Homebrew 7.0.0 is out, here’s what changed for security

Homebrew installs command-line software and desktop applications from the terminal on macOS and Linux, and Mac developers use it to set up their machines. On Sunday the project shipped version 7.0.0 and closed eight security advisories with it. The most serious of them let unsigned removal metadata for a cask, Homebrew’s recipe for installing a prebuilt application, execute commands with sudo. Homebrew deleted the vulnerable recovery code and the API accessors that reached it.

Seven of the eight advisories were fixed in 6.0.x releases, so a machine that has been auto-updating already carries those. The eighth arrives in 7.0.0: until it is installed, a malicious cask can execute code outside the macOS install sandbox through LaunchServices.

Eight advisories, one of them High

Homebrew rates one advisory High, two Moderate and five Low. The High one is the sudo path, fixed in 6.0.12. A Moderate fixed in that same release stopped the macOS installer from reading Git configuration owned by the Homebrew prefix, which could execute programs as root. The other Moderate is the LaunchServices escape, and 7.0.0 answers it by restricting application launching, Mach services and Unix socket connections.

The five Low entries, fixed in 6.0.6 and 6.0.7, cover requests and file paths reaching somewhere the user did not intend: redirects that could carry secret headers to another host or be turned into server-side request forgery, Git redirects that could sidestep restrictions on taps (the third-party repositories that supply package definitions), Subversion URLs that could become command options, and patches that could write outside the staged source tree.

Homebrew now scans installed packages itself

brew vulns ships with this release. It checks installed formulae, the package definitions Homebrew builds from, against known vulnerabilities through OSV.dev, a public index of open source vulnerability records, and it needs no extra tap or gem. Flags including --severity=high, --deps and --fix-available narrow the output to what a team can act on.

Behind the command sits a new advisory database that records vulnerabilities against the formula versions and revisions Homebrew ships, backported security fixes included. That detail decides how many false alarms a security team handles: when Homebrew patches a package without moving its upstream version number, a scanner reading the version string alone flags a hole that is already closed. The records are OSV-format and CC0 licensed, and Homebrew publishes the findings in its formula API and as a downloadable index.

Provenance checks widen too. Homebrew verifies build attestations for supported third-party tap bottles, extending a check that covered its own core tap, and taps created with brew tap-new publish those attestations by default.

What the sandbox does not cover

Tap trust remains the main protection against a malicious third-party cask. In Homebrew’s words, sandboxing “cannot make untrusted software safe to run.” An installed application runs with the user’s privileges, and vendor .pkg installers run outside the sandbox and can ask for sudo.

Within that boundary, 7.0.0 narrows what an installation can do. Homebrew sandboxes formula and cask operations and delivers setup instructions as signed data, cutting the arbitrary Ruby that runs during an install; the old post_install and cask flight blocks are deprecated in favor of declared steps, which official taps already reject and third-party taps may keep using until 11 December 2027. Builds no longer read the home directory by default. Dependency downloads are moving to a separate fetch phase, after which installation runs with networking off and caches read-only, though that migration is still in progress.

On Linux, Homebrew replaces the Bubblewrap sandboxing introduced in June with Landlock, a kernel facility that needs no dependencies or escalated Docker permissions. Kernels without Landlock keep running in the less secure configuration that predates 6.0.0, and brew doctor reports the gap as an advisory.

Intel Macs stop getting new bottles

Homebrew moved Intel x86_64 to Tier 3 after unreliable infrastructure ended routine Intel bottle builds. Bottles already built stay available, but an updated formula may have to be compiled locally, which is how an Intel user would pick up a fix that ships in a new version. Homebrew runs on Intel until 1 September 2027 without project support, and its suggestion for those users is a different package manager, MacPorts. Apple dropped Intel from macOS 27 and GitHub retires its Intel macOS runners in autumn 2027, and Homebrew’s volunteers cannot replace either. The release also removes macOS 10.15 and earlier and moves Sonoma 14 to Tier 3, with no new bottles there either.