it comes from an external dependency (https://github.com/the-turing-way/pathways).
That seems a little odd though because that package requires markdown-it-py ~= 3.0.
It also requires Python >= 3.10 so I'm not quite sure what is going on.

markdown-it-py is pinned to 1.1.0 in requirements.txt.