Security and performance lead the release
Homebrew has released version 7.0.0 of its package manager with faster installation workflows, built-in vulnerability reporting and changes to sandboxing on Linux. The project describes the update as its largest set of changes since version 6, spanning package installation, developer tooling and support policy for older Apple hardware.
The new `brew vulns` command checks installed formula versions against a Homebrew advisory database using data from OSV.dev. The project says its database accounts for the exact versions and revisions it ships, including security fixes that maintainers have backported. The feature is integrated into the main tool rather than requiring an additional tap or Ruby package.
Homebrew also changed its Linux sandbox from Bubblewrap to Landlock. According to the release notes, the newer approach avoids extra dependencies and elevated Docker permissions that complicated the previous setup. Linux kernels without Landlock can still run Homebrew, but without the sandbox protection introduced in version 6; `brew doctor` will identify that condition as an advisory.
The project cautions that sandboxing does not make untrusted software safe. Applications installed through Homebrew still run with the user’s privileges, and vendor package installers may execute outside the sandbox and request administrator authorization. Homebrew continues to describe trust in the source of third-party taps and casks as the main defense against malicious packages.
Platform support shifts
Version 7 ends support for macOS 10.15 Catalina and moves Intel-based Macs to Tier 3. Homebrew says the software should continue running on Intel hardware until September 2027, but the project will no longer provide normal support or routinely build binary bottles for that architecture. It attributes the change to Apple and GitHub reducing their own Intel support beyond what a volunteer project can replace.
The release also makes BrewUI, Homebrew’s official native macOS graphical interface, generally available. It is intended to make package discovery and management more approachable while retaining the existing command-line workflow. On the installation side, greater concurrency across downloads, preparation and installation is designed to reduce waiting while coordinating failures and summaries.
Homebrew is additionally working toward more relocatable binary packages. Version 7 can move compatible bottles into shorter installation prefixes, avoiding some source builds outside default locations. The current path-length limits vary by platform, and non-default prefixes remain unsupported. A future padded-build process is intended to extend relocation to prefixes up to 64 bytes, though the project has not announced a rollout date.
For package authors, legacy Ruby installation hooks in official taps are being replaced by declared steps that are easier to validate, sandbox and distribute through signed APIs. Third-party taps receive warnings before the old hooks are scheduled to stop working in December 2027. Existing users can receive version 7 through Homebrew’s automatic update mechanism or run `brew update` manually.
