[Fix] Remove Neon CLI and Pin All JS Dependencies

[yuneng-berri]

Summary

Failure Path (Before Fix)

@neondatabase/api-client pulled in axios as a transitive dependency, which is vulnerable to CVE-2026-25639 (DoS via __proto__ in mergeConfig). JS dependencies across the repo used ^/~ semver ranges, allowing future npm install runs to resolve to compromised versions.

Fix

• Removed @neondatabase/api-client dev dependency and neonHelperScripts.ts
• Removed neon CLI install and branch creation steps from CircleCI config
• Removed CVE-2026-25639 from the security scan allowlist (no longer needed)
• Pinned all JS dependencies to exact versions across all 7 package.json files in the repo

Testing

• npm install confirms lockfiles are stable (no changes)
• npm run build passes for the dashboard
• npm run test passes for the dashboard
• CircleCI config validates with circleci config validate

Type

🐛 Bug Fix
🚄 Infrastructure

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
litellm	Ready	Preview, Comment	Apr 1, 2026 11:18pm

[CLAassistant]

All committers have signed the CLA.

[codspeed-hq]

Merging this PR will not alter performance

✅ 16 untouched benchmarks

---

_{Comparing litellm_remove_neon_cli (006d481) with main (7250cba)}

[greptile-apps]

Greptile Summary

This PR removes the @neondatabase/api-client dev dependency (and its vulnerable transitive chain: axios → follow-redirects → proxy-from-env) to resolve CVE-2026-25639, and simultaneously pins all JS dependencies across 7 package.json files to exact semver versions to prevent future drift into compromised versions.

Key changes:

• @neondatabase/api-client, axios, follow-redirects, and proxy-from-env fully excised from ui/litellm-dashboard/package-lock.json
• neonHelperScripts.ts deleted and the Neon CLI install / branch-creation steps removed from the CircleCI e2e_ui_testing job
• CVE-2026-25639 removed from the ci_cd/security_scans.sh allowlist — no longer needed
• All ^/~ semver ranges replaced with exact pinned versions across every package.json in the repo
• The pinned versions match previously-resolved lockfile versions (validated by npm install producing no lockfile changes), though several packages are effectively bumped (e.g. @inkeep/cxkit-docusaurus 0.5.89→0.5.107, openai 4.93→4.104, antd 5.13→5.29)
• One latent issue: the Run Docker container step in the (currently commented-out) e2e_ui_testing job still references $E2E_UI_TEST_DATABASE_URL, which is no longer set anywhere after the Neon steps were removed

Confidence Score: 5/5

• Safe to merge — the CVE remediation is correct and complete, and the only remaining finding is a latent reference in a commented-out CI job.
• All P0/P1 concerns are addressed: the vulnerable axios transitive dependency chain is fully removed from the lockfile, the CVE allowlist entry is cleaned up, and no production code is affected. The single finding (stale $E2E_UI_TEST_DATABASE_URL reference in .circleci/config.yml) is P2 — it lives in a job that is currently commented out of the workflow and poses no immediate runtime risk.
• .circleci/config.yml — the Run Docker container step still references $E2E_UI_TEST_DATABASE_URL which is no longer populated; harmless now but should be cleaned up before the e2e_ui_testing job is re-enabled.

Important Files Changed

Filename	Overview
.circleci/config.yml	Removes Neon CLI install and branch-creation steps correctly, but the Run Docker container step still references the now-unset $E2E_UI_TEST_DATABASE_URL; harmless while the job is commented out but a latent bug.
ci_cd/security_scans.sh	Correctly removes CVE-2026-25639 allowlist entry that was needed only for the now-deleted @neondatabase/api-client transitive axios dependency.
ui/litellm-dashboard/package.json	Removes @neondatabase/api-client dev dependency and pins all remaining deps to exact versions; effectively also bumps several packages (e.g. openai 4.93→4.104, antd 5.13→5.29, @tanstack/react-query 5.64→5.90) to their previously-resolved lockfile versions.
ui/litellm-dashboard/scripts/e2e_tests/neonHelperScripts.ts	File deleted — correctly removes the Neon API client helper scripts that depended on the now-removed @neondatabase/api-client.
ui/litellm-dashboard/package-lock.json	Removes @neondatabase/api-client, axios, follow-redirects, and proxy-from-env nodes entirely; all other entries are pinned to previously-resolved versions with no unexpected tree changes.
docs/my-website/package.json	Pins all deps to exact versions; @inkeep/cxkit-docusaurus jumps from ^0.5.89 to 0.5.107 and dotenv from ^16.4.5 to 16.6.1, reflecting the previously-resolved versions.
litellm-js/spend-logs/package.json	Pins deps; @hono/node-server moves from ^1.10.1 to 1.19.6 and tsx from ^4.7.1 to 4.20.6, matching the previously-resolved lockfile versions.
tests/proxy_admin_ui_tests/ui_unit_tests/package.json	Pins all dev and runtime deps to exact versions; typescript moves from the broad ^5.0.0 to 5.9.3 and antd from ^5.12.5 to 5.29.1.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["Before: e2e_ui_testing CI job"] --> B["Install Neon CLI\n(neonctl)"]
    B --> C["Create Neon branch\n(neon branches create)"]
    C --> D["Set E2E_UI_TEST_DATABASE_URL\n(neon connection-string)"]
    D --> E["docker run\n-e DATABASE_URL=\$E2E_UI_TEST_DATABASE_URL"]
    E --> F["Run Playwright tests\nagainst Neon branch DB"]

    A2["After: e2e_ui_testing CI job\n(commented out in workflow)"] --> G["docker run\n-e DATABASE_URL=\$E2E_UI_TEST_DATABASE_URL\n⚠️ variable never set"]
    G --> H["Playwright tests\n(job not triggered)"]

    subgraph "Dependency chain removed"
        I["@neondatabase/api-client"] --> J["axios (CVE-2026-25639)"]
        J --> K["follow-redirects"]
        J --> L["proxy-from-env"]
    end

    M["neonHelperScripts.ts"] --> I
    M -->|deleted| N["✅ Removed"]
    I -->|removed from package.json| N

    style G fill:#fff3cd,stroke:#ffc107
    style N fill:#d4edda,stroke:#28a745
    style I fill:#f8d7da,stroke:#dc3545
    style J fill:#f8d7da,stroke:#dc3545
    style K fill:#f8d7da,stroke:#dc3545
    style L fill:#f8d7da,stroke:#dc3545

Loading

Comments Outside Diff (1)

1. .circleci/config.yml, line 3233-3247 (link)

   Stale $E2E_UI_TEST_DATABASE_URL reference in job definition

   The Run Docker container step still passes DATABASE_URL=$E2E_UI_TEST_DATABASE_URL to the container, but the step that populated this variable (the neon connection-string command) was removed. This means the variable is now undefined, so the container would start with DATABASE_URL= (empty string) — silently ignoring the database entirely.

   The job is currently commented out of the workflow so this won't fire today, but anyone who uncomments e2e_ui_testing in the future will get a container with no database connection and likely opaque failures. The reference should be replaced with a real $DATABASE_URL environment variable injected from CircleCI context, or the job definition cleaned up to reflect the new approach to provisioning test databases.

_{Reviews (1): Last reviewed commit: "[Fix] Remove neon CLI dependency and pin..." | Re-trigger Greptile}

[ishaan-berri]

lgtm