test: run ten packages on Vitest and set up Jest/Vitest coexistence

[cryptodev-2s]

Explanation

Every package in the monorepo runs its tests on Jest via ts-jest, which compiles the ESM sources to CommonJS just for tests. We want to be on Vitest, like metamask-module-template already is, but moving 97 packages and 848 test files in one PR is not reviewable.

So this sets up both runners side by side and moves the first ten packages. A package runs on Vitest once it has a vitest.config.mts, otherwise it keeps its jest.config.cjs. Script names are identical on both sides, so yarn test and yarn workspaces foreach run test do not care which runner a package uses. yarn.config.cjs and oxlint.config.ts both work the split out from disk, so there is no list to keep in sync by hand.

Migrated here: accounts-controller, approval-controller, base-controller, controller-utils, keyring-controller, phishing-controller, polling-controller, sample-controllers, subscription-controller, user-operation-controller. That is 2,066 tests, with each package's coverage thresholds still enforced.

Changes whose purpose is not obvious

tests/setup.ts had to be rewritten for Vitest. It deletes globalThis.fetch and then imports isomorphic-fetch to put it back, which only works because ts-jest emits the require in source order. Under real ESM the import evaluates first, so you end up with no fetch at all and every nock test fails. tests/vitest/setup.ts assigns the node-fetch globals directly instead.

Test helpers shared between packages cannot cross the runner boundary. A Jest package importing a Vitest package's helper fails at require time, and the reverse fails on @jest/globals. Both cases already existed (assets-controllers reaching into accounts-controller, sample-controllers into network-controller), so the shared helpers are now split to keep the common parts free of runner imports. Worth knowing for later batches: a package cannot always be migrated independently of its consumers.

Custom matcher types moved to types/vitest.d.ts, which needs its export {}. In a global script TypeScript reads declare module 'vitest' as declaring the module rather than augmenting it, which silently drops every other export including vi.

Three coverage thresholds moved by about 1.5 points (controller-utils, keyring-controller, user-operation-controller) because istanbul on esbuild output counts statements a little differently from babel on ts-jest output. Nothing was loosened beyond that measurement difference.

Smaller ones: toThrow now compares thrown values strictly, which showed approval-controller was never actually asserting the error codes it looked like it was; root test:packages skips coverage through a COLLECT_COVERAGE env var that both shared configs read, rather than the Jest CLI flags it used to forward to every package; .gitignore covers tests/**/*.d.ts, which tsc --build emits beside the shared helpers.

Why the dependency versions

Vitest 5, not the 4 that metamask-module-template pins. Starting a migration this size on a superseded major seemed worse than briefly leading the template, but it does mean the template wants a follow up bump. vite is a direct devDependency because the shared config imports its Plugin type, and jsdom because controller-utils needs that environment.

Verification

yarn lint, yarn constraints, yarn changelog:validate and yarn test:scripts pass. Beyond the ten migrated packages, I ran the 19 Jest packages that consume the shared helpers or custom matchers, plus wallet and react-data-query, since those are what the shared changes could break.

yarn lint:tsc is not green on main (1619 errors, and it is excluded from yarn lint). This branch sits at 1621: it fixes 3 and adds 2 of the same kind main already reports 8 times.

network-controller is deliberately left out. 17 of its 4,181 tests fail under Vitest on timing and event ordering, which is real work rather than a codemod gap, and belongs with the other timer heavy packages in its own PR.

References

• Follows the Vitest setup in metamask-module-template
• Follow up needed: bump metamask-module-template to Vitest 5 so the two stop drifting
• Follow up needed: network-controller, transaction-controller, transaction-pay-controller, assets-controllers and bridge-status-controller, whose tests lean heavily on timers

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
  • Not applicable. Switching test runner is not visible to consumers and nothing in dist/ changes, so this PR carries the no-changelog label.
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them
  • No breaking changes.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​metamask/​oxlint-config-vitest@​0.1.1
	@​vitest/​coverage-istanbul@​5.0.2
	vitest@​5.0.2
	vite@​8.3.1
	jsdom@​27.4.0

View full report

[socket-security]

Caution

MetaMask internal reviewing guidelines:

• Do not ignore-all
• Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
• Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
  @SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert  (click "▶" to expand/collapse)
Block		System shell access: npm tinyexec in module node:child_process Module: node:child_process Location: Package overview From: package.json → npm/vitest@5.0.2 → npm/tinyexec@1.3.1 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/tinyexec@1.3.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Network access: npm vitest in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: packages/controller-utils/package.json → npm/vitest@5.0.2 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/vitest@5.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm css-tree is 78.0% likely to have a medium risk anomaly Notes: The code is a standard, well-scoped parser fragment for a DSL-like FeatureFunction construct. It uses dynamic feature dispatch with proper balance checks and safe fallbacks, and emits a consistent AST node. No malicious behavior detected; the main risks relate to misconfiguration of the features map rather than code-level exploits. Confidence: 0.78 Severity: 0.58 From: packages/controller-utils/package.json → npm/jsdom@27.4.0 → npm/css-tree@3.2.1 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/css-tree@3.2.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm es-module-lexer is 74.0% likely to have a medium risk anomaly Notes: A WebAssembly-backed parser wrapper (package/dist/lexer.js) executes substrings extracted from untrusted input using (0, eval) during parsing, enabling arbitrary JavaScript execution if attacker-controlled data reaches the eval path. The threat also includes potential sensitive data leakage through error messages. Disable parse() on untrusted input or sandbox/replace builds to mitigate this risk. Confidence: 0.74 Severity: 0.78 From: package.json → npm/@easyops-cn/docusaurus-search-local@0.55.1 → npm/@docusaurus/core@3.10.2 → npm/@docusaurus/theme-common@3.10.2 → npm/@docusaurus/types@3.10.2 → npm/@docusaurus/plugin-content-docs@3.10.2 → npm/@docusaurus/preset-classic@3.10.2 → npm/vitest@5.0.2 → npm/raw-loader@4.0.2 → npm/es-module-lexer@2.3.2 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/es-module-lexer@2.3.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm es-module-lexer is 70.0% likely to have a medium risk anomaly Notes: A WASM-backed parser wrapper copies caller input into WASM memory and conditionally executes eval() on substrings that resemble quoted literals, creating a potential code-execution risk in the calling process. Error messages may include slices of input, increasing the chance of sensitive data exposure; the embedded WASM payload is opaque and could contain additional, unseen behaviors. Confidence: 0.70 Severity: 0.70 From: package.json → npm/@easyops-cn/docusaurus-search-local@0.55.1 → npm/@docusaurus/core@3.10.2 → npm/@docusaurus/theme-common@3.10.2 → npm/@docusaurus/types@3.10.2 → npm/@docusaurus/plugin-content-docs@3.10.2 → npm/@docusaurus/preset-classic@3.10.2 → npm/vitest@5.0.2 → npm/raw-loader@4.0.2 → npm/es-module-lexer@2.3.2 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/es-module-lexer@2.3.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm jsdom is 90.0% likely to have a medium risk anomaly Notes: This file implements a Window-like global for a DOM environment (jsdom-style). It is not malicious by intent: there are no hardcoded credentials, exfiltration paths, backdoors, or process-spawning operations present. However, it deliberately includes an ability to execute arbitrary script strings inside a vm context when the createWindow option runScripts is set to 'dangerously' (or 'outside-only' for some vm usage). That feature is a significant security hazard if untrusted data can reach timer handlers or other script sources. Consumers must ensure runScripts is not enabled for untrusted inputs or otherwise sanitize/avoid passing string handlers. Overall: functional DOM environment code with a notable, explicit code-execution risk when configured to allow it. Confidence: 0.90 Severity: 0.60 From: packages/controller-utils/package.json → npm/jsdom@27.4.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/jsdom@27.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm obug reads DEBUG Env Vars: DEBUG Location: Package overview From: package.json → npm/vitest@5.0.2 → npm/@vitest/coverage-istanbul@5.0.2 → npm/obug@2.2.1 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/obug@2.2.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm obug Location: Package overview From: package.json → npm/vitest@5.0.2 → npm/@vitest/coverage-istanbul@5.0.2 → npm/obug@2.2.1 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/obug@2.2.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm rolldown is 72.0% likely to have a medium risk anomaly Notes: This module is a legitimate-looking HMR client but contains a high-impact execution mechanism: it dynamically imports modules from server-provided data.path and injects/executess module scripts from server-provided data.url, both driven by untrusted WebSocket JSON messages. If the WebSocket server/transport is compromised (notably if ws:// is used without TLS), an attacker could potentially trigger remote code execution in the client. No overt stealth/persistence/credential theft behavior is present in the snippet, but the trust boundary and dynamic code loading make the security risk significant for any non-fully-trusted development setup. Confidence: 0.72 Severity: 0.66 From: package.json → npm/vite@8.3.1 → npm/rolldown@1.2.11 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rolldown@1.2.11. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm rolldown reads NAPI_RS_NATIVE_LIBRARY_PATH Env Vars: NAPI_RS_NATIVE_LIBRARY_PATH Location: Package overview From: package.json → npm/vite@8.3.1 → npm/rolldown@1.2.11 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rolldown@1.2.11. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm rolldown Env Vars: NAPI_RS_ENFORCE_VERSION_CHECK Location: Package overview From: package.json → npm/vite@8.3.1 → npm/rolldown@1.2.11 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rolldown@1.2.11. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm rolldown reads NAPI_RS_WASI_FLAVOR Env Vars: NAPI_RS_WASI_FLAVOR Location: Package overview From: package.json → npm/vite@8.3.1 → npm/rolldown@1.2.11 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rolldown@1.2.11. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm rolldown reads NAPI_RS_FORCE_WASI Env Vars: NAPI_RS_FORCE_WASI Location: Package overview From: package.json → npm/vite@8.3.1 → npm/rolldown@1.2.11 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rolldown@1.2.11. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm rolldown Location: Package overview From: package.json → npm/vite@8.3.1 → npm/rolldown@1.2.11 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rolldown@1.2.11. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm rolldown reads NODE_ENV Env Vars: NODE_ENV Location: Package overview From: package.json → npm/vite@8.3.1 → npm/rolldown@1.2.11 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rolldown@1.2.11. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm rolldown reads CONSOLA_LEVEL Env Vars: CONSOLA_LEVEL Location: Package overview From: package.json → npm/vite@8.3.1 → npm/rolldown@1.2.11 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rolldown@1.2.11. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm rolldown reads ROLLDOWN_TEST Env Vars: ROLLDOWN_TEST Location: Package overview From: package.json → npm/vite@8.3.1 → npm/rolldown@1.2.11 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rolldown@1.2.11. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm tinyexec Location: Package overview From: package.json → npm/vitest@5.0.2 → npm/tinyexec@1.3.1 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/tinyexec@1.3.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report