What is the Neural Link?

The Neural Link is a bi-directional bridge that connects AI agents directly to the Neo.mjs runtime. It lets agents inspect the Scene Graph, component state, event listeners, computed styles, and DOM rectangles, and mutate the running application in real time.

Why is Neo.mjs called an Application Engine instead of a framework?

Neo.mjs maintains persistent application objects in a worker-backed Scene Graph instead of compiling application state away into ephemeral DOM nodes. That architecture enables multi-window orchestration, runtime permutation, and deep AI introspection.

What is Context Engineering?

Context Engineering shapes the information and tool environment around AI agents. Neo.mjs implements it through Knowledge Base, Memory Core, GitHub Workflow, and Neural Link MCP servers for frontier harnesses, plus a File System MCP server for internal Neo.ai.Agent local loops.

What is the Neo.mjs Agent OS?

The Neo.mjs Agent OS is the repository Brain: source code and services for Memory Core, Knowledge Base, Active Hybrid GraphRAG, DreamService, Golden Path synthesis, A2A coordination, and Neural Link tooling.

Neo.mjs - Self-Evolving Software Organism

Frontmatter

title	build(deps-dev): bump the npm_and_yarn group across 1 directory with 6 updates
author	dependabot
state	Merged
createdAt	Jul 21, 2026, 11:10 PM
updatedAt	Jul 21, 2026, 11:45 PM
closedAt	Jul 21, 2026, 11:45 PM
mergedAt	Jul 21, 2026, 11:45 PM
branches	`dev` ← `dependabot/npm_and_yarn/npm_and_yarn-79a7c4eef5`
url	https://github.com/neomjs/neo/pull/15663
contentTrust
projected
quarantined	244
signals	[]

Merged

dependabot commented on Jul 21, 2026, 11:10 PM

Bumps the npm_and_yarn group with 6 updates in the / directory:

Package	From	To
dompurify [QUARANTINED_URL: github.com]	`3.4.11`	`3.4.12`
fast-uri [QUARANTINED_URL: github.com]	`3.1.2`	`3.1.4`
hono [QUARANTINED_URL: github.com]	`4.12.26`	`4.12.31`
immutable [QUARANTINED_URL: github.com]	`5.1.5`	`5.1.9`
linkify-it [QUARANTINED_URL: github.com]	`5.0.1`	`5.0.2`
svgo [QUARANTINED_URL: github.com]	`4.0.1`	`4.0.2`

Updates dompurify from 3.4.11 to 3.4.12

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.12

Fixed an issue where a hook would not get called for custom elements, thanks @Rikuxx0

Hardened the handling of hooks removing elements, @mkrause-bee360

Added support for a few new SVG attributes, thanks @cbn-falias & @Develop-KIM

Hardened the handling of declarative partial updates

Updated the documentation is several spots, README, wiki, etc.

Bumped several dependencies where possible

Commits

a9ca1e5 release: 3.4.12 (#1537)
See full diff in compare view

Updates fast-uri from 3.1.2 to 3.1.4

Release notes

Sourced from fast-uri's releases.

v3.1.4

⚠️ Security Release

Fix for [QUARANTINED_URL: github.com]

Full Changelog: [QUARANTINED_URL: github.com]

v3.1.3

⚠️ Security Release

Fixes: [QUARANTINED_URL: github.com]

Full Changelog: [QUARANTINED_URL: github.com]

Commits

6aeece6 Bumped v3.1.4
2d50fba fix: reject literal backslash in URI authority
0549fe3 Bumped v3.1.3
2a6d357 Merge commit from fork
See full diff in compare view

Updates hono from 4.12.26 to 4.12.31

Release notes

Sourced from hono's releases.

v4.12.31

What's Changed

test(context): assert case-insensitive header names in response helpers by @yusukebe in honojs/hono#5116

chore(benchmark): add app.fetch() overhead benchmark by @yusukebe in honojs/hono#5117

refactor(aws-lambada): remove FIXME in @ts-expect-error by @yusukebe in honojs/hono#5130

fix(utils/body): reuse cached formData in parseBody() by @yusukebe in honojs/hono#5131

fix(request): fix multipart boundary mismatch in cloneRawRequest by @yusukebe in honojs/hono#5133

fix(sse): emit retry feild when retry is 0 by @yusukebe in honojs/hono#5135

test(validator): fix misspelled identifier in transform type test by @yusukebe in honojs/hono#5136

Full Changelog: [QUARANTINED_URL: github.com]

v4.12.30

What's Changed

chore(benchmark/routers): bump deps in honojs/hono#5107

chore(benchmark): remove not used benchmarks in honojs/hono#5108

chore: update to ts6 in prep for ts7 in honojs/hono#5104

fix(cache): deduplicate Cache-Control directives case-insensitively in honojs/hono#5025

fix(compress): do not compress 206 Partial Content responses in honojs/hono#5020

fix(client): replaceUrlParam should not match a param that prefixes another in honojs/hono#5096

fix(method-override): set duplex when forwarding a stream body in query mode in honojs/hono#5110

Full Changelog: [QUARANTINED_URL: github.com]

v4.12.29

What's Changed

fix(client): merge function headers with per-request headers by @yusukebe in honojs/hono#5092

chore: fix no-op tsc in test script by @yusukebe in honojs/hono#5093

fix(lambda-edge): resolve the handler with the value passed to the callback by @yusukebe in honojs/hono#5094

docs(language): add JSDoc @example to languageDetector by @codebybilal18 in honojs/hono#5081

test(workerd): add compatibilityDate by @yusukebe in honojs/hono#5100

fix(lambda-edge): base64 encode content-encoded response bodies by @yusukebe in honojs/hono#5099

fix(aws-lambda): treat any non-identity content-encoding as binary by @yusukebe in honojs/hono#5101

fix(types): strip extra properties from array types in JSONParsed by @Arman-Luthra in honojs/hono#5103

fix(trie-router): match empty wildcard remainder after regexp param by @usualoma in honojs/hono#5102

fix(etag): treat If-None-Match: * as a match by @yusukebe in honojs/hono#5084

New Contributors

@codebybilal18 made their first contribution in honojs/hono#5081

@Arman-Luthra made their first contribution in honojs/hono#5103

Full Changelog: [QUARANTINED_URL: github.com]

v4.12.28

What's Changed

fix(serve-static): treat empty string content as found by @yusukebe in honojs/hono#5062

docs(MIGRATION): fix req.raw.headers reference (property, not method) by @EduardF1 in honojs/hono#5047

chore: don't publish *.tsbuildinfo by @yusukebe in honojs/hono#5066

fix(utils/body,validator): normalize Content-Type media type for case-insensitive matching by @yusukebe in honojs/hono#5067

fix: avoid circular dependency between body.ts and request.ts by @usualoma in honojs/hono#5071

... (truncated)

Commits

cadff88 4.12.31
64c613a test(validator): fix misspelled identifier in transform type test (#5136)
aeba9ec fix(sse): emit retry feild when retry is 0 (#5135)
d796450 fix(request): fix multipart boundary mismatch in cloneRawRequest (#5133)
80959d4 fix(utils/body): reuse cached formData in parseBody() (#5131)
21b44b6 refactor(aws-lambada): remove FIXME in @ts-expect-error (#5130)
5f73897 docs(combine): close quote in combine JSDoc example (#5126)
c285f9a chore(benchmark): add app.fetch() overhead benchmark (#5117)
fb9d7bf test(context): assert case-insensitive header names in response helpers (#5116)
b2ae3a2 4.12.30
Additional commits viewable in compare view

Updates immutable from 5.1.5 to 5.1.9

Release notes

Sourced from immutable's releases.

v5.1.9

What's Changed

fix(List): preserve undefined values when grown past 32 elements by @spokodev / @jdeniau in immutable-js/immutable-js#2235 (originated from immutable-js/immutable-js#2230 )

Full Changelog: [QUARANTINED_URL: github.com]

v5.1.8

What's Changed

fix(List): guard oversized bounds in setListBounds. Fixes CVE [QUARANTINED_URL: github.com]

perf(Map): index large hash-collision buckets for faster lookups. Fixes CVE [QUARANTINED_URL: github.com]

Full Changelog: [QUARANTINED_URL: github.com]

v5.1.7

What's Changed

fix(Repeat): lastIndexOf returned size instead of size - 1 by @chatman-media in immutable-js/immutable-js#2227

internal

Backport tests from 6.x branch by @jdeniau in immutable-js/immutable-js#2199

fix(IndexedCollection): has(index) on a lazy Seq of unknown size now checks index existence instead of searching for a value equal to the index by @jdeniau in immutable-js/immutable-js#2203

Better type for reduce if not ininitial value is given by @jdeniau in immutable-js/immutable-js#2205

Backport test from #2193 by @jdeniau in immutable-js/immutable-js#2207

backport tests from 6.x by @jdeniau in immutable-js/immutable-js#2213

Firefox link to non-French page by @jdeniau in immutable-js/immutable-js#2219

Bump esbuild and @size-limit/preset-small-lib by @dependabot[bot] in immutable-js/immutable-js#2217

backport tests from #2210 by @jdeniau in immutable-js/immutable-js#2214

Bump shell-quote from 1.8.2 to 1.8.4 by @dependabot[bot] in immutable-js/immutable-js#2211

Bump @tootallnate/once from 2.0.0 to 2.0.1 by @dependabot[bot] in immutable-js/immutable-js#2190

Bump minimatch from 9.0.5 to 9.0.9 by @dependabot[bot] in immutable-js/immutable-js#2189

Bump @codemirror/theme-one-dark from 6.1.2 to 6.1.3 by @dependabot[bot] in immutable-js/immutable-js#2168

Bump form-data from 4.0.5 to 4.0.6 by @dependabot[bot] in immutable-js/immutable-js#2220

Bump typescript-eslint from 8.33.0 to 8.61.1 by @dependabot[bot] in immutable-js/immutable-js#2222

Bump @rollup/plugin-commonjs from 28.0.2 to 29.0.3 by @dependabot[bot] in immutable-js/immutable-js#2224

New Contributors

@chatman-media made their first contribution in immutable-js/immutable-js#2227

Full Changelog: [QUARANTINED_URL: github.com]

v5.1.6

What's Changed

fix(reverseFactory): read reversedSequence.size in __iterator instead of this by @jdeniau in immutable-js/immutable-js#2196

... (truncated)

Changelog

Sourced from immutable's changelog.

5.1.9

fix(List): a List grown past 32 elements while all its values are undefined no longer reads those values back as null (affected get, iteration, toArray, equals and hashCode)

5.1.8

fix(List): guard oversized bounds in setListBounds. Fixes CVE [QUARANTINED_URL: github.com]

perf(Map): index large hash-collision buckets for faster lookups. Fixes CVE [QUARANTINED_URL: github.com]

4.3.9

fix(List): guard oversized bounds in setListBounds. Fixes CVE [QUARANTINED_URL: github.com]

perf(Map): index large hash-collision buckets for faster lookups. Fixes CVE [QUARANTINED_URL: github.com]

5.1.7

fix(Repeat): lastIndexOf returned size instead of size - 1 by @chatman-media in immutable-js/immutable-js#2227. Fixes CVE CVE-2026-29063

fix(IndexedCollection): has(index) on a lazy Seq of unknown size now checks index existence instead of searching for a value equal to the index #2203

[TypeScript]: reduce/reduceRight without an initial value now infer the result type from the collection's values when the reducer returns a value (e.g. list.reduce((a, b) => a + b) infers number), matching Array#reduce. Previously an explicit type argument was required. #2205

5.1.6

fix(reverseFactory): read reversedSequence.size in __iterator instead of this #2196

Commits

329f7a6 5.1.9
21fabd9 changelog
009164f Merge pull request #2235 from immutable-js/fix/avoid-null-when-setsize33
5b65bfb fix(List): preserve undefined values when grown past 32 elements
50bf39e Update CHANGELOG.md for versions 5.1.8 and 4.3.9
6496539 5.1.8
808a83a Merge commit from fork
e51d49f perf(Map): index large hash-collision buckets for faster lookups
25c58b0 fix typescript in tests
a1a1ee4 Merge commit from fork
Additional commits viewable in compare view

Updates linkify-it from 5.0.1 to 5.0.2

Changelog

Sourced from linkify-it's changelog.

5.0.2 / 2026-07-02

Fixed DoS in mailto: links (restrict user name to 64 chars).

Restricted user/pass part length in links.

Commits

50a0c91 5.0.2 released
de3b885 Update package hooks
13effaa Add package lock
39d748d Bump c8
00ce877 Drop tlds deps
ecde823 Update benchmark to mitata
23c62cd Refactor demo / doc build and publish
fd63f3b CI config update
f4ea5af demo: update bootstrap & layout
1454fb6 lint: dim warnings
Additional commits viewable in compare view

Updates svgo from 4.0.1 to 4.0.2

Release notes

Sourced from svgo's releases.

v4.0.2

What's Changed

Security

removeScripts, remove JavaScript URIs case-insensitively and make <script> handling namespace aware. By @SethFalco

Bug Fixes

convertColors, skip case-normalization for CSS custom properties. By @SethFalco in svg/svgo#2213

convertPathData, improve handling of consecutive t commands. By @KTibow in svg/svgo#2156

convertPathData, safer handling of paths. By @KTibow in svg/svgo#2158

Improve parsing of negative (or +) arc radii. By @KTibow in svg/svgo#2205

When converting to a data URI, only encode it as a data URI once. By @johnkenny54 in svg/svgo#2053

Performance

mergePaths, speed up child node removal. By @mozzie in svg/svgo#2216

Other Changes

removeAttributesBySelector, log warning and noop if missing parameters. By @KTibow in svg/svgo#2215

Commits

b2309cf chore: sync version with api
f529cfc Merge commit from fork
581fe68 performance: speed up mergePath child node removal (#2216)
eb4c8b6 docs(removeAttributesBySelector): properly document and check types (#2215)
6fd5872 fix(convertColors): skip convertCase on css custom properties (#2213)
7414f73 fix: properly parse negative (or +) arc radii (#2205)
a8c19aa fix: only call encodeSVGDatauri once and add test case (#2053)
65548f4 fix(convertPathData): properly handle consecutive t commands (#2156)
a41a7c1 fix(convertPathData): introducing isSafeToRemove (#2164)
38625dd test: handle charm icons (#2203)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the Security Alerts page [QUARANTINED_URL: github.com].