What is the Neural Link?

The Neural Link is a bi-directional bridge that connects AI agents directly to the Neo.mjs runtime. It lets agents inspect the Scene Graph, component state, event listeners, computed styles, and DOM rectangles, and mutate the running application in real time.

Why is Neo.mjs called an Application Engine instead of a framework?

Neo.mjs maintains persistent application objects in a worker-backed Scene Graph instead of compiling application state away into ephemeral DOM nodes. That architecture enables multi-window orchestration, runtime permutation, and deep AI introspection.

What is Context Engineering?

Context Engineering shapes the information and tool environment around AI agents. Neo.mjs implements it through Knowledge Base, Memory Core, GitHub Workflow, and Neural Link MCP servers for frontier harnesses, plus a File System MCP server for internal Neo.ai.Agent local loops.

What is the Neo.mjs Agent OS?

The Neo.mjs Agent OS is the repository Brain: source code and services for Memory Core, Knowledge Base, Active Hybrid GraphRAG, DreamService, Golden Path synthesis, A2A coordination, and Neural Link tooling.

Frontmatter

title	Bump on-headers and compression
author	dependabot
state	Merged
createdAt	Jul 18, 2025, 12:41 AM
updatedAt	Jul 18, 2025, 1:34 AM
closedAt	Jul 18, 2025, 1:34 AM
mergedAt	Jul 18, 2025, 1:34 AM
branches	`dev` ← `dependabot/npm_and_yarn/multi-96c788614a`
url	https://github.com/neomjs/neo/pull/7079

1.1.0 / 2025-07-17

Merged

dependabot commented on Jul 18, 2025, 12:41 AM

Bumps on-headers and compression. These dependencies needed to be updated together. Updates on-headers from 1.0.2 to 1.1.0

Release notes

Sourced from on-headers's releases.

1.1.0

Important

Fix CVE-2025-7339 (GHSA-76c9-3jph-rj3q)

What's Changed

Migrate CI pipeline to GitHub actions by @carpasse in jshttp/on-headers#12

fix README.md badges by @carpasse in jshttp/on-headers#13

add OSSF scorecard action by @carpasse in jshttp/on-headers#14

fix: use ubuntu-latest as ci runner by @UlisesGascon in jshttp/on-headers#19

ci: apply OSSF Scorecard security best practices by @UlisesGascon in jshttp/on-headers#20

👷 add upstream change detection by @ctcpip in jshttp/on-headers#31

✨ add script to update known hashes by @ctcpip in jshttp/on-headers#32

💚 update CI - add newer node versions by @ctcpip in jshttp/on-headers#33

New Contributors

@carpasse made their first contribution in jshttp/on-headers#12

@UlisesGascon made their first contribution in jshttp/on-headers#19

@ctcpip made their first contribution in jshttp/on-headers#31

Full Changelog: https://github.com/jshttp/on-headers/compare/v1.0.2...v1.1.0

Changelog

Sourced from on-headers's changelog.

Fix CVE-2025-7339 (GHSA-76c9-3jph-rj3q)

Commits

4b017af 1.1.0
b636f2d ♻️ refactor header array code
3e2c2d4 ✨ ignore falsy header keys, matching node behavior
172eb41 ✨ support duplicate headers
c6e3849 🔒️ fix array handling
6893518 💚 update CI - add newer node versions
56a345d ✨ add script to update known hashes
175ab21 👷 add upstream change detection (#31)
ce0b2c8 ci: apply OSSF Scorecard security best practices (#20)
1a38c54 fix: use ubuntu-latest as ci runner (#19)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for on-headers since your current version.

Updates compression from 1.7.4 to 1.8.1

Release notes

Sourced from compression's releases.

v1.8.1

What's Changed

fix(docs): update multiple links from http to https by @Phillip9587 in expressjs/compression#222

ci: add dependabot for github actions by @bjohansebas in expressjs/compression#207

build(deps): bump github/codeql-action from 2.23.2 to 3.28.15 by @dependabot[bot] in expressjs/compression#228

build(deps): bump ossf/scorecard-action from 2.3.1 to 2.4.1 by @dependabot[bot] in expressjs/compression#229

build(deps-dev): bump eslint-plugin-import from 2.26.0 to 2.31.0 by @dependabot[bot] in expressjs/compression#230

build(deps-dev): bump supertest from 6.2.3 to 6.3.4 by @dependabot[bot] in expressjs/compression#231

[StepSecurity] ci: Harden GitHub Actions by @step-security-bot in expressjs/compression#235

build(deps): bump github/codeql-action from 3.28.15 to 3.29.2 by @dependabot[bot] in expressjs/compression#243

build(deps): bump actions/upload-artifact from 4.3.1 to 4.6.2 by @dependabot[bot] in expressjs/compression#239

build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by @dependabot[bot] in expressjs/compression#240

build(deps): bump actions/checkout from 4.1.1 to 4.2.2 by @dependabot[bot] in expressjs/compression#241

build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 by @dependabot[bot] in expressjs/compression#244

deps: on-headers@1.1.0 by @UlisesGascon in expressjs/compression#246

Release: 1.8.1 by @UlisesGascon in expressjs/compression#247

New Contributors

@dependabot[bot] made their first contribution in expressjs/compression#228

@step-security-bot made their first contribution in expressjs/compression#235

Full Changelog: https://github.com/expressjs/compression/compare/1.8.0...v1.8.1

v1.8.0

What's Changed

Refactor chunkLength function for improved readability and consistency by @Ayoub-Mabrouk in expressjs/compression#203

Refactor toBuffer function to simplify buffer check logic by @Ayoub-Mabrouk in expressjs/compression#201

ci: add CodeQL (SAST) by @bjohansebas in expressjs/compression#204

Use headersSent instead of _header by @maritz in expressjs/compression#129

Bugfix/use write head instead of implicit header by @Icehunter in expressjs/compression#170

feat: add default option by @bjohansebas in expressjs/compression#191

ci: update ci workflow by @bjohansebas in expressjs/compression#206

feat: support for brotli by @bjohansebas in expressjs/compression#194

docs: improve readme by @bjohansebas in expressjs/compression#209

docs: keywords field by @bjohansebas in expressjs/compression#210

refactor: simplify encoding negotiation logic by @bjohansebas in expressjs/compression#213

New Contributors

@Ayoub-Mabrouk made their first contribution in expressjs/compression#203

@maritz made their first contribution in expressjs/compression#129

@Icehunter made their first contribution in expressjs/compression#170

Full Changelog: https://github.com/expressjs/compression/compare/1.7.5...v1.8.0

1.7.5

What's Changed

chore: add support for OSSF scorecard reporting by @inigomarquinez in expressjs/compression#186

ci: fix errors in ci github action for node 8 and 9 by @inigomarquinez in expressjs/compression#187

docs: fix spelling by @dijonkitchen in expressjs/compression#174

deps: bytes@3.1.2 by @bjohansebas in expressjs/compression#192

... (truncated)

Changelog

Sourced from compression's changelog.

1.8.1 / 2025-07-17

deps: on-headers@~1.1.0

Fix CVE-2025-7339 (GHSA-76c9-3jph-rj3q)

1.8.0 / 2025-02-10

Use res.headersSent when available

Replace _implicitHeader with writeHead property

add brotli support for versions of node that support it

Add the enforceEncoding option for requests without Accept-Encoding header

1.7.5 / 2024-10-31

deps: Replace accepts with negotiator@~0.6.4

Add preference option

deps: bytes@3.1.2

Add petabyte (pb) support

Fix "thousandsSeparator" incorrecting formatting fractional part

Fix return value for un-parsable strings

deps: compressible@~2.0.18

Mark font/ttf as compressible

Remove compressible from multipart/mixed

deps: mime-db@'>= 1.43.0 < 2'

deps: safe-buffer@5.2.1

Commits

83a0c45 1.8.1
ce62713 deps: on-headers@1.1.0 (#246)
f4acb23 build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 (#244)
6eaebe6 build(deps): bump actions/checkout from 4.1.1 to 4.2.2 (#241)
37e0623 build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 (#240)
bc436b2 build(deps): bump actions/upload-artifact from 4.3.1 to 4.6.2 (#239)
2f9f572 build(deps): bump github/codeql-action from 3.28.15 to 3.29.2 (#243)
5f13b14 [StepSecurity] ci: Harden GitHub Actions (#235)
76e0945 build(deps-dev): bump supertest from 6.2.3 to 6.3.4 (#231)
ae6ee80 build(deps-dev): bump eslint-plugin-import from 2.26.0 to 2.31.0 (#230)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for compression since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the Security Alerts page.