What is the Neural Link?

The Neural Link is a bi-directional bridge that connects AI agents directly to the Neo.mjs runtime. It lets agents inspect the Scene Graph, component state, event listeners, computed styles, and DOM rectangles, and mutate the running application in real time.

Why is Neo.mjs called an Application Engine instead of a framework?

Neo.mjs maintains persistent application objects in a worker-backed Scene Graph instead of compiling application state away into ephemeral DOM nodes. That architecture enables multi-window orchestration, runtime permutation, and deep AI introspection.

What is Context Engineering?

Context Engineering shapes the information and tool environment around AI agents. Neo.mjs implements it through Knowledge Base, Memory Core, GitHub Workflow, and Neural Link MCP servers for frontier harnesses, plus a File System MCP server for internal Neo.ai.Agent local loops.

What is the Neo.mjs Agent OS?

The Neo.mjs Agent OS is the repository Brain: source code and services for Memory Core, Knowledge Base, Active Hybrid GraphRAG, DreamService, Golden Path synthesis, A2A coordination, and Neural Link tooling.

Frontmatter

title	chore(deps-dev): bump hono from 4.12.18 to 4.12.23
author	dependabot
state	Merged
createdAt	Jun 4, 2026, 11:26 PM
updatedAt	Jun 5, 2026, 3:44 AM
closedAt	Jun 5, 2026, 3:43 AM
mergedAt	Jun 5, 2026, 3:43 AM
branches	`dev` ← `dependabot/npm_and_yarn/hono-4.12.23`
url	https://github.com/neomjs/neo/pull/12548

Merged

dependabot commented on Jun 4, 2026, 11:26 PM

Bumps hono from 4.12.18 to 4.12.23.

Release notes

Sourced from hono's releases.

v4.12.23

What's Changed

fix(serve-static): normalize all backslashes in file paths, not just the first in honojs/hono#4962

feat(context): export the Context class publicly by @BlankParticle in honojs/hono#4543

docs(contribution): add AI Usage Policy by @yusukebe in honojs/hono#4970

feat(compress): add contentTypeFilter option and COMPRESSIBLE_CONTENT_TYPE_REGEX re-export by @na-trium-144 in honojs/hono#4961

fix(utils/ipaddr): do not compress a single 0 group to :: by @yusukebe in honojs/hono#4971

Full Changelog: https://github.com/honojs/hono/compare/v4.12.22...v4.12.23

v4.12.22

What's Changed

chore: update vitest to v4 and cleanups by @BlankParticle in honojs/hono#4952

fix(mime): specify charset parameter per MIME type instead of mechanical detection by @renatograsso10 in honojs/hono#4912

fix(compress): respect Accept-Encoding when encoding option is set by @LeSingh1 in honojs/hono#4951

fix(deno): echo negotiated WebSocket subprotocol in upgrade response by @ATOM00blue in honojs/hono#4955

feat: add msgpack as a compressible content type by @na-trium-144 in honojs/hono#4957

New Contributors

@renatograsso10 made their first contribution in honojs/hono#4912

@LeSingh1 made their first contribution in honojs/hono#4951

@ATOM00blue made their first contribution in honojs/hono#4955

@na-trium-144 made their first contribution in honojs/hono#4957

Full Changelog: https://github.com/honojs/hono/compare/v4.12.21...v4.12.22

v4.12.21

Security fixes

This release includes fixes for the following security issues:

app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

Affects: app.mount(). Fixes prefix stripping using the raw URL pathname instead of the decoded path, where percent-encoded characters in the mount prefix or path could cause the prefix to be removed at the wrong position, resulting in the sub-application receiving an incorrect path. GHSA-2gcr-mfcq-wcc3

IP Restriction bypasses static deny rules for non-canonical IPv6

Affects: hono/ip-restriction. Fixes IP address comparison using string equality, where non-canonical IPv6 representations of a denied address — such as compressed forms or hex-notation IPv4-mapped addresses — could bypass static deny rules. GHSA-xrhx-7g5j-rcj5

Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

Affects: hono/cookie. Fixes missing validation of sameSite and priority options against injection characters (;, \r, \n), where user-controlled input passed to either option could inject additional attributes into the Set-Cookie response header. GHSA-3hrh-pfw6-9m5x

JWT middleware accepts any Authorization scheme, not only Bearer

Affects: hono/jwt, hono/jwk. Fixes missing scheme validation in the Authorization header, where any two-part header value was accepted regardless of the scheme name, allowing non-Bearer schemes to pass JWT authentication. GHSA-f577-qrjj-4474

Users who use app.mount(), hono/ip-restriction, hono/cookie, or hono/jwt/hono/jwk are encouraged to upgrade to this version.

... (truncated)

Commits

83bfb3b 4.12.23
bcd290a fix(utils/ipaddr): do not compress a single 0 group to :: (#4971)
c968177 feat(compress): add contentTypeFilter option and `COMPRESSIBLE_CONTENT_TYPE_R...
0265a54 docs(contribution): add AI Usage Policy (#4970)
c84c5d2 feat(context): export the Context class publicly (#4543)
82dad62 fix(serve-static): normalize all backslashes in file paths, not just the firs...
2f01b77 4.12.22
6bc0dff feat: add msgpack as a compressible content type (#4957)
7e0555d fix(deno): echo negotiated WebSocket subprotocol in upgrade response (#4955)
f0ed246 fix(compress): respect Accept-Encoding when encoding option is set (#4951)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the Security Alerts page.

neo-gpt APPROVED reviewed on Jun 5, 2026, 12:16 AM

PR Review Summary

Status: Approved

🪜 Strategic-Fit Decision

Per §9 Strategic-Fit Step-Back:

Decision: Approve
Rationale: Approve because this is a lockfile-only indirect dependency bump with clean CI and focused local MCP transport verification after reinstalling from the PR lockfile. No follow-up ticket is warranted for a routine dependency maintenance PR.

Thanks, Dependabot. I verified the package-lock delta and the MCP transport surface that consumes the transitive Hono dependency; this is eligible for human merge.

🧭 Patch-Blind Premise Snapshot

Inputs Read Before Patch: Open PR state and exact head 26eb666dd2430d6112ec8d541e577765aa420c33; changed-file list; package-lock.json dependency entries; current branch commit message; Hono usage search over runtime/test source; PR CI rollup.
Expected Solution Shape: A correct Dependabot bump should only update the resolved hono package metadata in package-lock.json, without touching application source or hardcoding any runtime behavior. Test isolation should cover the MCP SDK transport paths that consume Hono transitively, using the PR lockfile rather than stale local node_modules.
Patch Verdict: Matches. The diff changes only node_modules/hono version/resolved/integrity from 4.12.18 to 4.12.23, and a clean install resolved hono@4.12.23 under @modelcontextprotocol/sdk before the focused transport tests ran.

🕸️ Context & Graph Linking

Target Epic / Issue ID: None — Dependabot dependency maintenance PR without a Neo close-target.
Related Graph Nodes: Dependency maintenance; MCP transport/client surface; hono transitive dependency; @modelcontextprotocol/sdk.

🔬 Depth Floor

Challenge OR documented search (per guide §7.1):

Documented search: I actively looked for source-level Hono imports outside dependency metadata, close-target magic in the branch commit body, and stale local dependency resolution that would invalidate a local smoke test. I found no source-level Hono import in live runtime/test paths; no Closes / Resolves / Fixes close-target appears in origin/dev..HEAD; and I corrected the stale local install with npm ci before testing.

Rhetorical-Drift Audit (per guide §7.4):

N/A — routine Dependabot body and lockfile-only dependency metadata; no architectural prose, Anchor & Echo summary, or [RETROSPECTIVE] claim added by this PR.

🧠 Graph Ingestion Notes

[KB_GAP]: N/A.
[TOOLING_GAP]: N/A.
[RETROSPECTIVE]: Routine dependency bumps that affect transitive MCP transport internals should be reviewed against the consuming transport/client tests after ensuring local node_modules matches the PR lockfile.

🎯 Close-Target Audit

For every issue named as close-target, verify it does NOT carry the epic label:

Close-targets identified: none.
Branch commit message checked with git log origin/dev..HEAD --format='%h%x09%s%n%b'; no Closes / Resolves / Fixes magic close-target found.

Findings: Pass.

N/A Audits — 📑 🪜 📡 🔗

N/A across listed dimensions: lockfile-only indirect dependency maintenance does not introduce or modify a public contract ledger surface, evidence-ladder AC, MCP OpenAPI description, skill convention, or architectural primitive.

🧪 Test-Execution & Location Audit

Branch checked out locally via checkout_pull_request.
Clean dependency install run from PR lockfile: npm ci --ignore-scripts --prefer-offline --no-audit --no-fund.
Dependency resolution verified: npm ls hono @hono/node-server --depth=1 reports hono@4.12.23 under @modelcontextprotocol/sdk@1.27.1.
Focused transport/client test run: npm run test-unit -- test/playwright/unit/ai/mcp/client/McpClientTransportConfig.spec.mjs test/playwright/unit/ai/mcp/server/shared/services/TransportService.spec.mjs → 22 passed.
GitHub CI at exact head is green: lint-pr-body, CodeQL/Analyze, integration-unified, and unit all succeeded.

Findings: Tests pass.

📋 Required Actions

No required actions — eligible for human merge.

📊 Evaluation Metrics

[ARCH_ALIGNMENT]: 100 - I actively considered source-surface drift, runtime behavior hardcoding, and MCP transport contract changes and confirmed none apply; this is a pure dependency metadata update.
[CONTENT_COMPLETENESS]: 100 - I actively considered missing ticket linkage, missing contract notes, and PR-body structural failures; Dependabot PR body is appropriate for dependency maintenance and lint-pr-body passed.
[EXECUTION_QUALITY]: 100 - I actively considered stale local dependency resolution, transitive MCP transport breakage, and CI coverage gaps; clean install resolved hono@4.12.23, focused transport/client tests passed 22/22, and CI is green.
[PRODUCTIVITY]: 100 - Achieves the maintenance goal exactly: updates the indirect hono dependency from 4.12.18 to 4.12.23 without collateral changes.
[IMPACT]: 40 - Routine dependency maintenance, but non-trivial because the included upstream range contains security fixes and Hono is in the MCP SDK transport dependency chain.
[COMPLEXITY]: 10 - Very low: one lockfile entry changed and no source, test, config, or docs files were modified.
[EFFORT_PROFILE]: Quick Win - Low-complexity maintenance with useful security/transport hygiene value.

Eligible for human merge; agent reviewers still do not execute gh pr merge.