---
tagName: 11.19.1
name: Neo.mjs v11.19.1 Release Notes
publishedAt: '2026-01-09T20:57:58Z'
isPrerelease: false
isDraft: false
---
# Neo.mjs v11.19.1 Release Notes

**Release Type:** Architectural Hardening & Autonomous Infrastructure  
**Stability:** Production-Ready (Critical Security Patches)  
**Upgrade Path:** Drop-in replacement for v11.19.0  

> **TL;DR:** v11.19.1 resolved **33 tickets in 11 hours**, moving from the discovery of a critical prototype pollution vulnerability to a fully automated, conflict-free release pipeline. By leveraging the **Neural Link** for live "Scene Graph" inspection, we replaced guesswork with **Empirical Certainty**, allowing us to pinpoint "Zombie VNodes" and fix them with surgical precision. This release proves that AI-assisted engineering isn't just about faster code—it's about higher-fidelity architecture.

---

## 🛡️ The VDOM Firewall: Defensive Instance Isolation

v11.19.1 addresses the most subtle form of state corruption: **Blueprint Pollution**. We identified a vulnerability where early lifecycle access could corrupt the shared prototype of a component.

### The Problem: Shared State Leakage
In a multi-threaded engine, state isolation is the foundation of stability. We discovered that if an `afterSetId` hook accessed `this.vdom` during the initial construction phase, it was inadvertently receiving a reference to the **Class Prototype**. Any modification—such as assigning an ID—was written directly into the shared blueprint, polluting every subsequent instance of that class.

### The Solution: Eager Blueprint Sandboxing
We refactored `Neo.component.Base` to enforce **Eager Isolation**.
*   **The Firewall:** The constructor now intercepts the initialization flow *before* `super.construct()` is called. It verifies the VDOM's ownership and clones the blueprint immediately.
*   **The Result:** Prototype pollution is now architecturally impossible. Every component instance is guaranteed to operate within its own private **VDOM Sandbox** before any logic layer (hooks or setters) can touch it.
*   **Centralized ID Stability:** We purged ad-hoc ID logic from the entire component library, routing all root and wrapper ID assignments through the centralized `Neo.mixin.VdomLifecycle.ensureStableIds()`.
*   **Impact:** This eliminates an entire class of "Heisenbug" state corruption issues that could manifest as random UI glitches in production applications.

---

## 🛑 The "GitHub Pages" Reality Check

We battle-tested v11.19.0 extensively locally. The new "Releases Overview" worked perfectly in our dev environments. But when we deployed the Portal to GitHub Pages, the Release Notes vanished.

*   **The Constraint:** We discovered that GitHub Pages strictly enforces a "No `.github` Folder" policy. Even with `.nojekyll` enabled, and even when the folder is deeply nested inside `node_modules`, GitHub's serving infrastructure silently refuses to serve any file path containing `.github`.
*   **The Attempts:** We tried symlinks. We tried copying the folder during the build. We tried nesting it. The platform said "No."
*   **The Pivot:** This physical platform constraint forced us to re-architect our content strategy. v11.19.1 moves all synced artifacts (Issues, Release Notes, Archive) from the hidden `.github` directory to a public-facing `resources/content/` structure. This wasn't just a rename; it was a necessary migration to make our "Engine-as-Content" vision compatible with the real world of static hosting.

---

## ⚙️ Operational Sovereignty: The Autonomous Release Pipeline

While v11.19.1 hardens the engine for users, it also revolutionizes how we maintain it. We have achieved **Operational Sovereignty** by automating our release workflow from scratch.

*   **Autonomous Infrastructure:** We created `buildScripts/publishRelease.mjs` to eliminate the friction of manual versioning, SEO generation, and conflict resolution.
*   **Git Plumbing for Atomic Commits:** By using low-level `git commit-tree` commands, we now snapshot the entire `dev` branch and project it onto `main` as a single, clean commit. This bypasses Git's rename detection entirely, turning "Merge Conflict Hell" into an instant, conflict-free operation.

---

## 🎨 Eliminating Layout Thrash: First-Paint Stability

We've polished the **Neo.mjs Portal** to match the framework's stability improvements, proving that "Smooth is Fast."

### Killing the "Visual Snap"
The Portal previously used a JavaScript `ResizeObserver` to apply responsive sizing. This created **Layout Trashing**: the UI would render, the worker would measure it, and the sidebar would "snap" into place. 
We've replaced this with **Native CSS Media Queries**. The layout is now perfectly stable from the very first paint frame.

### Markdown Hardening
*   **Image Containment:** We implemented regex-based post-processing in the `Markdown` component to wrap all images in a scrollable flex-container, preventing side-navigation overlaps.
*   **404 Guardrails:** The component now validates its input. If a server returns an HTML 404 page, the component rejects the update, preventing CSP violations and unintended HTML injection from error pages.

---

## 🔄 Process Evolution: Neural Link Certainty

This release marks a fundamental shift in AI-assisted engineering. We moved from **"Static Guessing"** to **"Runtime Inspection."**

### Beyond Static Analysis
When we encountered the prototype pollution issue, we didn't just grep the code. We used the **Neural Link** to inspect live **Scene Graphs**.
*   **The "Proof" Moment:** Instead of assuming pollution might exist, the AI was able to inspect the VNode tree of a live component and state: *"Tobi, THIS specific vnode id inside the prototype is the empirical proof."*
*   **High-Fidelity Testing:** This level of introspection allowed us to rapidly generate Playwright unit tests (`AutoId.spec.mjs`) that perfectly mirrored the engine's internal VDOM/VNode/Component structures, enabling us to simulate, verify, and fix complex race conditions in minutes.

### 🔄 The SDK Pattern: Code Reuse Across Contexts
The new release automation script (`buildScripts/publishRelease.mjs`) demonstrates a key architectural pattern: **MCP server capabilities are exposed as importable services**, allowing them to be used outside AI contexts.

```javascript
// buildScripts/publishRelease.mjs
// Step 6: Post-Release Cleanup
import { GH_SyncService } from '../ai/services.mjs';

await GH_SyncService.runFullSync(); // Same method agents use via MCP
```

This "SDK Pattern" proves that our AI infrastructure isn't siloed "magic"—it's **composable infrastructure**. Build scripts, GitHub Actions, and developer tools can import and execute the same business logic services that power the Neural Link.

### Velocity Metrics:
*   **Scope:** 33 Tickets (#8450 - #8482)
*   **Total Duration:** 11 Hours, 15 Minutes
*   **Workflow:** 100% Agent-led Implementation & Verification

---

## 📦 Full Changelog

### 🛡️ Core & VDOM Hardening
*   Investigate VDOM ID Collisions and Create Reproduction Test (#8465)
*   Prevent Prototype VDOM Mutation in Component.Base afterSetId (#8466)
*   Centralize and Enforce Stable VDOM IDs in VdomLifecycle (#8467)
*   Fix Unit Test Failures after VDOM ID Stabilization (#8468)
*   Audit and Refactor all afterSetId Implementations (#8469)
*   Enhance VDOM AutoId Unit Test Documentation (#8470)
*   Refactor afterSetId in src/button/Base.mjs (#8471)
*   Implement Lazy VDOM Cloning in Component Base (#8472)
*   Refactor afterSetId in Split Button and Grid Body (#8473)
*   Enforce Eager VDOM Cloning in Component Constructor (#8474)
*   Remove redundant ensureStableIds from Button Base (#8475)
*   Refactor Gallery to remove manual afterSetId ID assignment (#8476)
*   Refactor Progress Component ID handling (#8477)
*   Refactor afterSetId in Form Fields to ensureStableIds (#8478)

### 🚀 Portal & UI Enhancements
*   Add validation to Markdown component to reject HTML 404 responses (#8450)
*   Fix Portal Release buttons missing text due to missing name field (#8461)
*   Portal App: Update SectionsList styling to match new transparent design (#8462)
*   Fix Blog List Rendering Artifact in Release View (#8464)
*   Wrap Markdown images in scrollable container (#8479)
*   Constrain Markdown image wrapper width in Portal app (#8480)
*   Fix Portal layout trashing by replacing JS-driven size classes with CSS Media Queries (#8481)
*   Fix Markdown blockquote margin-right to override browser default (#8482)

### ⚙️ Build & Infrastructure
*   Move GitHub Workflow Sync Target to resources/content (#8451)
*   Update .sync-metadata.json paths to reflect relocation to resources/content/ (#8452)
*   Refactor IssueSyncer to use relative paths in .sync-metadata.json (#8453)
*   Update release index generation to use correct path in resources/content (#8454)
*   Remove obsolete path substring in Release Component (#8455)
*   Automate Release Workflow with Git Squash & Local-First Strategy (#8456)
*   Optimize Release Squash using Git Plumbing (#8457)
*   Integrate Knowledge Base Upload into Publish Release Workflow (#8458)
*   Remove standalone prepare-release script from package.json (#8459)
*   Refactor: Enhance documentation and cleanup comments in publishRelease.mjs (#8460)
*   Disable Neural Link on GitHub Pages (#8463)


All changes delivered in 1 atomic commit: [c659e42](https://github.com/neomjs/neo/commit/c659e429db722e8b5068eef3329051fd8730a3c1)
