[Snyk] Security upgrade @vaadin/router from 1.7.5 to 2.0.0

[taefi]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	666/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.9	Regular Expression Denial of Service (ReDoS) SNYK-JS-PATHTOREGEXP-7925106	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: @vaadin/router

The new version differs by 68 commits.

• 167efd6 2.0.0-rc4
• 1c559fb fix: Router#resolve typings (PiT 23.3: frontend does not compile #891)
• 78ff48b 2.0.0-rc3
• ffa94b1 fix: support WCs with result property (feat(hilla): React compatible tsconfig.json (v23.3) #889)
• 070e918 2.0.0-rc2
• da67a21 fix: copy dts files (feat(hilla): React compatible tsconfig.json #888)
• c3241e0 2.0.0-rc1
• d88ea97 refactor!: move Router fully to TypeScript (Update Vaadin 23.2.7 #886)
• f5f31e0 chore: update yarn.lock and docs
• 04f7f06 chore: fix build for "type": "module" (Update Vaadin 23.1.6 #833)
• 81e86c9 chore(deps): bump y18n from 3.2.1 to 3.2.2 (Update Vaadin 22.0.0.alpha2 #605)
• d40b806 chore(deps): bump handlebars from 4.7.6 to 4.7.7 (injected #619)
• 6fa628a chore(deps): bump hosted-git-info from 2.8.8 to 2.8.9 (Update Vaadin 22.0.0.alpha6 #620)
• 1567041 chore(deps): bump ws from 7.4.2 to 7.4.6 (Remove vaadin.whitelisted-packages comment (V22) #631)
• 3281d95 chore(deps): bump path-parse from 1.0.6 to 1.0.7 (Revert "Use safe log4j version" #669)
• 58f9150 chore(deps): bump shelljs from 0.8.3 to 0.8.5 (Update Vaadin 22.0.7 #714)
• bd585c3 chore(deps): bump color-string from 1.5.3 to 1.9.0 (Update Vaadin 22.0.8 #722)
• 9afba26 chore(deps): bump postcss from 7.0.35 to 7.0.39 (Run mvn install -Pproduction to update package files #724)
• 614982e chore(deps): bump ua-parser-js from 0.7.22 to 0.7.31 (Update Vaadin 23.0.2 #731)
• a1218f9 chore(deps): bump follow-redirects from 1.9.0 to 1.14.8 (Upgrade node-forge to secure version #733)
• 7f9e8d4 chore(deps-dev): bump @ rollup/plugin-node-resolve from 9.0.0 to 15.0.1 (Update Vaadin 14.8.14 #815)
• e610c25 chore(deps): bump urijs from 1.19.6 to 1.19.11 (npm up jake to fix alert #759)
• 2018653 chore(deps): bump shell-quote from 1.7.2 to 1.7.3 (chore: Recreate lock files #784)
• b063a4a chore(deps-dev): bump rollup from 2.35.1 to 2.79.1 ([Snyk] Upgrade @polymer/polymer from 3.4.1 to 3.5.1 #807)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)