This release adds 10 notable features for engineering teams evaluating rollout.
Published 2d
MCP Developer Tools
✓ No known CVEs patched
✓ No known CVEs patched in this version
Topics
agent-skills
ai-agent-tools
ai-agents
binary-analysis
cli
coding-agent
+10 more
coding-agents
decompiler
disassembler
hopper-disassembler
mcp
mcp-server
model-context-protocol
reverse-engineering
reverse-engineering-tools
static-analysis
Summary
AI summaryBug fixes across browser, process, and reconstruction modules plus code refactoring updates are included in version 2.5.0.
Full changelog
2.5.0 (2026-07-24)
Features
- add runtime reconstruction roadmap workflows (1dbb157)
- analysis: add bounded memory and call tracing (8e7709d)
- artifacts: add provider-neutral inspection (d997728)
- browser: capture controlled Playwright scenarios (1ac3118)
- browser: compare scenario and storage evidence (f27dd74)
- javascript: compare source with shipped bundles (697be94)
- javascript: recover runtime semantic effects (38c883b)
- process: support explicit stdin closure (205bf15)
- reconstruction: add obligation ledgers (9d48ca7)
- reconstruction: evaluate end-to-end readiness (38ff741)
- runtime: add passive V8 Inspector observation (8271650)
- server: advertise available tools dynamically (035e114)
Bug Fixes
- analysis: report call-edge truncation (6039b92)
- browser: close scenario containment gaps (1bd65f6)
- browser: contain scenario pages and preserve inputs (24b3dc4)
- browser: require storage fingerprint approval (f0069cb)
- ci: allow slower real browser startup (095c75d)
- ci: propagate readiness verifier failures (9f9f9c3)
- ci: repair cross-platform package verification (1c9e508)
- comparison: preserve uncertainty and v1 inputs (b9217dc)
- hopper: add bounded analysis recovery (e0bc7fd)
- javascript: keep digestless bundle matches unknown (5a76aaf)
- process: expose launcher identity mismatch (62ac73c)
- process: normalize macOS launcher identity (9c3aec8)
- process: tolerate exit during ownership revalidation (a0f8b72)
- reconstruction: authenticate obligation proof boundaries (7b1e3bd)
- reconstruction: bind proof evidence to claims (83b3368)
- runtime: preserve deterministic context identity (9bd2ac5)
- test: use direct Node launcher on macOS (13f3372)
Performance Improvements
Code Refactoring
- application: reuse graph evidence resolution (4e8aa98)
- browser: centralize scenario metadata budgeting (e79e367)
- browser: clarify inspector capture identifiers (ca035a7)
- browser: reuse CDP endpoint parsing (00abf45)
- javascript: centralize source range comparison (c9500d3)
- javascript: share semantic call-site lookup (94a2c60)
- reconstruction: isolate ledger coverage (4f62695)
- server: reuse availability policy type (eeb4349)
Documentation
Tests
- browser: use neutral scenario fixture identifiers (fd25a7e)
- package: stabilize fake Hopper ownership (0b70131)
Continuous Integration
- verify runtime observation and readiness (9349ff5)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Rea
All releases →Related context
Related tools
Earlier breaking changes
- vrea-agents-2.0.0 mcp now requires Evidence for managed reconstruction.
- vrea-agents-1.0.0 contracts APIs now return structured discriminated output shapes
- vrea-agents-0.3.0 rename identity package and CLI to REA
- vrea-0.2.0 rename identity package and CLI to REA
Beta — feedback welcome: [email protected]