Homebrew 7.0.0: Built-in Vulnerability Scanning, a Sandbox, and Farewell to Intel

The developers of Homebrew, the package manager for macOS and Linux, have unveiled the 7.0.0 release. According to maintainer Mike McQuaid, the key changes since version 6.0.0 are faster installation and upgrades, stricter isolation, a native macOS app, built-in vulnerability scanning with a database, the end of support for macOS 10.15, and the move of Intel-based computers to the third support tier.

Speed and Security

The brew install, reinstall, and upgrade commands now combine downloading and preparing packages, cutting the idle time between them; sets defined in a Brewfile benefit too. A warm start reuses already-parsed API data, while signatures are still verified on every download.

A separate section is devoted to security. A number of vulnerabilities have been closed — including a high-severity one in which unsigned cask uninstall metadata could execute commands via sudo. Operations on formulae and casks now run in a sandbox, and reading the home directory is blocked by default so that stray personal files don't end up in a build. That said, the authors are candid: the sandbox doesn't make untrusted software safe — apps run with the user's privileges, and vendors' .pkg installers operate outside the isolation.

Vulnerability Scanning and the App

There is now a dedicated vulnerability database and a built-in brew vulns command, which checks installed formulae through OSV.dev without any extra taps or gems. The entries are published in OSV format under the CC0 license, so security teams are free to reuse them.

For those who prefer a graphical interface, there's an official BrewUI app (it installs on macOS Tahoe 26 and newer). It offers searching and browsing packages in a single window and shows exactly which brew commands are being run behind the scenes.

Linux and the End of the Intel Era

On Linux, instead of Bubblewrap — which caused headaches with configuration and permissions under Docker — Landlock is now used; it requires no dependencies or elevated privileges. Kernels without Landlock will keep working, but with no isolation.

The main sad news concerns Intel. Homebrew is moving its monitoring of macOS on Intel to Tier 3: the old builds will remain, there will be no new binary packages, and support will end entirely on September 1, 2027. The reason is simple: Apple removed Intel support from macOS 27 Golden Gate, and in the fall of 2027 GitHub Actions will decommission its Intel runners. If the two largest IT companies can't keep up support, a volunteer project can't manage it either — Intel users are advised to switch to MacPorts.

Homebrew remains a non-commercial, enthusiast-driven project and is a reminder about donations. And, as it happens, it proudly notes that the repository's open issues, as for almost the entire time since 6.0.0, still number zero.

Source: Hacker News