Today, I’m proud to announce Homebrew 7.0.0. The most significant changes since 6.0.0 are faster installations and upgrades, stronger sandboxing, a native macOS app, built-in vulnerability checks and an advisory database, the end of macOS 10.15 support and Intel Macs moving to Tier 3.

Contents

⬆️ Upgrading

An auto-update or manual brew update (if you have $HOMEBREW_NO_AUTO_UPDATE set) will upgrade Homebrew for you.

Now means 7.0.0. Deprecated interfaces warn until disablement; disabled interfaces reject use and removed interfaces are unavailable.

🍺 All Homebrew users

The following improvements apply across platforms unless stated otherwise.

🏎️ Performance

Greater concurrency across downloads, preparation and installation maximises performance while coordinating failures and summaries.

• brew install, brew reinstall and brew upgrade overlap package preparation and downloads, including brew bundle batches, reducing waits between packages and allowing a Brewfile to benefit from the same shared installation work as a command naming several packages.
• brew config gathers independent system details concurrently, so compiler, operating-system and repository checks overlap instead of making diagnostic reports wait for every subprocess in turn.
• brew tap-info --installed --json=v1 collects tap metadata concurrently, shortening inventory requests when several repositories need Git or network checks while preserving the output order expected by scripts.
• brew cleanup avoids repeated cache scans, speeding up cleanup for installations with many packages.
• brew fetch reads download information directly from API metadata for bottles and casks, starting downloads without loading complete package definitions merely to discover URLs and checksums.
• brew update prepares Ruby caches so subsequent commands start faster.
• Homebrew reuses parsed API data on warm runs while verifying signatures on every load, reducing preparation time for repeated package commands without dropping authenticity checks.
• Homebrew launches fewer subprocesses during startup, reducing command overhead, and reads terminal dimensions directly, avoiding hangs with uutils stty.

🔒 Security

Homebrew 7.0.0 includes various security fixes and new installation protections.

Security advisories

The first fixed releases are listed below.

• GHSA-rg9r-ppxp-87hm, High, fixed in 6.0.12: unsigned cask-removal metadata could execute commands with sudo; all vulnerable recovery code and API accessors have been deleted.
• GHSA-5263-whxq-77hp, Moderate, fixed in 7.0.0: a malicious cask could execute code outside the macOS install sandbox through LaunchServices; Homebrew restricts application launching, Mach services and Unix socket connections.
• GHSA-hqpg-hjr9-c7j8, Moderate, fixed in 6.0.12: the macOS installer ignores prefix-owned Git configuration that could execute programs as root.
• GHSA-x82f-cj53-gqfr, Low, fixed in 6.0.7: brew livecheck restricts redirects to prevent server-side request forgery.
• GHSA-3m5g-jfx7-3p65, Low, fixed in 6.0.7: download redirects cannot forward secret headers to other hosts.
• GHSA-r9gp-p4vv-f93x, Low, fixed in 6.0.6: Git redirects cannot bypass tap restrictions.
• GHSA-9g4r-vmj2-j2gj, Low, fixed in 6.0.7: Subversion external URLs cannot become command options.
• GHSA-r7qx-325v-4ccx, Low, fixed in 6.0.6: patch targets cannot escape the staged source tree.

Installation and tap protection

Tap trust remains the primary protection against malicious third-party casks; sandboxing mainly limits accidental damage and adds installation safeguards. It cannot make untrusted software safe to run: applications execute with the user’s privileges, and vendor .pkg installers run outside the sandbox and may require sudo. We balance tighter restrictions with keeping existing software working.

Trust and environment migrations and replacements.

🔎 Commands and configuration

Commands provide clearer previews, package information and service configuration.

Brewfiles record language-tool sources alongside other packages, reducing separate installation instructions when reproducing an environment on another machine.

Command and configuration migrations and replacements.

🗃️ Casks

Formula links take precedence when formulae and casks provide the same commands, with warnings explaining how to restore the cask links.

Cask configuration migrations and replacements.

🍎 macOS users

Homebrew moves macOS Intel x86_64 to Tier 3 in September 2026, announced in August 2025 and repeated in the 5.0.0 release notes on 12 November 2025; 7.0.0 also drops macOS 10.15. Homebrew still runs on Intel until September 2027, without project support or routine bottle builds. Apple and GitHub’s retreat from Intel support exceeds what Homebrew’s volunteers can replace.

macOS support migrations

🖥️ Homebrew app

BrewUI is Homebrew’s fully released official graphical interface for macOS, making package management more approachable through a native application.

🐧 Linux users

Homebrew 6.0.0 introduced Bubblewrap sandboxing. Homebrew 7.0.0 replaces it with Landlock, requiring no dependencies or escalated Docker permissions, which caused setup problems with Bubblewrap.

Status in 7.0.0: kernels without Landlock continue working without Linux sandboxing in the less secure pre-6.0.0 configuration; brew doctor reports missing protection as an advisory.

Linux configuration

🍾 Non-default prefix users

Homebrew relocates compatible bottles to shorter prefixes, avoiding source builds outside the default installation location.

Status in 7.0.0: limits are 13 bytes on Apple Silicon macOS, 26 on Linux and 10 for existing Intel macOS bottles. These count the full path, including slashes; the Cellar must also fit its build-time length. Bottles marked :any or :any_skip_relocation are relocatable to any prefix.

Upcoming rollout: padded builds aim to make every bottle and dependency relocatable to prefixes up to 64 bytes on Apple Silicon macOS and both Linux architectures. This may eventually allow full support within those limits; non-default prefixes remain unsupported for now, with no rollout date.

🔍 Security teams and auditors

Homebrew’s new advisory database records vulnerabilities against the formula versions and revisions Homebrew ships, including backported security fixes. brew vulns is built in, checking known vulnerabilities using OSV.dev without another tap or gem.

🐳 Homebrew users in CI

Homebrew images and GitHub Actions provide maintained migration targets.

CI migrations

🛠️ Tap maintainers

Authoring tools reduce manual setup and encourage safer package definitions.

• brew audit --cask --online --fix corrects macOS requirements and application-name case; brew audit --strict detects downloaded prebuilt npm executables in installed homebrew/core formulae, helping maintainers enforce source-build requirements.
• brew style --fix consolidates platform-specific cask checksums and sorts dependencies, simplifying cross-platform definitions; brew style also rejects broad com.install4j.* uninstall and zap patterns that could affect unrelated applications.
• brew tap-new generates automatic update workflows for new taps, checking upstream versions on a schedule and opening pull requests so maintainers can review updates without manually checking each formula. It also generates attesting bottle-publishing workflows by default, with --no-attestations as an opt-out, helping new taps publish the provenance that Homebrew can verify when their users install bottles.
• brew bump-cask-pr can generate separate Intel and Apple Silicon version stanzas from architecture-specific update results, allowing maintainers to follow upstream applications that release different versions for each architecture without manually rewriting supported root-level definitions.
• brew bump-formula-pr updates Git resources whose version is a commit hash, keeping both the version and pinned revision in sync for projects without release tags.
• brew create generates syntactically valid formula templates, with separate fetch and offline-build phases for Go and Rust to prevent downloads during compilation.
• brew update-python-resources --ignore-main-package-cooldown bypasses only the main package’s cooldown in third-party formulae.
• brew benchmark measures cold and warm install/fetch workloads separately, with --runs= controlling repetitions and --exec supporting custom Hyperfine commands, so contributors can identify whether a change improves fresh downloads, cached installations or command overhead rather than relying on one combined timing.
• brew bump-compatibility-version records changes requiring dependant rebuilds.
• brew formula-python-resources --all/--tap= inventories Python resources, while brew bump-python-resources-pr --packages= opens security updates, with -n/--dry-run, --install-dependencies, --no-fork, --branch=, --message= and --output= supporting automation.
• Homebrew formulae use python3 to select their direct Python dependency without hardcoded interpreter paths.
• Homebrew formulae can declare stop_timeout for services, giving databases and other stateful applications longer to shut down gracefully before the service manager terminates them; stop_timeout 60 sets a one-minute allowance on both macOS and Linux.
• Homebrew’s python_major_minor_version helper supplies the selected Python version, avoiding repeated version-detection code in formula definitions that need versioned paths or arguments.
• Homebrew’s std_go_args(ldflags: :goreleaser) supplies common GoReleaser build metadata, including version, commit and build date, helping upstream applications report useful version information from Homebrew builds without each formula recreating those linker arguments.
• Homebrew formulae and casks can record a human homepage check with homepage ..., browsed: "YYYY-MM-DD", pausing automated availability checks for one year when a site works in browsers but blocks automated requests, while ensuring the manual check has an expiry.
• Homebrew services can use shared package path helpers, allowing service definitions to refer to package locations consistently without duplicating path construction between their commands and environment settings.

🪜 Install steps

Formula post_install and cask *flight Ruby blocks are deprecated in favour of declared *_steps. Explicit operations and paths allow validation, sandboxing and signed API delivery, making setup safer and avoiding repeated package evaluation.

Status in 7.0.0: official taps reject legacy hooks; third-party taps receive warnings until 11 December 2027.

Install hook migrations

The migration guide lists install-step names, DSLs and public API replacements.

Maintenance command removals and replacements are also documented.

🙏 Finally

Thanks to all our hard-working volunteer maintainers, contributors, sponsors and supporters for getting us this far.