Homebrew 7.0.0 is officially out, bringing major security upgrades: a built-in vulnerability scanner, a Homebrew-specific advisory database, enhanced sandbox isolation, and better performance across package workflows.
What’s New in Homebrew’s Security Model
The standout feature in version 7.0.0 is brew vulns, a built-in command that scans installed formulae, dependencies, and Brewfiles for known vulnerabilities. Users no longer need external taps or Ruby gems to assess risk. The command leverages a new advisory database from Homebrew itself, alongside OSV.dev data, to accurately flag affected packages. Filters let you view results by severity, see which packages have fixes, identify unremediated flaws, or spot issues skipped due to untrusted sources.
Under the hood, Homebrew’s advisory database tracks vulnerabilities down to the specific formula version or revision distributed by Homebrew. That’s key when patches get backported without bumping upstream version numbers. The advisory data is accessible via Homebrew’s formula API and also available as a downloadable OSV-format index.
Sandboxing & Build Process Tightened Up
On macOS and Linux, package builds are now much more isolated. macOS formula and cask operations inside the sandbox have been tightened: reads from the user’s home directory are blocked by default, temporary directories for internal build tools are made private, and network access is disabled during the installation phase. Caches also become read-only during build to prevent unauthorized writes.
Homebrew has shifted dependency downloads to a separate fetch phase, where network access is permitted and writable caches are available. Once the install phase begins, however, network privileges are cut off, and caches locked down. On Linux, Landlock replaces Bubblewrap for sandboxing. This reduces dependency-and-permission issues seen with Bubblewrap. Systems lacking Landlock will still run Homebrew, but brew doctor will warn of sandbox feature absence.
Also addressed is a moderate-severity vulnerability (GHSA-5263-whxq-77hp) that could let a malicious cask break out of the macOS installation sandbox using LaunchServices. The update revokes permissions for LaunchServices, Mach services, and Unix socket connections to curb this risk.
Deprecations, Support Changes, and Performance Gains
Homebrew 7.0.0 drops compatibility with macOS Catalina (10.15). Intel-based Macs are now relegated to Tier 3 support — prebuilt binaries (“bottles”) may no longer be available, forcing source builds. A full end of support for Intel Macs is scheduled for September 2027.
Performance tweaks include overlapping tasks across download, preparation, and installation stages. Startup overhead is trimmed via reduced subprocess spawning, API data parsing is reused, and various commands like fetch, update, and diagnostics are faster. Overall workflow speed sees noticeable improvements.
The vulnerability scanner is useful both for individual developers and organizations: whether auditing workstations, enforcing compliance in CI/CD pipelines, or maintaining software inventory. Stronger sandboxing and tighter controls during build/install phases reflect rising demand for supply-chain and build security in open source ecosystems.
