Homebrew 7.0.0

Date: 13 September 2026
Author: MikeMcQuaid

I am thrilled to officially unveil Homebrew 7.0.0.

Since the release of version 6.0.0, we have implemented several pivotal enhancements. The most notable include accelerated installation and upgrade speeds, more robust sandboxing, the introduction of a native macOS application, and a built-in advisory database for vulnerability scanning. Additionally, we are supporting macOS 10.15 ending support for macOS 10.15, and Intel-based Macs are transitioning to Tier 3.

---

📋 Table of Contents

• Upgrading
• General Improvements
• Performance Boosts
• Security Enhancements
• Environment Changes
• Installation Protections

---

⬆️ Upgrading <a name="upgrading"></a>

Your Homebrew installation will update automatically. If you have configured $HOMEBREW_NO_AUTO_UPDATE, you can trigger the process manually via:

brew update

The Deprecation Lifecycle

Homebrew follows a strict path for removing old interfaces:

1. Deprecated: Users receive a warning.
2. Disabled: Use is rejected.
3. Removed: The interface is completely unavailable.

🛠️ Environment Transition Matrix <a name="environment-changes"></a>

---

🍺 All Homebrew Users <a name="all-homebrew-users"></a>

The following updates are global across all supported platforms.

🏎️ Performance <a name="performance"></a>

We have focused on maximizing throughput by increasing concurrency during the download, preparation, and installation phases.

Key Optimizations:

• Overlapping Workflows: brew install, brew reinstall, and brew upgrade now overlap package preparation with downloads. This includes brew bundle batches, meaning a Brewfile now shares installation work similarly to a command listing multiple packages.
• Concurrent Diagnostics: brew config now runs system checks (compiler, OS, repo) in parallel.
• Faster Metadata: brew tap-info --installed --json=v1 collects data concurrently while maintaining the output order required by scripts.
• Efficient Cleanup: brew cleanup no longer performs redundant cache scans.
• Direct API Access: brew fetch utilizes API metadata for bottles and casks to start downloads immediately, bypassing the need to load full package definitions first.
• Startup Speed:
  • brew update now pre-caches Ruby.
  • Parsed API data is reused on "warm" runs (though signatures are always verified).
  • Reduced subprocess spawning during boot.
  • Terminal dimensions are read directly to prevent uutils stty hangs.

Concurrency Logic

The time to complete a batch installation can be simplified as: $T_{total} \approx \max(T_{download}, T_{preparation}) + T_{installation}$

---

🔒 Security <a name="security"></a>

Homebrew 7.0.0 introduces critical security patches and new safeguards for the installation process.

Security Advisories

The following vulnerabilities have been addressed:

• GHSA-rg9r-ppxp-87hm (High): Fixed in 6.0.12. Removed vulnerable recovery code and API accessors that allowed unsigned cask-removal metadata to execute sudo commands.
• GHSA-5263-whxq-77hp (Moderate): Fixed in 7.0.0. Restricted application launching, Mach services, and Unix sockets to prevent malicious casks from escaping the macOS sandbox via LaunchServices.
• GHSA-hqpg-hjr9-c7j8 (Moderate): Fixed in 6.0.12. Fixed an issue where the macOS installer ignored prefix-owned Git configs, potentially allowing root execution.
• GHSA-x82f-cj53-gqfr (Low): Fixed in 6.0.7. brew livecheck now restricts redirects to mitigate SSRF.
• GHSA-3m5g-jfx7-3p65 (Low): Fixed in 6.0.7. Secret headers are no longer forwarded during download redirects.
• GHSA-r9gp-p4vv-f93x (Low): Fixed in 6.0.6. Git redirects can no longer bypass tap restrictions.
• GHSA-9g4r-vmj2-j2gj (Low): Fixed in 6.0.7. Subversion external URLs are prevented from becoming command options.
• GHSA-r7qx-325v-4ccx (Low): Fixed in 6.0.6. Patch targets are now confined to the staged source tree.

Installation and Tap Protection <a name="installation-and-tap-protection"></a>

While sandboxing provides a safety net against accidental damage, tap trust remains the primary defense against malicious third-party software.

Warning: Sandboxing does not make untrusted software "safe." Applications still run with user privileges, and .pkg installers operate outside the sandbox and may request sudo access.

New Protections include:

• Signed Setup: Homebrew now uses signed data for structured setup.
• Operation Sandboxing: Formula and cask operations are sandboxed to limit arbitrary Ruby execution.
• Phase Separation: We are migrating to a two-step process:
  1. Fetch Phase: Network access enabled $\rightarrow$ Writable caches.
  2. Install Phase: Networking disabled $\rightarrow$ Read-only caches.
• Privacy: By default, sandboxed processes are blocked from reading the user's home directory to protect personal files.