feat(test): upgrade to Vitest v5 with migration support

[fengmk2]

Upgrade vp test and the vite-plus/test* API to Vitest 5.0.0. Update the package graph and config integration. Preserve supported compatibility aliases. Require Node.js ^22.18.0 || ^24.11.0 || >=26.0.0.

Add a Vitest v5 pass to vp migrate. Preserve v4 behavior where compatible options exist. Apply safe source changes. Report changes that need manual review. Add runtime guards, regression fixtures, and a migration guide.

Keep this PR as a draft until we resolve these upstream issues:

• Preview locator clicks fail with real timers.
• Browser globals retain JSON-encoded define values.
• Node and browser matcher declarations conflict with @testing-library/jest-dom.

See rfcs/vitest-v5-upgrade.md for the design and release requirements. This work supports #2405.

[netlify]

✅ Deploy Preview for viteplus-preview ready!

Name	Link
🔨 Latest commit	88d0647
🔍 Latest deploy log	https://app.netlify.com/projects/viteplus-preview/deploys/6a9ed69fc7071d000884db81
😎 Deploy Preview	https://deploy-preview-2551--viteplus-preview.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[cloudflare-workers-and-pages]

🚀 Deploying Preview to Cloudflare 🚀

Preview URL: https://rfc-vitest-v5-upgrade-viteplus-dev.voidzero-docs.workers.dev (commit 88d0647)

This URL reflects your latest Preview deployment

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://85e9d21c-viteplus-dev.voidzero-docs.workers.dev	88d0647	2026-09-07T15:23:45.847Z	Visit the dashboard ↗
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://862ed814-viteplus-dev.voidzero-docs.workers.dev	a60f750	2026-09-06T16:05:48.929Z	Visit the dashboard ↗
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://4f5dde6e-viteplus-dev.voidzero-docs.workers.dev	0cc40f3	2026-09-06T15:47:56.670Z	Visit the dashboard ↗
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://de831f5a-viteplus-dev.voidzero-docs.workers.dev	5787285	2026-09-06T15:34:33.759Z	Visit the dashboard ↗
Build: Failed ❌ View logs ↗		2d55279	2026-09-04T16:42:33.879Z	View logs ↗
Build: Failed ❌ View logs ↗		8186f1e	2026-09-04T02:00:42.355Z	View logs ↗
Build: Failed ❌ View logs ↗		9b2b1ea	2026-09-03T13:35:15.624Z	View logs ↗

[github-actions]

✅ Staging deployment successful!

Preview: https://viteplus-staging.void.app/
Commit: 88d0647

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​tinyspy@​2.2.0
	npm/​@​vitest/​spy@​3.2.7 ⏵ 5.0.0			+3	+1
	npm/​@​vitest/​pretty-format@​5.0.0
	npm/​@​vitest/​utils@​3.2.7 ⏵ 5.0.0			+3	+1
	npm/​@​vitest/​mocker@​3.2.7 ⏵ 5.0.0			+1	+1
	npm/​@​vitest/​browser@​5.0.0
	npm/​@​vitest/​coverage-istanbul@​5.0.0
	npm/​@​vitest/​coverage-v8@​5.0.0
	npm/​vitest@​3.2.7 ⏵ 5.0.0	+1		+1	+1
	npm/​kill-port@​1.6.1
	npm/​rimraf@​6.1.3
	npm/​@​vitest/​browser-preview@​5.0.0
	npm/​@​vitest/​browser-playwright@​5.0.0
	npm/​birpc@​0.2.19
	npm/​@​vitest/​browser-webdriverio@​4.1.11 ⏵ 5.0.0-rc.1	+2		+4	+1
	npm/​temporal-polyfill@​1.0.4
	npm/​@​testing-library/​jest-dom@​6.9.1
	npm/​@​vitest/​snapshot@​3.2.7 ⏵ 5.0.0			+1	+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm data-urls is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/test_v5_optional_packages/package.json → npm/jsdom@27.2.0 → npm/data-urls@6.0.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/data-urls@6.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report