Tests on vitest instead of jest: pnpm audit is clean

[williamstein]

Why

CI runs pnpm audit --audit-level high, and it fails on main, so every PR fails, including #21. All five advisories come in through jest and ts-jest; none is in patchflow's own dependencies.

Package	Severity	Path	Fixed release?
braces 3.0.3 (GHSA-vfj7-8cjw-p6xm)	high	jest → micromatch	none on npm
handlebars 4.7.9	critical, moderate	ts-jest	4.7.10
sprintf-js 1.0.3	moderate	jest → istanbul → argparse	none on npm

There is no fixed braces release, so overrides alone can't fix it. A pnpm patch would, as in cocalc-ai #962, but version-only audits still flag patched versions, and ignoring advisories would hide them.

What

The tests run on vitest 5 instead of jest. Vitest has jest's API and brings none of these packages. Afterwards pnpm audit reports no known vulnerabilities at any level, with no overrides, patches or ignored advisories.

• vitest.config.ts replaces jest.config.cjs:
  • describe/it/expect as globals, as the tests are written;
  • one file at a time, as --runInBand did.
• jest.spyOn becomes vi.spyOn, the only jest-specific call.
• tsconfig types and the oxlint env change from jest to vitest.
• snapshot-join's synchronous fuzz takes about 16 s, so it gets an explicit 120_000 timeout. Jest never timed synchronous tests; vitest does. mixed-version's fuzz already has one.

Checks

• pnpm audit (all levels): no known vulnerabilities.
• pnpm check:
  • 157 tests pass; the MIXED_FUZZ suite is skipped, as before;
  • oxlint and tsc are clean;
  • the build works.
• vitest 5 supports CI's Node 24.

After this merges, #21 needs to be rebased on main to pick it up.

[williamstein]

Automated technical review of exact head d5be4619fed81a7b84a28bf25c09045cf073512c: no findings.

I checked the Jest/Vitest configuration and test-call changes, the dependency/lockfile delta, and CI's Node 24 environment. fileParallelism: false preserves the important one-test-file-at-a-time property; the one API-specific change (jest.spyOn to vi.spyOn) and the explicit synchronous-fuzz timeout are appropriate.

Independent validation:

• pnpm install --frozen-lockfile
• pnpm audit — no known vulnerabilities at any severity
• pnpm check — 157 passed, 1 skipped; oxlint clean; types/ESM/CJS builds clean

This is ready to merge before rebasing #21.