Pin cosmiconfig to specific version

[joberstein]

Description

Pin cosmiconfig to specific version.

Motivation and Context

Yarn at least (maybe npm also?) doesn't update transitive dependencies, so any consuming apps that had installed a lower version of 8.x.x would face an issue by not pinning to a specific dependency because yarn won't update transitive dependencies if the installed one satisfies the requirement (e.g. 8.0.0 will satisfy ^8.0.0 even if it's not the latest 8.x.x).

Pinning a specific version so that installers will be forced to install the new version of comsiconfig when updating commitlint/cli or commitlint/load.

Resolves:

• fix: break .cjs after upgrading to 18.4.0 #3754
• fix: not working in yarn 4 pnp #3752

Caused by:

• Bump cosmiconfig version and conditionally support mjs config #3747

Usage examples

N/A

How Has This Been Tested?

Tested locally by installing the updated version in https://github.com/mikro-orm/mikro-orm which was facing this issue.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have added tests to cover my changes.
• All new and existing tests passed.

[escapedcat]

Thanks @joberstein and @newives !