Homebrew Release Notes

What's Changed

• Verify API formula patch downloads by @MikeMcQuaid in #24285
• Require verifiable official formula sources by @MikeMcQuaid in #24287
• Honour explicit cask checksum requirements by @MikeMcQuaid in #24288
• livecheck: prefer Git livecheck over GithubLatest by @bevanjkay in #24280
• Keep outdated :no_linkage build dependencies by @HaraldNordgren in #24290
• cask/audit: skip livecheck requirement for :latest by @bevanjkay in #24297
• advisory-match: exclude reviewed false aliases by @p-linnane in #24296
• Extract tarballs with a UTF-8 locale by @IngmarStein in #24304
• Combine dependency role tags from API metadata by @p-linnane in #24302
• Match newlines in tap path regex by @p-linnane in #24303
• Warn when the upstream remote isn't origin by @HaraldNordgren in #24299
• Treat archive filenames literally by @p-linnane in #24305
• Keep patches in stable blocks during bumps by @MikeMcQuaid in #24307
• cask/audit: reject new casks requiring Rosetta by @bevanjkay in #24309
• generate-cask-ci-matrix: skip signing on macOS 15 by @bevanjkay in #24312
• Fix ZIP volume label specs on macOS 27 by @p-linnane in #24313
• Don't flag newer CLT releases as outdated by @p-linnane in #24314
• info: remove stale installed_as_dependency TODO by @hyuraku in #24318
• bundle cleanup: report failed removals by @edel67 in #24289
• Require zap stanzas in new casks by @bevanjkay in #24315
• Prefill app and zap in brew create --cask by @bevanjkay in #24316
• Skip unavailable MacPorts website links by @MikeMcQuaid in #24326
• Sign temporary keg copies before restoring them by @MikeMcQuaid in #24325
• Bump portable-ruby to 4.0.8 by @brew-commit-app[bot] in #24323
• Warn about Git sandbox configuration failures by @MikeMcQuaid in #24329
• formula: deuniversalize the keg being installed by @zbeekman in #24327
• Bump portable-ruby to 4.0.9 by @brew-commit-app[bot] in #24334
• Honour curl environment options consistently by @MikeMcQuaid in #24328
• dmg: skip legacy desktop metadata by @QuillVot in #24331
• Re-read terminal size on resize during downloads by @mxtymoshyk in #24338
• Allow Keychain tokens for Git downloads by @MikeMcQuaid in #24341
• Restart systemd services on unsuccessful exit by @xucian in #24342
• cask/audit: strip gktool progress from errors by @bevanjkay in #24344
• list: fail clearly for uninstalled casks when piped by @aktanazat in #24345
• Speed up linking and unlinking kegs by @krehel in #24332
• keg_relocate: strip high bytes before matched paths by @andrew in #24321
• Preserve UTF-8 paths in ELF loader strings by @andrew in #24349
• Prefer reliable installed download tools by @MikeMcQuaid in #24346
• Share analytics queries and package downloads by @MikeMcQuaid in #24350
• Allow reading private sandbox temporary files by @MikeMcQuaid in #24351
• Limit implicit item trust to install commands by @MikeMcQuaid in #24352
• download_queue: name the download in checksum mismatch errors by @Moisan in #24353
• Document Homebrew and MDM administration by @MikeMcQuaid in #24355

New Contributors

• @QuillVot made their first contribution in #24331
• @mxtymoshyk made their first contribution in #24338
• @xucian made their first contribution in #24342
• @aktanazat made their first contribution in #24345

Full Changelog: 7.0.10...7.0.11

Original source

What's Changed

• Ignore Ubuntu release list link check failures by @MikeMcQuaid in #24196
• Require test resources in homebrew/core by @MikeMcQuaid in #24180
• Preserve cask approval for copied helpers by @MikeMcQuaid in #24191
• Add OSS Scanner Dockerfile and threat model by @p-linnane in #24199
• spdx: store downcased licenses in hash across calls by @alebcay in #24197
• Harden tap redirect trust and rollback by @p-linnane in #24198
• Fix offline, vacuous and repo-leaking specs by @p-linnane in #24200
• Ignore hidden directories when listing taps by @p-linnane in #24201
• Isolate Bootsnap caches across gem changes by @SSakutaro in #24206
• Bump portable-ruby to 4.0.7_1 by @brew-commit-app[bot] in #24211
• Check untrusted conflicts without loading them by @p-linnane in #24208
• Avoid duplicate source upgrades of dependencies by @p-linnane in #24209
• Report net dependency impact in test-bot by @p-linnane in #24213
• Avoid nested formula locks while linking by @p-linnane in #24207
• formula_versions: allow test-only resources by @daeho-ro in #24218
• Show versions of dependencies in dry-run by @HaraldNordgren in #24210
• Extend T::Generic in Tapioca DSL compilers by @p-linnane in #24219
• rubocop: Always run the "every formula should have a test block" check by @issyl0 in #24188
• Suppress developer mode warnings in CI by @p-linnane in #24220
• bundle: protect Brewfile formulae during cleanup by @AbdelrahmanHafez in #24222
• advisory-match: emit split affected intervals by @p-linnane in #24223
• advisory-match: add --rejected-candidates by @p-linnane in #24224
• advisory-match: reuse platform-independent history by @p-linnane in #24225
• cask/audit: check signing of more artifact types by @bevanjkay in #24227
• Check cask receipt tap when untapping by @p-linnane in #24228
• pr-publish: reset label inputs per pull request by @p-linnane in #24232
• pr-publish: remove large runner uploads by @p-linnane in #24233
• advisory-match: fix spec indentation warning by @p-linnane in #24234
• advisory-match: cache historical formula source by @p-linnane in #24231
• Fix local formula sources in brew info by @MikeMcQuaid in #24238
• Add cop for ternaries with nil branches by @MikeMcQuaid in #24239
• Read protected install step symlinks with sudo by @p-linnane in #24241
• sort search results by version by @adamv in #24240
• utils/pypi: preserve :test resources by @botantony in #24242
• bundle: protect alternate formula names by @AbdelrahmanHafez in #24229
• Document yearly BottleTransition update by @hyuraku in #24243
• cask/audit: skip resource-only bundles by @MikeMcQuaid in #24247
• test: isolate tty? and command lookup fixtures by @p-linnane in #24245
• cask/ci/check: ignore more running Apple apps by @bevanjkay in #24244
• bundle: upgrade outdated npm packages by @MikeMcQuaid in #24254
• docs: unify formula and cask description guidelines by @bevanjkay in #24256
• info: show build deps for source installs by @HaraldNordgren in #24258
• Exclude end date from approved-review searches by @MikeMcQuaid in #24260
• Keep ENV build metadata off the shareable ENV by @p-linnane in #24249
• Require lead maintainer review for CODEOWNERS by @p-linnane in #24265
• Accept dependency tag arrays in API metadata by @p-linnane in #24262
• Stop bundle specs leaking Tap and Cask doubles by @p-linnane in #24267
• Preserve and validate no_linkage metadata by @p-linnane in #24263
• Use full names for tap migration targets by @p-linnane in #24266
• utils/curl: guess charset from a <meta> tag by @hyuraku in #24257
• info: show revision in headline upgrade version by @HaraldNordgren in #24271
• curl: stop retrying local download write failures by @BrandenXia in #24275
• audit: flag self-submissions by commit email by @bevanjkay in #24277
• shared_audits: parse whois dates with spaces by @bevanjkay in #24276
• cask: merge uninstall and zap directives into one pass by @bevanjkay in #24194
• Disclaim sandbox TCC responsibility when available by @MikeMcQuaid in #24272
• audit: require livecheck for new packages by @bevanjkay in #24279
• Make source build dependency upgrades more liberal by @HaraldNordgren in #24273
• rubocops/cask: disallow bare ToDesktop wildcard by @krehel in #24281
• api: revalidate JSON API caches with ETag, not the bumped mtime by @xrl in #24193
• Truncate summary versions to fit terminal width by @MikeMcQuaid in #24283
• Add vulnerability-aware package management by @MikeMcQuaid in #24274
• unpack: explain extraction disk space failures by @BrandenXia in #24278
• Tighten bottle attestation verification by @MikeMcQuaid in #24282
• Preserve build errors with Pathname arguments by @MikeMcQuaid in #24292
• Serialise Pathnames in forked child errors by @dduugg in #24294
• Publish local patch checksums in the formula API by @MikeMcQuaid in #24284
• Preserve cask backups across lifecycle phases by @MikeMcQuaid in #24295

New Contributors

• @BrandenXia made their first contribution in #24275
• @xrl made their first contribution in #24193

Full Changelog: 7.0.9...7.0.10

Original source

What's Changed

• formula: extract commit for goreleaser flags by @cho-m in #24163
• advisory-match: ignore uncomparable sources by @p-linnane in #24169
• Correct Command Line Tools version advice by @MikeMcQuaid in #24170
• test/formula_spec: mock cached_download to avoid slow test by @cho-m in #24171
• advisory-match: move fixes past shared versions by @p-linnane in #24172
• Recommend Xcode 27 on Apple silicon Tahoe by @p-linnane in #24177
• Infer Xcode 26.x versions from clang builds by @p-linnane in #24178
• Remove comments during automated patch removal by @nandahkrishna in #24164
• Use sandbox env for interactive fetch phase by @Moisan in #24166
• info: show install paths and PATH shadowing with --verbose by @HaraldNordgren in #24168
• Show versions when installing dependencies by @HaraldNordgren in #24179
• Add test-only resources for offline tests by @MikeMcQuaid in #24173
• Re-sign Mach-O files after relocation fails by @MikeMcQuaid in #24183
• Interactive fetch shell by @Moisan in #24174
• Stop inferring Xcode versions from clang by @p-linnane in #24185
• Allow skipping cask token conflict audit by @cho-m in #24186
• Require canonical names for formula trust by @MikeMcQuaid in #24189
• keg_relocate: read files directly instead of shelling out to grep by @alebcay in #24190
• Avoid reusing the exec test's fixture database by @MikeMcQuaid in #24192

Full Changelog: 7.0.8...7.0.9

Original source

What’s Changed

test-bot: skip bottles for unsatisfiable formulae by @daeho-ro in #24104

Time out stalled cask audit downloads by @p-linnane in #24108

cask: remove pre-staged downloads when installs fail by @dergachoff in #24107

diagnostic: allowlist JPKI client dylibs by @ttsuru in #24110

shell: fish-quote the fish profile line by @rawsun007 in #24114

keg: keep versioned opt aliases that still point at an installed keg by @erikdw in #24113

docs/_layouts/base.html: fix heading permalinks by @bevanjkay in #24116

Support bumping cask versions per platform by @waldyrious in #24111

Prevent SSH prompts during sandboxed Git fetches by @MikeMcQuaid in #24117

Fix flaky cleanup and bottle tests by @MikeMcQuaid in #24118

sandbox: allow Keychain trust evaluation on macOS by @gritse in #24120

Allow symlinked Git config in download sandbox by @MikeMcQuaid in #24121

dev-cmd/bump-formula-pr: append patch checkbox to formula_checkboxes by @botantony in #24122

sandbox: allow system trust evaluation online by @MikeMcQuaid in #24126

bump: use refresh_for_tag for per-OS detection by @krehel in #24127

Load legacy formula DSL in history walks by @p-linnane in #24131

cask/utils: don't follow symlinks when gaining permissions by @hyuraku in #24134

Allow Git downloads to use the GitHub API token by @gritse in #24128

Use a private working directory in the sandbox by @MikeMcQuaid in #24132

generate-cask-ci-matrix: add Golden Gate runner by @bevanjkay in #24135

Improve install, upgrade and reinstall output by @MikeMcQuaid in #24138

Check sudo access only when first needed by @MikeMcQuaid in #24139

formatter: round before picking the unit in disk_usage_readable by @rawsun007 in #24144

Recognize legacy PyPI resource URLs by @p-linnane in #24142

Deduplicate combined upgrade summaries by @MikeMcQuaid in #24149

Isolate deferred messages between test examples by @MikeMcQuaid in #24148

Handle unresolved Cask effective groups by @MikeMcQuaid in #24146

contributions: count coauthors for amended commits by @iMichka in #24125

Docs: install script no longer supports macOS Intel by @NReilingh in #24151

pr-publish: add --warn-on-upload-failure by @daeho-ro in #24081

Re-enable sort cop for zsh and fish completions by @AlternateRT in #24050

formulary: link tap issues when formulae print by @hyuraku in #24156

utils/shell: general cleanup. by @rawsun007 in #24154

Protect Homebrew locks from sandboxed hooks by @MikeMcQuaid in #24157

Use runtime platform for vendored gem extensions by @MikeMcQuaid in #24159

advisory-match: include mixed build versions by @p-linnane in #24161

Support monthly maintainer reports by @MikeMcQuaid in #24162

New Contributors

@dergachoff made their first contribution in #24107

@ttsuru made their first contribution in #24110

@erikdw made their first contribution in #24113

@gritse made their first contribution in #24120

@NReilingh made their first contribution in #24151

Full Changelog: 7.0.7...7.0.8

Original source

What's Changed

• Reconcile records for removed resources by @p-linnane in #24049
• Extend sandboxing to package processing by @MikeMcQuaid in #24038
• Report analytics failure when debugging by @SMillerDev in #24059
• Fix pkgconf infinite reinstall after macOS upgrade by @rseleven in #24061
• Check extensionless scripts in style commands by @MikeMcQuaid in #24063
• shims/super/cc: update swift path by @cho-m in #24065
• install_steps: fix sandbox write path resolution by @kronikpillow in #24067
• formula: provide fallback git identity in sandbox by @Moisan in #24066
• dev-cmd/advisory-match: fix test style by @samford in #24076
• Support Homebrew without sudo access by @MikeMcQuaid in #24062
• Add as-brew-user and support MDM deployment by @MikeMcQuaid in #24071
• Relax Git download credential sandboxing by @MikeMcQuaid in #24064
• dev-cmd/bump-formula-pr: remove incorporated GitHub-based patches by @nandahkrishna in #24047
• Relocate prefixes split across x86-64 operands by @MikeMcQuaid in #24080
• Deduplicate deprecation and sandbox warnings by @MikeMcQuaid in #24078
• curl: use the last value of a repeated singleton header by @rawsun007 in #24053
• Restore PATH for sandboxed Git downloads by @MikeMcQuaid in #24084
• Avoid recursive formulae and casks fallbacks by @MikeMcQuaid in #24086
• cask/uninstall: skip signalling other users' processes by @hyuraku in #24082
• Stabilise warning and GitHub artifact tests by @MikeMcQuaid in #24093
• Type cask artifact options instead of **options by @dduugg in #24095
• upgrade: keep requested order in keg-only groups by @zbeekman in #24092
• cleanup: handle casks without a version in a given OS by @krehel in #24096
• [Fix] Clear cached receipts after source builds by @Hoshino-Yumetsuki in #24098
• Reject repeated SemVer prefixes by @andrew in #24099
• Bound SemVer input length by @andrew in #24100
• Keep fetch source time out of git checkouts by @daeho-ro in #24091
• livecheck: set a timeout for Git tag lookups by @SSakutaro in #24103
• shell: single-quote values for rc by @rawsun007 in #24105
• bump: order npm cooldown versions by semver by @hyuraku in #24097
• sorbet: More T.binds in test formula/caveats blocks by @issyl0 in #24106

New Contributors

• @rseleven made their first contribution in #24061
• @kronikpillow made their first contribution in #24067
• @Hoshino-Yumetsuki made their first contribution in #24098

Full Changelog: 7.0.6...7.0.7

Original source

What's Changed

Reject redundant minimum macOS dependencies by @p-linnane in #24020
Avoid duplicate Caskroom loads in doctor by @joseph1020 in #24026
Fix historical loading and CPANSA fallback by @p-linnane in #24029
Type Style options instead of **options by @dduugg in #24025
Avoid repeated Cask rename migrations during update by @joseph1020 in #24031
Type Formulary options instead of **options by @dduugg in #24032
pypi: resolve non-PyPI sources missing from PyPI by @daeho-ro in #24036
shell: do not wrap an escaped value in double quotes by @rawsun007 in #24035
Allow --formula-list with --new-history by @p-linnane in #24037
sandbox: keep system temp dirs writable in offline installs by @stefanb in #24034
Fix CLT version check on Intel Tahoe by @thiagogenez in #24043
Fix cask_sparkle_min_os audit options handling by @samford in #24039
Avoid rescanning casks when none are outdated by @joseph1020 in #24040
shell: single-quote the profile line before echoing it by @rawsun007 in #24042
Annotate deprecations only when they propagate by @p-linnane in #24045
cask: add pwsh_completion stanza by @AlternateRT in #24046
Caveats: use OnSystem to guard macOS caveats by @samford in #24048
formula: add std_cargo_fetch_args by @chenrui333 in #24051

New Contributors

@joseph1020 made their first contribution in #24026

Full Changelog: 7.0.4...7.0.5

Original source

What's Changed

• formula: skip Java splash screens in macOS tests by @ashr123 in #24005
• Add brew advisory-match --formula-list by @p-linnane in #24007
• Update Ubuntu release cycle link by @MikeMcQuaid in #24012
• shell: emit a PowerShell assignment from export_value by @rawsun007 in #24010
• Avoid sudo for user-local cask app groups by @MikeMcQuaid in #24011
• Derive service completions from Cellar paths by @p-linnane in #24009
• Prefer Homebrew Python for uv tools by @MikeMcQuaid in #24014
• contributions: match co-authored commits made under a real name/email by @iMichka in #23926
• cask: improve consistency of rename handling by @MikeMcQuaid in #24016
• Keep parsed and evaled stdout free of warnings by @MikeMcQuaid in #24015
• pkg: run Git as the installation user by @MikeMcQuaid in #24019
• github_git_download_strategy: fetch when GitHub API is unavailable by @dawidd6 in #24022

Full Changelog: 7.0.3...7.0.4

Original source

What's Changed

Check test-bot dependencies recursively by @MikeMcQuaid in #23981
Gemfiles: require a minimum Ruby version by @p-linnane in #23983
sandbox: pass the terminal to stty by @p-linnane in #23994
install: separate upgrades in dry-run summaries by @p-linnane in #23986
Document VS Code Ruby LSP setup by @HaraldNordgren in #23995
shell: write a literal line into a PowerShell profile by @rawsun007 in #23996
Allow sandboxed icon conversion on macOS by @MikeMcQuaid in #23999
formula: run Java headless in sandboxed phases by @ashr123 in #24001
Share Git facts across platform views and load legacy formulae in history walks by @p-linnane in #23990
Hold prerelease-ambiguous versions in advisory matching by @p-linnane in #23991
Add brew advisory-match --reconcile-history by @p-linnane in #23992
Harden ownership and permissions of cask apps by @MikeMcQuaid in #24003

New Contributors

@ashr123 made their first contribution in #24001

Full Changelog: 7.0.2...7.0.3

Original source

What's Changed

• Change prefix selection documentation and behaviour by @jtbrough in #23959
• Fix typos by @aguashui in #23961
• Update Safari user agent to 27.0 by @samford in #23964
• Fix shorter-prefix Perl bottle relocation by @MikeMcQuaid in #23962
• Populate description caches only on search by @p-linnane in #23965
• shims/super/cc: allow paths under HOMEBREW_FORMULA_BUILDPATH by @woodruffw in #23971
• Verify only trusted files when tapping by @p-linnane in #23972
• Type AbstractSubcommand#args as CLI::Args by @dduugg in #23968
• cleanup: drop an unreachable bottle-version branch by @rawsun007 in #23975
• info: don't over-flag missing deps by @HaraldNordgren in #23960
• Bump portable-ruby to 4.0.7 by @brew-commit-app[bot] in #23974
• Avoid sandbox profile and payload file races by @MikeMcQuaid in #23976
• Fix Sorbet LSP crash from two config dirs by @HaraldNordgren in #23980
• utils/popen: redirect stdin to /dev/null by default on popen_read by @cho-m in #23978

New Contributors

• @jtbrough made their first contribution in #23959
• @aguashui made their first contribution in #23961

Full Changelog: 7.0.1...7.0.2

Original source

Today, I’m proud to announce Homebrew 7.0.0. The most significant changes since 6.0.0 are faster installations and upgrades, stronger sandboxing, a native macOS app, built-in vulnerability checks and an advisory database, the end of macOS 10.15 support and Intel Macs moving to Tier 3.

Contents

• ⬆️ Upgrading
• 🍺 All Homebrew users
  • 🏎️ Performance
  • 🔒 Security
    • Security advisories
    • Installation and tap protection
  • 🔎 Commands and configuration
  • 🗃️ Casks
• 🍎 macOS users
  • 🖥️ Homebrew app
• 🐧 Linux users
• 🍾 Non-default prefix users
• 🔍 Security teams and auditors
• 🐳 Homebrew users in CI
• 🛠️ Tap maintainers
  • 🪜 Install steps
• 🙏 Finally

⬆️ Upgrading

An auto-update or manual brew update (if you have $HOMEBREW_NO_AUTO_UPDATE set) will upgrade Homebrew for you.

Now means 7.0.0. Deprecated interfaces warn until disablement; disabled interfaces reject use and removed interfaces are unavailable.

[Table of environment changes and timings]

🍺 All Homebrew users

The following improvements apply across platforms unless stated otherwise.

🏎️ Performance

Greater concurrency across downloads, preparation and installation maximises performance while coordinating failures and summaries.

• brew install, brew reinstall, and brew upgrade overlap package preparation and downloads, including brew bundle batches, reducing waits between packages and allowing a Brewfile to benefit from the same shared installation work as a command naming several packages.
• brew config gathers independent system details concurrently, so compiler, operating-system and repository checks overlap instead of making diagnostic reports wait for every subprocess in turn.
• brew tap-info --installed --json=v1 collects tap metadata concurrently, shortening inventory requests when several repositories need Git or network checks while preserving the output order expected by scripts.
• brew cleanup avoids repeated cache scans, speeding up cleanup for installations with many packages.
• brew fetch reads download information directly from API metadata for bottles and casks, starting downloads without loading complete package definitions merely to discover URLs and checksums.
• brew update prepares Ruby caches so subsequent commands start faster.
• Homebrew reuses parsed API data on warm runs while verifying signatures on every load, reducing preparation time for repeated package commands without dropping authenticity checks.
• Homebrew launches fewer subprocesses during startup, reducing command overhead, and reads terminal dimensions directly, avoiding hangs with uutils stty.

🔒 Security

Homebrew 7.0.0 includes various security fixes and new installation protections.

Security advisories

The first fixed releases are listed below.

• GHSA-rg9r-ppxp-87hm, High, fixed in 6.0.12: unsigned cask-removal metadata could execute commands with sudo; all vulnerable recovery code and API accessors have been deleted.
• GHSA-5263-whxq-77hp, Moderate, fixed in 7.0.0: a malicious cask could execute code outside the macOS install sandbox through LaunchServices; Homebrew restricts application launching, Mach services, and Unix socket connections.
• GHSA-hqpg-hjr9-c7j8, Moderate, fixed in 6.0.12: the macOS installer ignores prefix-owned Git configuration that could execute programs as root.
• GHSA-x82f-cj53-gqfr, Low, fixed in 6.0.7: brew livecheck restricts redirects to prevent server-side request forgery.
• GHSA-3m5g-jfx7-3p65, Low, fixed in 6.0.7: download redirects cannot forward secret headers to other hosts.
• GHSA-r9gp-p4vv-f93x, Low, fixed in 6.0.6: Git redirects cannot bypass tap restrictions.
• GHSA-9g4r-vmj2-j2gj, Low, fixed in 6.0.7: Subversion external URLs cannot become command options.
• GHSA-r7qx-325v-4ccx, Low, fixed in 6.0.6: patch targets cannot escape the staged source tree.

Installation and tap protection

Tap trust remains the primary protection against malicious third-party casks; sandboxing mainly limits accidental damage and adds installation safeguards. It cannot make untrusted software safe to run: applications execute with the user’s privileges, and vendor .pkg installers run outside the sandbox and may require sudo. We balance tighter restrictions with keeping existing software working.

• Homebrew delivers structured setup as signed data and sandboxes formula and cask operations, reducing arbitrary Ruby execution and repeated package loading.
• Homebrew begins migrating dependency downloads into a fetch phase: migrated formulae download with network access and writable caches, then install disables networking and makes those caches read-only; migration remains ongoing.
• Homebrew blocks sandboxed reads of the home directory by default, keeping unrelated personal files outside package builds while allowing required Homebrew paths; private temporary directories let build tools communicate locally without enabling network access.
• Homebrew rejects mismatched real and effective user IDs before reading configuration, removing untested privilege-switching code for unsupported shared installations.

Trust and environment migrations and replacements.

🔎 Commands and configuration

Commands provide clearer previews, package information and service configuration.

• brew install --dry-run previews formulae and casks together.
• brew list --no-installed-on-request identifies formulae installed as dependencies.
• brew info distinguishes uninstallable packages with ⊘ from uninstalled packages with ✘ and marks unmet operating-system and architecture requirements, making it easier to understand whether a package can run on the current machine before starting an installation.
• brew services reads persistent overrides from $HOMEBREW_USER_CONFIG_HOME/services/.env, allowing local service settings to survive package upgrades and take effect on restart without editing generated service files. New and restarted services use sh.brew. on macOS and Linux, recognising legacy registrations until restart.
• brew bundle restores language tools from declared sources: Cargo Git repositories or paths and source: for remote uv tools.
• brew doctor --json provides structured diagnostics for automation; brew doctor also warns when another brew shadows the current installation in PATH, helping diagnose wrapper and installation conflicts.
• brew deps --brewfile inspects a Brewfile’s dependencies, making it easier to review the packages a development environment will bring in before installing that environment.
• brew untap offers to uninstall a tap’s packages first, allowing an unwanted package source and its installed software to be removed together.
• HOMEBREW_AUTO_UPDATE_QUIET suppresses automatic-update package details, keeping routine command output focused while still allowing Homebrew to update in the background of normal use.
• Homebrew stops exporting its own BUNDLER_VERSION to child processes, allowing formula builds to use their required Bundler version.

Brewfiles record language-tool sources alongside other packages, reducing separate installation instructions when reproducing an environment on another machine.

Command and configuration migrations and replacements.

🗃️ Casks

Formula links take precedence when formulae and casks provide the same commands, with warnings explaining how to restore the cask links.

• brew upgrade skips incompatible casks while upgrading compatible applications; both it and brew outdated honour HOMEBREW_NO_UPGRADE_AUTO_UPDATES_CASKS, preserving self-updating applications’ opt-out.
• brew uninstall removes records for casks missing from the API, warning about possible leftovers, and avoids needless password prompts when files are already owned by the current user.
• brew link and brew unlink accept --cask/--casks and --formula/--formulae, allowing cask binaries, manpages and completions to be disabled or restored without reinstalling; --dry-run previews changes, while brew link --overwrite replaces conflicts and --force replaces only symlinks from the same cask.
• Homebrew’s API includes cask language variants, allowing installation to select the appropriate URL, checksum and artifacts from package data without evaluating the cask’s Ruby definition for each language choice.

Cask configuration migrations and replacements.

🍎 macOS users

Homebrew moves macOS Intel x86_64 to Tier 3 in September 2026, announced in August 2025 and repeated in the 5.0.0 release notes on 12 November 2025; 7.0.0 also drops macOS 10.15.

Homebrew still runs on Intel until September 2027, without project support or routine bottle builds. Apple and GitHub’s retreat from Intel support exceeds what Homebrew’s volunteers can replace.

• brew services run applies per-service environment overrides without registering a login service, making temporary runs use the same configuration as a permanently registered service.
• brew shellenv sets PATH directly, avoiding macOS path_helper subprocesses and configuration-file writes.
• Homebrew moves Intel to Tier 3: existing bottles remain, but updated formulae may require source builds after unreliable infrastructure ended routine Intel bottle updates.
• Homebrew’s .pkg installer is Apple Silicon only and requires macOS Sequoia 15 or later; MacPorts may offer Intel users better binary package coverage.
• Homebrew installs prebuilt casks without Xcode Command Line Tools, removing a compiler dependency from application setup.
• Homebrew fully supports macOS Golden Gate 27, following its bottle rollout; Sequoia 15, Tahoe 26 and Golden Gate 27 are Tier 1 on Apple Silicon.
• Homebrew permits Metal shader compilation inside the macOS sandbox, allowing ggml and whisper.cpp tests to use GPU acceleration without network access.

macOS support migrations

[Table of interface or platform status and replacements]

🖥️ Homebrew app

BrewUI is Homebrew’s fully released official graphical interface for macOS, making package management more approachable through a native application.

• brew install homebrew-app installs BrewUI on macOS Tahoe 26 or later.
• BrewUI brings package browsing, search and installed-version details into one window, making it easier to explore available software and review an existing installation.
• BrewUI shows the underlying brew commands for package operations, keeping the work visible and helping connect graphical actions with familiar terminal commands.

🐧 Linux users

Homebrew 6.0.0 introduced Bubblewrap sandboxing. Homebrew 7.0.0 replaces it with Landlock, requiring no dependencies or escalated Docker permissions, which caused setup problems with Bubblewrap.

Status in 7.0.0: kernels without Landlock continue working without Linux sandboxing in the less secure pre-6.0.0 configuration; brew doctor reports missing protection as an advisory.

• brew config reports the Landlock ABI for troubleshooting.
• Homebrew supports Landlock ABI 2 on Linux 6.1, warning when the kernel cannot enforce network restrictions.
• Homebrew moves AppImages to their application destination, matching macOS .app installations instead of versioned symlinks, so self-updates preserve launchers.

Linux configuration

[Table of interface or platform status and replacements]

🍾 Non-default prefix users

Homebrew relocates compatible bottles to shorter prefixes, avoiding source builds outside the default installation location.

Status in 7.0.0: limits are 13 bytes on Apple Silicon macOS, 26 on Linux and 10 for existing Intel macOS bottles. These count the full path, including slashes; the Cellar must also fit its build-time length. Bottles marked :any or :any_skip_relocation are relocatable to any prefix.

• Homebrew relocates prefix symlinks so they remain usable elsewhere.
• Homebrew records relocation metadata at build time, reducing repeated installation scans and allowing installation to apply the recorded changes instead of rediscovering every embedded path on each machine.

Upcoming rollout: padded builds aim to make every bottle and dependency relocatable to prefixes up to 64 bytes on Apple Silicon macOS and both Linux architectures. This may eventually allow full support within those limits; non-default prefixes remain unsupported for now, with no rollout date.

🔍 Security teams and auditors

Homebrew’s new advisory database records vulnerabilities against the formula versions and revisions Homebrew ships, including backported security fixes.

• brew vulns is built in, checking known vulnerabilities using OSV.dev without another tap or gem.
• brew vulns scans installed formulae and reports untrusted-tap skips, with --severity=high, --deps and --brewfile for focused checks. It prioritises remediation using --fix-available and --no-fix-available and --fix-type for released versus patched fixes and --list-skipped for coverage gaps.
• Homebrew publishes advisory findings in the formula API and a downloadable advisory index, helping other tools distinguish outstanding vulnerabilities from fixes already shipped. The database’s OSV-format records are freely reusable under CC0, giving security teams a shared source of Homebrew-specific vulnerability data.
• Homebrew recognises security patches annotated with resolves, avoiding vulnerability reports for fixes already included in a package.
• Homebrew adds upstream package identifiers to software bills of materials, allowing external tools to connect source archives with registries such as PyPI, npm and Cargo rather than relying only on Homebrew formula names.
• Homebrew verifies attestations for supported third-party tap bottles, extending build-provenance checks beyond homebrew/core when a tap publishes the required attestations.

🐳 Homebrew users in CI

Homebrew images and GitHub Actions provide maintained migration targets.

• brew test-bot --build-dependents-from-source limits source builds to ten dependants per formula per shard, prioritising popular packages, enabling broader Linux source-build coverage while keeping CI runtime manageable.
• Homebrew runs routine Golden Gate dependant tests on GitHub’s xcode-27 runners, reducing reliance on self-hosted infrastructure.
• Homebrew retires the Ubuntu 22.04 image; use the maintained general-purpose image below.
• Homebrew’s versioned actions pin internal dependencies, making workflow upgrades reviewable; migrate @main and removed @master references to releases or full SHAs.
• Homebrew uses Homebrew/actions/setup-ruby with portable-ruby: true in its Ruby workflow, allowing CI jobs to select the same interpreter as Homebrew without depending on internal Ruby entry points.

CI migrations

[Table of interface or platform status and replacements]

🛠️ Tap maintainers

Authoring tools reduce manual setup and encourage safer package definitions.

• brew audit --cask --online --fix corrects macOS requirements and application-name case; brew audit --strict detects downloaded prebuilt npm executables in installed homebrew/core formulae, helping maintainers enforce source-build requirements.
• brew style --fix consolidates platform-specific cask checksums and sorts dependencies, simplifying cross-platform definitions; brew style also rejects broad com.install4j.* uninstall and zap patterns that could affect unrelated applications.
• brew tap-new generates automatic update workflows for new taps, checking upstream versions on a schedule and opening pull requests so maintainers can review updates without manually checking each formula. It also generates attesting bottle-publishing workflows by default, with --no-attestations as an opt-out, helping new taps publish the provenance that Homebrew can verify when their users install bottles.
• brew bump-cask-pr can generate separate Intel and Apple Silicon version stanzas from architecture-specific update results, allowing maintainers to follow upstream applications that release different versions for each architecture without manually rewriting supported root-level definitions.
• brew bump-formula-pr updates Git resources whose version is a commit hash, keeping both the version and pinned revision in sync for projects without release tags.
• brew create generates syntactically valid formula templates, with separate fetch and offline-build phases for Go and Rust to prevent downloads during compilation.
• brew update-python-resources --ignore-main-package-cooldown bypasses only the main package’s cooldown in third-party formulae.
• brew benchmark measures cold and warm install/fetch workloads separately, with --runs= controlling repetitions and --exec supporting custom Hyperfine commands, so contributors can identify whether a change improves fresh downloads, cached installations or command overhead rather than relying on one combined timing.
• brew bump-compatibility-version records changes requiring dependant rebuilds.
• brew formula-python-resources --all/--tap= inventories Python resources, while brew bump-python-resources-pr --packages= opens security updates, with -n/--dry-run, --install-dependencies, --no-fork, --branch=, --message= and --output= supporting automation.
• Homebrew formulae use python3 to select their direct Python dependency without hardcoded interpreter paths.
• Homebrew formulae can declare stop_timeout for services, giving databases and other stateful applications longer to shut down gracefully before the service manager terminates them; stop_timeout 60 sets a one-minute allowance on both macOS and Linux.
• Homebrew’s python_major_minor_version helper supplies the selected Python version, avoiding repeated version-detection code in formula definitions that need versioned paths or arguments.
• Homebrew’s std_go_args(ldflags: :goreleaser) supplies common GoReleaser build metadata, including version, commit and build date, helping upstream applications report useful version information from Homebrew builds without each formula recreating those linker arguments.
• Homebrew formulae and casks can record a human homepage check with homepage ..., browsed: "YYYY-MM-DD", pausing automated availability checks for one year when a site works in browsers but blocks automated requests, while ensuring the manual check has an expiry.
• Homebrew services can use shared package path helpers, allowing service definitions to refer to package locations consistently without duplicating path construction between their commands and environment settings.

🪜 Install steps

Formula post_install and cask *flight Ruby blocks are deprecated in favour of declared *_steps. Explicit operations and paths allow validation, sandboxing and signed API delivery, making setup safer and avoiding repeated package evaluation.

Status in 7.0.0: official taps reject legacy hooks; third-party taps receive warnings until 11 December 2027.

• brew style --fix converts common hooks; manual migrations require rewriting the block’s contents as declared steps, following the Formula Cookbook or Cask Cookbook.
• Homebrew provides structured file operations and configuration writes, preserving common setup without arbitrary Ruby; formula authors describe the intended operation and target, while Homebrew handles validation and execution consistently.
• Homebrew validates serialised steps before execution, giving package authors a defined set of supported operations and allowing API-delivered setup to follow the same rules as locally loaded definitions.

Install hook migrations

[Table of interface or platform status and replacements]

The migration guide lists install-step names, DSLs and public API replacements.

Maintenance command removals and replacements are also documented.

🙏 Finally

• The Intel support decision reflects the limits of a volunteer-run project: Apple have dropped Intel x86_64 support from macOS 27 Golden Gate and GitHub Actions will retire Intel macOS runners in autumn 2027. If Apple and Microsoft’s GitHub, two of the world’s largest technology companies, cannot continue supporting macOS Intel x86_64, sadly neither can Homebrew. MacPorts still supports macOS Intel x86_64 and is likely to provide better results on this platform.
• Homebrew is a non-profit project run entirely by volunteers, not employees. We need your funds to pay for software, hardware and hosting around continuous integration and future improvements to the project. Every donation will be spent on making Homebrew better for our users. Please consider a regular donation through GitHub Sponsors, OpenCollective, and Patreon.
• Homebrew/brew (still) has no open issues at the time of writing, as has been the case for most of the period since Homebrew 6.0.0 🎉.

Thanks to all our hard-working volunteer maintainers, contributors, sponsors and supporters for getting us this far.

Original source

What's Changed

Use quarterly reports for role suggestions by @MikeMcQuaid in #23726
cask/audit: reject verified parameter on all casks by @AlternateRT in #23718
doctor: remove grep_v(String) from JSON output by @hyuraku in #23727
Target Intel Clang under Rosetta by @MikeMcQuaid in #23723
formula: update cargo fetch example by @cho-m in #23728
formula_creator: add deny network to some modes by @cho-m in #23730
formula_creator: add deny network for go and rust by @cho-m in #23734
bump-cask-pr: load modified contents with FromContentLoader by @p-linnane in #23738
bump: avoid overwriting skip message with autobump by @samford in #23737
formula_creator: add deny network for cabal and zig by @cho-m in #23739
Use InfluxDB v3 API for analytics reporting by @SMillerDev in #23620
vulns: correct upstream fix boundaries and add reviewed overrides by @p-linnane in #23736
Fix two dead links in the docs by @rawsun007 in #23744
Report invalid formulae in pr-pull by @MikeMcQuaid in #23746
services: recognize both macOS service labels by @p-linnane in #23741
cask/uninstall: don't quit or signal the host process by @bevanjkay in #23695
sandbox: allow writing xcrun db by @cho-m in #23748
bump-formula-pr: render added version stanzas as string literals by @dduugg in #23751
keg_relocate: contain text relocation to the keg by @dduugg in #23749
keg: fix remove_oldname_opt_records to avoid early return by @cho-m in #23753
rubocops/formula_cop: match array dependency type values by @hyuraku in #23758
generate-cask-ci-matrix: drop macOS Intel CI by @bevanjkay in #23757
formula_creator: remove outdated comment, show resource only for perl by @cho-m in #23745
Stop fetching bottle manifests when creating tabs by @MikeMcQuaid in #23760
pkg: reset installer Git config by @dduugg in #23747
services: default to canonical macOS service labels by @p-linnane in #23750
Add Formula#python3 for the direct Python dependency by @p-linnane in #23754
cask: do not follow a symlinked rmdir path by @dduugg in #23761
Replace some T.nilable(T::Boolean) by @botantony in #23350
cask/cask_loader: recover uninstall artifacts from the signed payload by @dduugg in #23762
formula_creator: add deny network for ruby by @cho-m in #23763
formula: handle --offline in std_cargo_args by @cho-m in #23764
unpack_strategy/zip: move volume labels by basename by @dduugg in #23765
Remove default branch sync workflow by @MikeMcQuaid in #23732
test: cover Utils.safe_filename and .safe_filename? by @rawsun007 in #23773
Install app_image by moving the AppImage, mirroring the app stanza by @waldyrious in #23771
Replace deleted homebrew-cask helper scripts by @bevanjkay in #23672
Add cask audit for versioned app_image targets by @waldyrious in #23777
Move more methods into Utils by @MikeMcQuaid in #23774
Slim down and tighten AGENTS.md by @MikeMcQuaid in #23778
api/formula/formula_struct_generator: defer placeholder replacement by @cho-m in #23780
services: resolve owner from the registered service file by @p-linnane in #23781
Fix shim exec loops and reap timed-out commands by @MikeMcQuaid in #23776
Stop fetching unsigned per-package API data by @MikeMcQuaid in #23772
Remove aggregate test jobs by @MikeMcQuaid in #23785
Move formula Bundler defaults to superenv by @cho-m in #23786
utils/bottles: only trust a padded build prefix from the bottle manifest by @dduugg in #23788
services: recognize both Linux service labels by @p-linnane in #23792
Share Python dependency lookup with Formula#python3 by @p-linnane in #23794
cask: skip cask loader when no casks are installed by @krehel in #23798
pkg: seed the API cache as the install user by @dduugg in #23795
Re-sign node-gyp addons after stripping them by @daeho-ro in #23801
generate-cask-ci-matrix: skip runners the cask is disabled on by @bevanjkay in #23791

New Contributors

@rawsun007 made their first contribution in #23744

Full Changelog: 6.0.21...6.0.22

Original source

What's Changed

Harden build prefix relocation of poured bottles by @MikeMcQuaid in #23667
Harden build prefix relocation of poured bottles by @MikeMcQuaid in #23670
Drop macOS Intel CI in Homebrew/core by @p-linnane in #23677
formula: use -Wno-author in std_cmake_args by @p-linnane in #23676
docs: update brew tap's description by @AlternateRT in #23687
bundle/mac_app_store: Support upcoming mas 8.0.0 by @rgoldberg in #23690
Handle absent cask bundle version suffixes by @MikeMcQuaid in #23688
Speed up and expand integration coverage by @MikeMcQuaid in #23684
Split slow test jobs by @MikeMcQuaid in #23675
rubocops: add CMakeArgs cop by @p-linnane in #23680
Group upgrade dependencies and dependents by @MikeMcQuaid in #23691
Relativise absolute symlinks into the prefix when bottling by @MikeMcQuaid in #23682
Defer the relocated pour validation sweep by @MikeMcQuaid in #23681
Stream parallel cleanup output by @MikeMcQuaid in #23692
github_runner_matrix: use macos-15-intel for Portable Ruby x86_64 by @p-linnane in #23694
advisory-match: sync alias families and reopen reviewed ranges by @p-linnane in #23696
tap: normalise Codeberg remote forms by @AlternateRT in #23697
Break out GitHub Packages downloads per tag by @MikeMcQuaid in #23698
Add padded bottle build prefixes by @MikeMcQuaid in #23693
test/spec_helper: skip missing test tools under brew test-bot by @p-linnane in #23700
extend/pathname: one lstat per entry in compute_disk_usage by @krehel in #23701
rubocops/cask: flag redundant nested on_* blocks by @p-linnane in #23705
audit: add --fix command for casks by @bevanjkay in #23618
Enable shorter-prefix bottle relocation by @MikeMcQuaid in #23699
utils/tty: memoise a failed stty size by @krehel in #23706
formula_auditor: reject Linux libomp dependency in core formula by @cho-m in #23708
rubocops/lines: add cop for jpeg dependency by @cho-m in #23709
rubocops/lines: remove dead syntax by @cho-m in #23710
bundle: require cask/cask_loader before use by @p-linnane in #23716
Never install downloads with checksum mismatches by @MikeMcQuaid in #23717
Reduce Intel macOS to Tier 3 by @p-linnane in #23679
Harden unsigned API, trust, installer and output boundaries by @p-linnane in #23720
Restore brew analytics to the manpage and completions by @dylanpulver in #23721
Verify cached downloads at every consumption boundary by @p-linnane in #23719
release: skip doctor on Tier 3 Intel macOS by @MikeMcQuaid in #23725
Speed up test-bot smoke jobs by @MikeMcQuaid in #23724

New Contributors

@dylanpulver made their first contribution in #23721

Full Changelog: 6.0.20...6.0.21

Original source

What's Changed

generate-zap: resolve apps from package receipts by @loganrosen in #23623
cc shim: compare by canonicalizing both sides, fixing issues with symlinked HOMEs by @averms in #23637
pathname/disk_usage_extension: fix double path traversal by @krehel in #23632
Migrate analytics to brew.sh proxy by @SMillerDev in #23639
Add brew tests --load-only and break the install require cycle by @p-linnane in #23642
Run privileged cask install steps in the parent process by @p-linnane in #23641
Drive bottle pours from relocation metadata by @MikeMcQuaid in #23643
bundle: fail Flatpak entries when flatpak is not installed by @p-linnane in #23648
upgrade: print the fetch heading before prefetching by @bevanjkay in #23640
utils/curl: fix curl_version memoization by @krehel in #23651
livecheck/livecheck: rename some params to formula_or_cask by @cho-m in #23650
Explain Cask Gatekeeper security model by @MikeMcQuaid in #23653
rubocops/cask/url: require each keyword parameter on its own line by @hyuraku in #23654
Check domain age to be > 30 days in auditors by @SMillerDev in #23655
dev-cmd/bump: skip if there is an open bump PR by @cho-m in #23649
cmd/uses: require cask/cask by @botantony in #23660
tapioca/compilers/cask/config: Generate accessors from DEFAULT_DIRS by @p-linnane in #23661
Fix undefined method 'all' for class Cask::Cask in deps command by @middagj in #23663
Add package manager caches and isolate them in CI by @MikeMcQuaid in #23656
Add formula fetch phase run before install by @MikeMcQuaid in #23657
dev-cmd/pr-pull: require cask/cask_loader by @p-linnane in #23664
Check ELF relocatability by structure when bottling by @MikeMcQuaid in #23644
Delete node-gyp debris and strip addons when bottling by @MikeMcQuaid in #23645
Check raw linkage names when bottling by @MikeMcQuaid in #23646
bundle: batch installs where possible by @dduugg in #23659
Require trust for automatic tap migration installs by @felix314159 in #23662

New Contributors

@averms made their first contribution in #23637
@felix314159 made their first contribution in #23662

Full Changelog: 6.0.19...6.0.20

Original source