Homebrew 7.0.0 ships faster installs and a native macOS app

Homebrew, the macOS and Linux package manager, released version 7.0.0. The announcement on brew.sh describes faster installations and upgrades, stronger sandboxing, a native macOS app, built-in vulnerability checks and an advisory database, the end of macOS 10.15 support, and the move of Intel Macs to Tier 3 as the most significant changes since Homebrew 6.0.0.

On performance, Homebrew now overlaps package preparation and downloads instead of running them one after another. brew install, brew reinstall and brew upgrade run downloads and preparation concurrently, including for brew bundle batches, so a Brewfile installing several packages shares the same installation work as a single multi-package command. brew config gathers compiler, operating-system and repository details concurrently rather than waiting on each subprocess in turn; brew tap-info --installed --json=v1 collects tap metadata concurrently while keeping the output order scripts expect; brew cleanup stops repeated cache scans; and brew fetch reads download URLs and checksums straight from API metadata instead of loading complete package definitions. Homebrew also launches fewer subprocesses at startup and reuses parsed API data on warm runs while still verifying signatures on every load.

The release notes list eight security advisories fixed across recent versions. The most severe, GHSA-rg9r-ppxp-87hm (High), let unsigned cask-removal metadata execute commands with sudo; it was fixed in 6.0.12, and the vulnerable recovery code and API accessors were deleted outright. GHSA-5263-whxq-77hp (Moderate), fixed in 7.0.0 itself, let a malicious cask execute code outside the macOS install sandbox through LaunchServices; Homebrew now restricts application launching, Mach services and Unix socket connections. The remaining six advisories, rated Moderate or Low, cover issues including a root-privileged Git configuration bug in the macOS installer and unsafe redirect handling in brew livecheck, downloads, Git, Subversion and patch targets. Homebrew is explicit that tap trust, not sandboxing, remains the primary defense against a malicious third-party cask: sandboxing mainly limits accidental damage, cannot make untrusted software safe to run, applications still execute with the user's own privileges, and vendor .pkg installers run outside the sandbox and may require sudo.

Homebrew now delivers structured setup as signed data and sandboxes formula and cask operations to cut down on arbitrary Ruby execution. It is migrating dependency downloads into a separate fetch phase: migrated formulae download with network access and writable caches, then install with networking disabled and those caches made read-only; the migration is still ongoing. By default, sandboxed builds can no longer read the home directory, though required Homebrew paths stay accessible, and private temporary directories let build tools communicate locally without network access. A new advisory database records vulnerabilities against the exact formula versions and revisions Homebrew ships, including backported fixes, and the built-in brew vulns command checks installed formulae against it using OSV.dev, without needing another tap or gem; it also reports skips for untrusted taps and supports a --severity=high flag.

Homebrew now ships BrewUI, described in the release notes as its fully released official graphical interface for macOS. It installs with brew install homebrew-app on macOS Tahoe 26 or later, and brings package browsing, search and installed-version details into one window while still showing the underlying brew commands behind each graphical action.

On Linux, 7.0.0 replaces the Bubblewrap sandbox that Homebrew 6.0.0 introduced with Landlock, which needs no extra dependencies or elevated Docker permissions, the setup problems Bubblewrap had caused. Homebrew supports Landlock ABI 2 on Linux 6.1 and warns when a kernel cannot enforce network restrictions; on kernels without Landlock support at all, Homebrew keeps working without Linux sandboxing, in the same less secure configuration that predates 6.0.0.

Homebrew is dropping macOS 10.15 support in 7.0.0 and moving Intel Mac (x86_64) support to Tier 3 in September 2026, a change first announced in August 2025 and repeated in the 5.0.0 release notes on 12 November 2025. Existing Intel bottles remain available, but updated formulae may need source builds after unreliable infrastructure ended routine Intel bottle updates, and Homebrew says it will keep running on Intel, without project support or routine bottle builds, only until September 2027. The project frames the move as following Apple and GitHub's own retreat from Intel support, which it says has gone further than its volunteer maintainers can replace.

For users who install Homebrew outside its default location, 7.0.0 sets byte limits on how long a non-default prefix path can be: 13 bytes on Apple Silicon macOS, 26 bytes on Linux, and 10 bytes for existing Intel macOS bottles, counting the full path including slashes, with the Cellar itself also needing to fit its build-time length. Bottles marked :any or :any_skip_relocation can relocate to any prefix, and Homebrew now records relocation metadata at build time so installs apply it directly instead of rescanning every embedded path on each machine. An upcoming padded-build format aims to make every bottle and dependency relocatable to prefixes up to 64 bytes on Apple Silicon macOS and both Linux architectures; Homebrew says this may eventually allow full non-default-prefix support within those limits, but for now such prefixes remain unsupported, with no rollout date given.

Key facts

• Homebrew 7.0.0 overlaps downloads and package preparation across brew install, reinstall, upgrade and bundle, and parallelizes brew config and brew tap-info to cut wait times.
• A new advisory database plus the built-in brew vulns command check installed formulae for known vulnerabilities via OSV.dev, with no separate tap or gem needed.
• Eight security advisories are listed as fixed, from High-severity GHSA-rg9r-ppxp-87hm (sudo command execution via unsigned cask-removal metadata, fixed in 6.0.12) to Moderate-severity GHSA-5263-whxq-77hp (sandbox escape via LaunchServices, fixed in 7.0.0).
• BrewUI, called Homebrew's fully released official graphical interface for macOS, installs via brew install homebrew-app on macOS Tahoe 26 or later.
• On Linux, 7.0.0 replaces the Bubblewrap sandbox from 6.0.0 with Landlock; Homebrew also drops macOS 10.15 support and moves Intel Macs to Tier 3 in September 2026, with Intel support ending entirely in September 2027.

Why it matters

7.0.0 is framed as the largest jump since Homebrew 6.0.0, bundling three separate improvements that usually ship apart: measurable speed gains from concurrent downloads and preparation, a hardened default security posture (signed setup data, a fetch/install network split, a new advisory database with a built-in scanner), and a native graphical app, BrewUI, aimed at users who would rather browse packages than type commands. Together they push Homebrew from a command-line-only tool toward a package manager with a supported GUI and its own vulnerability-tracking infrastructure.

Who it affects

macOS users on Apple Silicon get the native BrewUI app and stay on Tier 1 support (Sequoia 15, Tahoe 26 and the upcoming Golden Gate 27). Intel Mac users move to Tier 3 support starting September 2026 and lose routine bottle builds, though installs keep working until September 2027. Linux users switch from Bubblewrap to Landlock sandboxing, with kernels lacking Landlock falling back to no sandboxing at all. Security teams and auditors gain the new advisory database and brew vulns command. Users running Homebrew from a non-default install path, tap maintainers and CI users each get their own set of changes described in the release notes.

How to use it

Homebrew upgrades itself automatically, or manually via brew update when auto-update is disabled with $HOMEBREW_NO_AUTO_UPDATE. BrewUI installs separately with brew install homebrew-app, and requires macOS Tahoe 26 or later. Vulnerability scanning runs through the built-in brew vulns command, which supports a --severity=high flag and needs no additional tap or gem. Deprecated command interfaces keep working with a warning, disabled interfaces reject use, and removed interfaces are gone entirely, so scripts relying on older flags should check the release notes before upgrading.

How solid is it

The source is Homebrew's own official release announcement on brew.sh, written in the first person by a project maintainer. It names specific commands, GHSA advisory identifiers, severities, fix versions and exact byte limits rather than speaking in generalities, which supports its credibility as a primary source. It is also candid about limits: several changes, such as the fetch/install network split and full non-default-prefix support, are explicitly described as still in progress rather than finished. Our retrieval stopped mid-sentence partway through the security section, so later sections, including one on tap maintainers, were not available for this retelling; that gap belongs to our retrieval, not to the announcement, which is complete on brew.sh.

Risks and caveats

Homebrew is explicit that sandboxing is not a safety guarantee: tap trust remains the primary protection against a malicious cask, sandboxing mainly limits accidental damage, and it cannot make untrusted software safe to run, since applications still execute with the user's own privileges and vendor .pkg installers run outside the sandbox and may require sudo. On Linux kernels without Landlock support, Homebrew runs with no sandboxing at all, in the same less secure configuration that predates version 6.0.0. Intel Mac users face a fixed end date, September 2027, after which Homebrew provides no project support or routine bottle builds. Non-default install prefixes remain tightly limited by byte count, and the planned fix, padded builds up to 64 bytes, has no announced rollout date.

“It cannot make untrusted software safe to run: applications execute with the user's privileges, and vendor .pkg installers run outside the sandbox and may require sudo.”

— Homebrew, 7.0.0 release notes