ci: bump pinned npm packages (semantic-release, conventional-changelog) and markdownlint-cli Docker image in CI workflows

[Aamod007]

Describe the bug

Several CI workflows in this repository pin severely outdated npm packages and Docker images inline. Unlike the GitHub Actions version bumps tracked in #1194, #1196, and #1198 (which address \�ctions/checkout, \�ctions/github-script, and \�ctions/setup-node), the npm packages and Docker images installed at runtime have not been updated and are now significantly behind their latest releases.

Affected files and outdated versions

*.github/workflows/release.yml* (lines 22, 30):

• \conventional-changelog-conventionalcommits@6.1.0\ — pinned at v6.1.0. The current latest is v8.x. This package provides the commit parsing preset used by semantic-release.
• \semantic-release@21.0.7\ — pinned at v21.0.7. The current latest stable is v25.0.3 (4 major versions behind). Newer versions include important bug fixes, improved plugin compatibility, and security patches.

*.github/workflows/lint.yml* (line 16):

• \ghcr.io/igorshubovych/markdownlint-cli:v0.35.0\ — pinned at v0.35.0. The current latest is v0.48.0 (13 minor versions behind). Newer versions include updated linting rules, bug fixes, and better CommonMark compliance.

To Reproduce

You can spot this by looking at the pinned versions in the workflow files and comparing them against what's currently available:

• In [.github/workflows/release.yml](https://github.com/asyncapi/spec/blob/master/.github/workflows/release.yml), line 22 installs \conventional-changelog-conventionalcommits@6.1.0\ and line 30 runs \semantic-release@21.0.7. Checking npm shows the latest stable releases are \semantic-release@25.0.3\ and \conventional-changelog-conventionalcommits@8.x\ respectively — a gap of several major versions on both.

• In [.github/workflows/lint.yml](https://github.com/asyncapi/spec/blob/master/.github/workflows/lint.yml), line 16 pulls the \ghcr.io/igorshubovych/markdownlint-cli:v0.35.0\ Docker image. The latest available tag is \�0.48.0, putting this 13 minor releases behind.

Expected behavior

CI workflows should use reasonably up-to-date versions of their runtime dependencies to benefit from bug fixes, security patches, and improved rule coverage. Pinned versions should be periodically reviewed and bumped.

Sample document

Not applicable — this is a CI infrastructure issue.

Additional context

• This issue is complementary to ci: bump actions/checkout from v3 to v4 in local workflows #1194 (checkout v3 → v4), ci: bump actions/github-script from v6 to v7 in local workflows #1196 (github-script v6 → v7), and ci: bump setup-node to v4 and Node to 20 in release.yml #1198 (setup-node v3 → v4 / Node 18 → 20). Those issues cover GitHub Actions versions; this issue covers the npm packages and Docker images those workflows install at runtime.
• The
  elease.yml\ workflow is particularly sensitive since it runs \semantic-release\ to cut every spec release.
• A major version bump of \semantic-release\ (21 → 25) may require checking the .releaserc\ configuration for breaking changes, though the basic configuration used in this repo is typically compatible.
• Suggested approach: bump in a test branch, verify a dry-run release, then merge.

[github-actions]

Welcome to AsyncAPI. Thanks a lot for reporting your first issue. Please check out our contributors guide and the instructions about a basic recommended setup useful for opening a pull request.
Keep in mind there are also other channels you can use to interact with AsyncAPI community. For more details check out this issue.