Homebrew 7.0.0

Today, I’m proud to announce Homebrew 7.0.0. The most significant changes since 6.0.0 are faster installations and upgrades, stronger sandboxing, a native macOS app, built-in vulnerability checks and an advisory database, the end of macOS 10.15 support and Intel Macs moving to Tier 3.

Contents

• ⬆️ Upgrading
• 🍺 All Homebrew users
  • 🏎️ Performance
  • 🔒 Security
    • Security advisories
    • Installation and tap protection
  • 🔎 Commands and configuration
  • 🗃️ Casks
• 🍎 macOS users
  • 🖥️ Homebrew app
• 🐧 Linux users
• 🍾 Non-default prefix users
• 🔍 Security teams and auditors
• 🐳 Homebrew users in CI
• 🛠️ Tap maintainers
  • 🪜 Install steps
• 🙏 Finally

⬆️ Upgrading

An auto-update or manual brew update (if you have $HOMEBREW_NO_AUTO_UPDATE set) will upgrade Homebrew for you.

Now means 7.0.0. Deprecated interfaces warn until disablement; disabled interfaces reject use and removed interfaces are unavailable.

🍺 All Homebrew users

The following improvements apply across platforms unless stated otherwise.

🏎️ Performance

Greater concurrency across downloads, preparation and installation maximises performance while coordinating failures and summaries.

• brew install, brew reinstall and brew upgrade overlap package preparation and downloads, including brew bundle batches, reducing waits between packages and allowing a Brewfile to benefit from the same shared installation work as a command naming several packages.
• brew config gathers independent system details concurrently, so compiler, operating-system and repository checks overlap instead of making diagnostic reports wait for every subprocess in turn.
• brew tap-info --installed --json=v1 collects tap metadata concurrently, shortening inventory requests when several repositories need Git or network checks while preserving the output order expected by scripts.
• brew cleanup avoids repeated cache scans, speeding up cleanup for installations with many packages.
• brew fetch reads download information directly from API metadata for bottles and casks, starting downloads without loading complete package definitions merely to discover URLs and checksums.
• brew update prepares Ruby caches so subsequent commands start faster.
• Homebrew reuses parsed API data on warm runs while verifying signatures on every load, reducing preparation time for repeated package commands without dropping authenticity checks.
• Homebrew launches fewer subprocesses during startup, reducing command overhead, and reads terminal dimensions directly, avoiding hangs with uutils stty.

🔒 Security

Homebrew 7.0.0 includes various security fixes and new installation protections.

Security advisories

The first fixed releases are listed below.

• GHSA-rg9r-ppxp-87hm, High, fixed in 6.0.12: unsigned cask-removal metadata could execute commands with sudo; all vulnerable recovery code and API accessors have been deleted.
• GHSA-5263-whxq-77hp, Moderate, fixed in 7.0.0: a malicious cask could execute code outside the macOS install sandbox through LaunchServices; Homebrew restricts application launching, Mach services and Unix socket connections.
• GHSA-hqpg-hjr9-c7j8, Moderate, fixed in 6.0.12: the macOS installer ignores prefix-owned Git configuration that could execute programs as root.
• GHSA-x82f-cj53-gqfr, Low, fixed in 6.0.7: brew livecheck restricts redirects to prevent server-side request forgery.
• GHSA-3m5g-jfx7-3p65, Low, fixed in 6.0.7: download redirects cannot forward secret headers to other hosts.
• GHSA-r9gp-p4vv-f93x, Low, fixed in 6.0.6: Git redirects cannot bypass tap restrictions.
• GHSA-9g4r-vmj2-j2gj, Low, fixed in 6.0.7: Subversion external URLs cannot become command options.
• GHSA-r7qx-325v-4ccx, Low, fixed in 6.0.6: patch targets cannot escape the staged source tree.

Installation and tap protection

Tap trust remains the primary protection against malicious third-party casks; sandboxing mainly limits accidental damage and adds installation safeguards. It cannot make untrusted software safe to run: applications execute with the user’s privileges, and vendor .pkg installers run outside the sandbox and may require sudo. We balance tighter restrictions with keeping existing software working.

• Homebrew delivers structured setup as signed data and sandboxes formula and cask operations, reducing arbitrary Ruby execution and repeated package loading.
• Homebrew begins migrating dependency downloads into a fetch phase: migrated formulae download with network access and writable caches, then install disables networking and makes those caches read-only; migration remains ongoing.
• Homebrew blocks sandboxed reads of the home directory by default, keeping unrelated personal files outside package builds while allowing required Homebrew paths; private temporary directories let build tools communicate locally without enabling network access.
• Homebrew rejects mismatched real and effective user IDs before reading configuration, removing untested privilege-switching code for unsupported shared installations.

Trust and environment migrations and replacements.

🔎 Commands and configuration

Commands provide clearer previews, package information and service configuration.

• brew install --dry-run previews formulae and casks together.
• brew list --no-installed-on-request identifies formulae installed as dependencies.
• brew info distinguishes uninstallable packages with ⊘ from uninstalled packages with ✘ and marks unmet operating-system and architecture requirements, making it easier to understand whether a package can run on the current machine before starting an installation.
• brew services reads persistent overrides from $HOMEBREW_USER_CONFIG_HOME/services/<formula>.env, allowing local service settings to survive package upgrades and take effect on restart without editing generated service files. New and restarted services use sh.brew.<formula> on macOS and Linux, recognising legacy registrations until restart.
• brew bundle restores language tools from declared sources: Cargo Git repositories or paths and source: for remote uv tools.
• brew doctor --json provides structured diagnostics for automation; brew doctor also warns when another brew shadows the current installation in PATH, helping diagnose wrapper and installation conflicts.
• brew deps --brewfile inspects a Brewfile’s dependencies, making it easier to review the packages a development environment will bring in before installing that environment.
• brew untap offers to uninstall a tap’s packages first, allowing an unwanted package source and its installed software to be removed together.
• HOMEBREW_AUTO_UPDATE_QUIET suppresses automatic-update package details, keeping routine command output focused while still allowing Homebrew to update in the background of normal use.
• Homebrew stops exporting its own BUNDLER_VERSION to child processes, allowing formula builds to use their required Bundler version.

Brewfiles record language-tool sources alongside other packages, reducing separate installation instructions when reproducing an environment on another machine.

Command and configuration migrations and replacements.

🗃️ Casks

Formula links take precedence when formulae and casks provide the same commands, with warnings explaining how to restore the cask links.

• brew upgrade skips incompatible casks while upgrading compatible applications; both it and brew outdated honour HOMEBREW_NO_UPGRADE_AUTO_UPDATES_CASKS, preserving self-updating applications’ opt-out.
• brew uninstall removes records for casks missing from the API, warning about possible leftovers, and avoids needless password prompts when files are already owned by the current user.
• brew link and brew unlink accept --cask/--casks and --formula/--formulae, allowing cask binaries, manpages and completions to be disabled or restored without reinstalling; --dry-run previews changes, while brew link --overwrite replaces conflicts and --force replaces only symlinks from the same cask.
• Homebrew’s API includes cask language variants, allowing installation to select the appropriate URL, checksum and artifacts from package data without evaluating the cask’s Ruby definition for each language choice.

Cask configuration migrations and replacements.

🍎 macOS users

Homebrew moves macOS Intel x86_64 to Tier 3 in September 2026, announced in August 2025 and repeated in the 5.0.0 release notes on 12 November 2025; 7.0.0 also drops macOS 10.15. Homebrew still runs on Intel until September 2027, without project support or routine bottle builds. Apple and GitHub’s retreat from Intel support exceeds what Homebrew’s volunteers can replace.

• brew services run applies per-service environment overrides without registering a login service, making temporary runs use the same configuration as a permanently registered service.
• brew shellenv sets PATH directly, avoiding macOS path_helper subprocesses and configuration-file writes.
• Homebrew moves Intel to Tier 3: existing bottles remain, but updated formulae may require source builds after unreliable infrastructure ended routine Intel bottle updates.
• Homebrew’s .pkg installer is Apple Silicon only and requires macOS Sequoia 15 or later; MacPorts may offer Intel users better binary package coverage.
• Homebrew installs prebuilt casks without Xcode Command Line Tools, removing a compiler dependency from application setup.
• Homebrew fully supports macOS Golden Gate 27, following its bottle rollout; Sequoia 15, Tahoe 26 and Golden Gate 27 are Tier 1 on Apple Silicon.
• Homebrew permits Metal shader compilation inside the macOS sandbox, allowing ggml and whisper.cpp tests to use GPU acceleration without network access.

macOS support migrations

🖥️ Homebrew app

BrewUI is Homebrew’s fully released official graphical interface for macOS, making package management more approachable through a native application.

• brew install homebrew-app installs BrewUI on macOS Tahoe 26 or later.
• BrewUI brings package browsing, search and installed-version details into one window, making it easier to explore available software and review an existing installation.
• BrewUI shows the underlying brew commands for package operations, keeping the work visible and helping connect graphical actions with familiar terminal commands.

🐧 Linux users

Homebrew 6.0.0 introduced Bubblewrap sandboxing. Homebrew 7.0.0 replaces it with Landlock, requiring no dependencies or escalated Docker permissions, which caused setup problems with Bubblewrap.

Status in 7.0.0: kernels without Landlock continue working without Linux sandboxing in the less secure pre-6.0.0 configuration; brew doctor reports missing protection as an advisory.

• brew config reports the Landlock ABI for troubleshooting.
• Homebrew supports Landlock ABI 2 on Linux 6.1, warning when the kernel cannot enforce network restrictions.
• Homebrew moves AppImages to their application destination, matching macOS .app installations instead of versioned symlinks, so self-updates preserve launchers.

Linux configuration

🍾 Non-default prefix users

Homebrew relocates compatible bottles to shorter prefixes, avoiding source builds outside the default installation location.

Status in 7.0.0: limits are 13 bytes on Apple Silicon macOS, 26 on Linux and 10 for existing Intel macOS bottles. These count the full path, including slashes; the Cellar must also fit its build-time length. Bottles marked :any or :any_skip_relocation are relocatable to any prefix.

• Homebrew relocates prefix symlinks so they remain usable elsewhere.
• Homebrew records relocation metadata at build time, reducing repeated installation scans and allowing installation to apply the recorded changes instead of rediscovering every embedded path on each machine.

Upcoming rollout: padded builds aim to make every bottle and dependency relocatable to prefixes up to 64 bytes on Apple Silicon macOS and both Linux architectures. This may eventually allow full support within those limits; non-default prefixes remain unsupported for now, with no rollout date.

🔍 Security teams and auditors

Homebrew’s new advisory database records vulnerabilities against the formula versions and revisions Homebrew ships, including backported security fixes. brew vulns is built in, checking known vulnerabilities using OSV.dev without another tap or gem.

• brew vulns scans installed formulae and reports untrusted-tap skips, with --severity=high, --deps and --brewfile for focused checks. It prioritises remediation using --fix-available and --no-fix-available, --fix-type for released versus patched fixes and --list-skipped for coverage gaps.
• Homebrew publishes advisory findings in the formula API and a downloadable advisory index, helping other tools distinguish outstanding vulnerabilities from fixes already shipped. The database’s OSV-format records are freely reusable under CC0, giving security teams a shared source of Homebrew-specific vulnerability data.
• Homebrew recognises security patches annotated with resolves, avoiding vulnerability reports for fixes already included in a package.
• Homebrew adds upstream package identifiers to software bills of materials, allowing external tools to connect source archives with registries such as PyPI, npm and Cargo rather than relying only on Homebrew formula names.
• Homebrew verifies attestations for supported third-party tap bottles, extending build-provenance checks beyond homebrew/core when a tap publishes the required attestations.

🐳 Homebrew users in CI

Homebrew images and GitHub Actions provide maintained migration targets.

• brew test-bot --build-dependents-from-source limits source builds to ten dependants per formula per shard, prioritising popular packages, enabling broader Linux source-build coverage while keeping CI runtime manageable.
• Homebrew runs routine Golden Gate dependant tests on GitHub’s xcode-27 runners, reducing reliance on self-hosted infrastructure.
• Homebrew retires the Ubuntu 22.04 image; use the maintained general-purpose image below.
• Homebrew’s versioned actions pin internal dependencies, making workflow upgrades reviewable; migrate @main and removed @master references to releases or full SHAs.
• Homebrew uses Homebrew/actions/setup-ruby with portable-ruby: true in its Ruby workflow, allowing CI jobs to select the same interpreter as Homebrew without depending on internal Ruby entry points.

CI migrations

🛠️ Tap maintainers

Authoring tools reduce manual setup and encourage safer package definitions.

• brew audit --cask --online --fix corrects macOS requirements and application-name case; brew audit --strict detects downloaded prebuilt npm executables in installed homebrew/core formulae, helping maintainers enforce source-build requirements.
• brew style --fix consolidates platform-specific cask checksums and sorts dependencies, simplifying cross-platform definitions; brew style also rejects broad com.install4j.* uninstall and zap patterns that could affect unrelated applications.
• brew tap-new generates automatic update workflows for new taps, checking upstream versions on a schedule and opening pull requests so maintainers can review updates without manually checking each formula. It also generates attesting bottle-publishing workflows by default, with --no-attestations as an opt-out, helping new taps publish the provenance that Homebrew can verify when their users install bottles.
• brew bump-cask-pr can generate separate Intel and Apple Silicon version stanzas from architecture-specific update results, allowing maintainers to follow upstream applications that release different versions for each architecture without manually rewriting supported root-level definitions.
• brew bump-formula-pr updates Git resources whose version is a commit hash, keeping both the version and pinned revision in sync for projects without release tags.
• brew create generates syntactically valid formula templates, with separate fetch and offline-build phases for Go and Rust to prevent downloads during compilation.
• brew update-python-resources --ignore-main-package-cooldown bypasses only the main package’s cooldown in third-party formulae.
• brew benchmark measures cold and warm install/fetch workloads separately, with --runs= controlling repetitions and --exec supporting custom Hyperfine commands, so contributors can identify whether a change improves fresh downloads, cached installations or command overhead rather than relying on one combined timing.
• brew bump-compatibility-version records changes requiring dependant rebuilds.
• brew formula-python-resources --all/--tap= inventories Python resources, while brew bump-python-resources-pr --packages= opens security updates, with -n/--dry-run, --install-dependencies, --no-fork, --branch=, --message= and --output= supporting automation.
• Homebrew formulae use python3 to select their direct Python dependency without hardcoded interpreter paths.
• Homebrew formulae can declare stop_timeout for services, giving databases and other stateful applications longer to shut down gracefully before the service manager terminates them; stop_timeout 60 sets a one-minute allowance on both macOS and Linux.
• Homebrew’s python_major_minor_version helper supplies the selected Python version, avoiding repeated version-detection code in formula definitions that need versioned paths or arguments.
• Homebrew’s std_go_args(ldflags: :goreleaser) supplies common GoReleaser build metadata, including version, commit and build date, helping upstream applications report useful version information from Homebrew builds without each formula recreating those linker arguments.
• Homebrew formulae and casks can record a human homepage check with homepage ..., browsed: "YYYY-MM-DD", pausing automated availability checks for one year when a site works in browsers but blocks automated requests, while ensuring the manual check has an expiry.
• Homebrew services can use shared package path helpers, allowing service definitions to refer to package locations consistently without duplicating path construction between their commands and environment settings.

🪜 Install steps

Formula post_install and cask *flight Ruby blocks are deprecated in favour of declared *_steps. Explicit operations and paths allow validation, sandboxing and signed API delivery, making setup safer and avoiding repeated package evaluation.

Status in 7.0.0: official taps reject legacy hooks; third-party taps receive warnings until 11 December 2027.

• brew style --fix converts common hooks; manual migrations require rewriting the block’s contents as declared steps, following the Formula Cookbook or Cask Cookbook.
• Homebrew provides structured file operations and configuration writes, preserving common setup without arbitrary Ruby; formula authors describe the intended operation and target, while Homebrew handles validation and execution consistently.
• Homebrew validates serialised steps before execution, giving package authors a defined set of supported operations and allowing API-delivered setup to follow the same rules as locally loaded definitions.

Install hook migrations

The migration guide lists install-step names, DSLs and public API replacements.

Maintenance command removals and replacements are also documented.

🙏 Finally

• The Intel support decision reflects the limits of a volunteer-run project: Apple have dropped Intel x86_64 support from macOS 27 Golden Gate and GitHub Actions will retire Intel macOS runners in autumn 2027. If Apple and Microsoft’s GitHub, two of the world’s largest technology companies, cannot continue supporting macOS Intel x86_64, sadly neither can Homebrew. MacPorts still supports macOS Intel x86_64 and is likely to provide better results on this platform.
• Homebrew is a non-profit project run entirely by volunteers, not employees. We need your funds to pay for software, hardware and hosting around continuous integration and future improvements to the project. Every donation will be spent on making Homebrew better for our users. Please consider a regular donation through GitHub Sponsors, OpenCollective and Patreon.
• Homebrew/brew (still) has no open issues at the time of writing, as has been the case for most of the period since Homebrew 6.0.0 🎉.

Thanks to all our hard-working volunteer maintainers, contributors, sponsors and supporters for getting us this far.