---
title: "cosmiconfig 10.0.1"
description: "Latest published version of cosmiconfig is 10.0.1, licensed MIT. Current as of our last registry check."
url: https://inlinr.com/packages/cosmiconfig
lang: en
---

[Packages](https://inlinr.com/packages)

# cosmiconfig

10.0.1 · 30 Aug 2026 MIT 172.2M / week [Repository](https://github.com/cosmiconfig/cosmiconfig) [Homepage](https://github.com/cosmiconfig/cosmiconfig#readme) [npm](https://www.npmjs.com/package/cosmiconfig) [Atom feed](https://inlinr.com/packages/feed/cosmiconfig)

Your version 

## Where each line stands

[Plan an upgrade](https://inlinr.com/packages/cosmiconfig/upgrade)

LineNewestSecurity

- 10.x 10.0.1 No known advisory Latest line
- 9.x 9.0.2 No known advisory [To 10.0.1](https://inlinr.com/packages/cosmiconfig/upgrade/9.0.2-10.0.1)
- 8.x 8.3.6 No known advisory [To 10.0.1](https://inlinr.com/packages/cosmiconfig/upgrade/8.3.6-10.0.1)
- 7.x 7.1.0 No known advisory [To 10.0.1](https://inlinr.com/packages/cosmiconfig/upgrade/7.1.0-10.0.1)
- 6.x 6.0.0 No known advisory [To 10.0.1](https://inlinr.com/packages/cosmiconfig/upgrade/6.0.0-10.0.1)
- 5.x 5.2.1 No known advisory [To 10.0.1](https://inlinr.com/packages/cosmiconfig/upgrade/5.2.1-10.0.1)

## Latest releases

[All 57 releases](https://inlinr.com/packages/cosmiconfig/releases)

1. 10.x · latest line
2. ### [10.0.1](https://inlinr.com/packages/cosmiconfig/releases/10.0.1 "Open this release") [](https://github.com/cosmiconfig/cosmiconfig/releases/tag/v10.0.1 "Read this release where it was published")  
30 Aug 2026  
Dependency security update.
3. ### [10.0.0](https://inlinr.com/packages/cosmiconfig/releases/10.0.0 "Open this release") [](https://github.com/cosmiconfig/cosmiconfig/releases/tag/v10.0.0 "Read this release where it was published")  
2 Aug 2026

  - breaking  
  The required version range is now `^22.18 || >=24`.
  - breaking  
  Remove `typescript` in favor of Node's own type stripping. This means that TypeScript 7 projects are supported, but non-erasable type syntax like `namespace` or `enum` is unsupported.
  - breaking  
  JSON parsing uses the `JSON.parse` function directly. `parse-json` is no longer used for better error messages, since Node has improved theirs.
4. 9.x · maintenance
5. ### [9.0.2](https://inlinr.com/packages/cosmiconfig/releases/9.0.2 "Open this release") [](https://github.com/cosmiconfig/cosmiconfig/blob/HEAD/CHANGELOG.md "Read this release where it was published")  
7 Jun 2026

  - Fixed a prototype chain issue that may happen when merging different config objects.
  - Fixed the `project` search strategy not correctly stopping at the package boundary.

Dependency tracking · free for 3 projects

## Know when your own dependencies move

cosmiconfig shipped a new major in the last 12 months, among 4 releases. inlinr shows which of your projects are behind, and what the upgrade breaks.

- Advisories reach you  
An email when a critical or high advisory affects a project, before the next install.
- Upgrades checked first  
Peer ranges, Node, ESM-only and types changes read before you bump.
- Only what matters  
Majors and breaking notes stay; patches and sibling bumps fold into one line.

[How dependency tracking works](https://inlinr.com/dependencies)

## Security

No known security advisory.

## Health

[Details](https://inlinr.com/packages/cosmiconfig/security#signals)

- **Provenance**:
- **Publisher**:
- **Maintainers**:
- **Scorecard**:
- **Size**:

## Weekly downloads

Reading releases, release notes and advisories…

Registry facts last checked 3 Nov 2026\. Releases and advisories last read 3 Nov 2026.