---
tagName: 11.6.1
name: Neo.mjs v11.6.1 Release Notes
publishedAt: '2025-11-19T17:38:22Z'
isPrerelease: false
isDraft: false
---
# Neo.mjs v11.6.1 Release Notes

This patch release focuses on critical stability improvements, regression fixes, and architectural enhancements to the MCP server infrastructure.

## ✨ Highlights

### 🛡️ Security & Stability

-   **Race Condition Fix**: Resolved a race condition where the App Worker could attempt to use Main Thread remote methods (like `Stylesheet`) before they were fully registered. `Neo.Main` now deterministic awaits the initialization of all addons before signaling readiness to the Worker Manager. (Issue #7815)
-   **XSS Mitigation**: Refactored `labelText` and `valueLabel` in `CheckBox` and `TextField` to strictly separate text content from VDOM structures. The unsafe use of `.html` (innerHTML) has been removed in favor of a secure VDOM-based approach. (Issue #7812, #7813)

### 🐛 Regression Fixes

-   **Layout Bindings**: Restored the ability to use data bindings on layout configurations (e.g., `bind: {activeIndex: ...}`) by replacing the deprecated `parseConfig` method with the new `createBindings` API in `src/layout/Base.mjs`. (Issue #7814)
-   **Value Label Rendering**: Fixed a regression in `Neo.filter.BooleanContainer` where icons were rendering as escaped strings instead of HTML elements. The `valueLabel` config now supports VDOM objects and arrays for rich content. (Issue #7812)

### 🤖 MCP Server Updates

-   **API Compliance**: Updated all MCP servers (GitHub Workflow, Memory Core, Knowledge Base) to use the new `McpServer` class from the SDK, resolving deprecation warnings. (Issue #7808)
-   **Dynamic Versioning**: Servers now dynamically pull their version from `package.json` instead of using a hardcoded value. (Issue #7809)
-   **Configurable Models**: The Gemini model name in `SessionService` is now configurable via `config.mjs`. (Issue #7811)
-   **Data Path Clarity**: Renamed ChromaDB data directories to `chroma-neo-knowledge-base` and `chroma-neo-memory-core` for better clarity and consistency. (Issue #7810)

### 🛠️ Build Tooling

-   **Webpack Warnings**: Suppressed a "Critical dependency" warning in `HighlightJs.mjs` by explicitly ignoring the dynamic import of the runtime library. (Issue #7816)

## 📦 Full Changelog

-   **Refactor: Rename Server to McpServer in MCP implementations** (Issue #7808)
-   **Refactor: Use npm package version in MCP servers** (Issue #7809)
-   **Refactor: Rename ChromaDB data directories for clarity** (Issue #7810)
-   **Refactor: Move hardcoded Gemini model name to config in SessionService** (Issue #7811)
-   **Fix regression: Enable HTML rendering in form field labels (valueLabel)** (Issue #7812)
-   **Refactor: Enhance labelText to support VDOM and remove innerHTML usage** (Issue #7813)
-   **Fix regression: Replace deprecated parseConfig with createBindings in Layout.mjs** (Issue #7814)
-   **Fix race condition: Await addon initialization in Neo.Main** (Issue #7815)
-   **Fix Webpack critical dependency warning in HighlightJs dynamic import** (Issue #7816)

All changes in 1 commit: https://github.com/neomjs/neo/commit/eae4b0e29ddfd1b7497707e0ddb3f7b4adc7af1e
