Remove hardhat and replace with vitest

[jeffsmale90]

📝 Description

Removes hardhat and related dependencies. Adds vitest as test runner for packages/delegation-toolkit.

Previously packages/delegation-toolkit tests were run with hardhat.

Coverage report is now shown when yarn:test is executed.

🚀 Why?

Test runners are inconsistent throughout the monorepo - vitest, hardhat. Additionally anvil and hardhat-network are used in different packages for network simulation.

Hardhat introduces a complex dependency graph, including some critical dependencies. Removing this, and depending on vitest for these unit tests brings consistency, and reduces dependency management.

Additionally this simplifies our unit-testing, forcing us to isolate the component under test, while we can continue to do integration testing with our e2e test suite.

Resolves the following vulnerabilities:

• https://github.com/MetaMask/delegation-toolkit/security/dependabot/15
• https://github.com/MetaMask/delegation-toolkit/security/dependabot/4
• https://github.com/MetaMask/delegation-toolkit/security/dependabot/25
• https://github.com/MetaMask/delegation-toolkit/security/dependabot/24
• https://github.com/MetaMask/delegation-toolkit/security/dependabot/20
• https://github.com/MetaMask/delegation-toolkit/security/dependabot/18
• https://github.com/MetaMask/delegation-toolkit/security/dependabot/17
• https://github.com/MetaMask/delegation-toolkit/security/dependabot/16
• https://github.com/MetaMask/delegation-toolkit/security/dependabot/14
• https://github.com/MetaMask/delegation-toolkit/security/dependabot/9
• https://github.com/MetaMask/delegation-toolkit/security/dependabot/19
• https://github.com/MetaMask/delegation-toolkit/security/dependabot/6
• https://github.com/MetaMask/delegation-toolkit/security/dependabot/10

🧪 How to Test?

This should bring no breaking changes, but improves the developer experience when running unit tests in /packages/delegation-toolkit.

Because this impacts how @metamask/delegation-core and @metamask/delegation-toolkit are bundled, it's important to test both esm and commonjs consumers for both packages.

I have validated this with commonjs with nodejs directly:

require("@metamask/delegation-core");
require("@metamask/delegation-core/actions");
require("@metamask/delegation-core/experimental");
require("@metamask/delegation-core/contracts");

ensuring that each is correctly resolved.

I have validated with esm with the following:

import * as dtk from "@metamask/delegation-toolkit";
import * as contracts from "@metamask/delegation-toolkit/contracts";
import * as experimental from "@metamask/delegation-toolkit/experimental";
import * as actions from "@metamask/delegation-toolkit/actions";
console.log({
  dtk: Object.keys(dtk),
  contracts: Object.keys(contracts),
  experimental: Object.keys(experimental),
  actions: Object.keys(actions),
});

⚠️ Breaking Changes

List any breaking changes:

• No breaking changes
• Breaking changes (describe below):

📋 Checklist

Check off completed items:

• Code follows the project's coding standards
• Self-review completed
• Documentation updated (if needed)
• Tests added/updated
• Changelog updated (if needed)
• All CI checks pass

🔗 Related Issues

Link to related issues:
Closes #
Related to #

📚 Additional Notes

Any additional information, concerns, or context:

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​vitest/​coverage-v8@​3.2.4
	undici-types@​6.19.8
	vitest@​2.1.9 ⏵ 3.2.4
	@​types/​node@​18.15.13 ⏵ 22.7.5

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

• [email protected]

View full report

[jeffsmale90]

@SocketSecurity ignore npm/[email protected]

[hanzel98]

Do we need this file with a reference to hardhat?

https://github.com/MetaMask/delegation-toolkit/blob/chore/remove-hardhat/packages/delegation-toolkit/artifacts/artifacts.d.ts

[hanzel98]

I wonder if these hardcoded addresses could give us false positives in the future, meaning that they seem to work but maybe only for an old version