test: run controller-utils on Vitest

[cryptodev-2s]

Explanation

Moves @metamask/controller-utils to Vitest.

References

• Stacked on test: add Vitest alongside Jest #10546, which explains the shared setup

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
  • Not applicable, test only change. Carries the no-changelog label.
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them
  • None.

---

Note

Low Risk
Test-only and tooling changes; production library code is unchanged aside from lockfile transitive deps for jsdom.

Overview
Migrates @metamask/controller-utils from Jest to Vitest, following the monorepo’s shared vitest.config.packages.js pattern.

Test scripts and devDependencies now use Vitest and jsdom instead of Jest, jest-environment-jsdom, ts-jest, and the custom Jest jsdom environment (including TextEncoder shims). A new vitest.config.js sets the jsdom environment and coverage thresholds aligned with the old Jest setup.

Unit tests import describe / expect / it (and vi for mocks and fake timers) from Vitest; create-service-policy.test.ts is the bulk of the mechanical jest → vi rewrites. tsconfig.json drops Jest types, test-runner-package-map.cjs no longer lists this package under Jest, and oxlint-suppressions.json is updated for removed Jest config paths and new Vitest lint suppressions.

^{Reviewed by Cursor Bugbot for commit 4101c8a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	jsdom@​27.4.0

View full report

[socket-security]

Warning

MetaMask internal reviewing guidelines:

• Do not ignore-all
• Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
• Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
  @SocketSecurity ignore npm/PACKAGE@VERSION

Priority	Alert  (click "▶" to expand/collapse)	Action
	Potential code anomaly (AI signal): npm ws is 75.0% likely to have a medium risk anomaly Notes: The code implements a standard EventTarget-like mixin for wrapping event listeners and dispatching events to user callbacks. There are no suspicious patterns such as dynamic code execution, hardcoded secrets, or network activity. The risk is contingent on what the consumer does inside their handlers; the snippet itself does not introduce malware or data leakage mechanisms beyond normal event dispatch. Overall security risk is low in isolation. Confidence: 0.75 Severity: 0.50 From: package.json → npm/jsdom@27.4.0 → npm/@docusaurus/core@3.10.2 → npm/@docusaurus/preset-classic@3.10.2 → npm/jest-environment-jsdom@30.5.2 → npm/vitest@5.0.3 → npm/web3@4.16.0 → npm/ws@8.22.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ws@8.22.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential code anomaly (AI signal): npm css-tree is 78.0% likely to have a medium risk anomaly Notes: The code is a standard, well-scoped parser fragment for a DSL-like FeatureFunction construct. It uses dynamic feature dispatch with proper balance checks and safe fallbacks, and emits a consistent AST node. No malicious behavior detected; the main risks relate to misconfiguration of the features map rather than code-level exploits. Confidence: 0.78 Severity: 0.58 From: packages/controller-utils/package.json → npm/jsdom@27.4.0 → npm/css-tree@3.2.1 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/css-tree@3.2.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential code anomaly (AI signal): npm jsdom is 90.0% likely to have a medium risk anomaly Notes: This file implements a Window-like global for a DOM environment (jsdom-style). It is not malicious by intent: there are no hardcoded credentials, exfiltration paths, backdoors, or process-spawning operations present. However, it deliberately includes an ability to execute arbitrary script strings inside a vm context when the createWindow option runScripts is set to 'dangerously' (or 'outside-only' for some vm usage). That feature is a significant security hazard if untrusted data can reach timer handlers or other script sources. Consumers must ensure runScripts is not enabled for untrusted inputs or otherwise sanitize/avoid passing string handlers. Overall: functional DOM environment code with a notable, explicit code-execution risk when configured to allow it. Confidence: 0.90 Severity: 0.60 From: packages/controller-utils/package.json → npm/jsdom@27.4.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/jsdom@27.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 424497f. Configure here.}

[mcmire]

LGTM.