Homebrew 7.0.0 arrived on September 13 with a release that matters well beyond routine package updates. The popular macOS and Linux package manager now includes a built-in vulnerability scanner, a Homebrew-specific advisory database, stronger installation sandboxing, and the full release of BrewUI, its native macOS app.
For individual developers, the immediate change is simple: Homebrew can now report known vulnerabilities in installed formulae without requiring a separate tap, gem, or third-party script. For IT and security teams that manage developer Macs, the release turns Homebrew into a more visible part of endpoint inventory, patch planning, and software supply-chain review.
The project’s official 7.0.0 release notes list faster installs and upgrades, stronger sandboxing, built-in vulnerability checks, an advisory database, the new Mac app, the end of macOS 10.15 support, and Intel Macs moving to Tier 3. Security coverage from Help Net Security and BleepingComputer also highlights why this is a practical security release, not just a convenience upgrade.
The new command to run first
The headline feature for security teams is brew vulns. Homebrew says the command checks installed formulae against known vulnerabilities using OSV.dev, with no extra tap or gem required. The new advisory database records vulnerabilities against the formula versions and revisions Homebrew actually ships, including cases where Homebrew has backported security fixes.
That Homebrew-specific mapping is important. A generic vulnerability scan can flag an upstream package version as vulnerable even when a distribution or package manager has already patched its build. Homebrew’s database is intended to help distinguish packages that still need action from packages that include fixes under the same upstream version line.
Developers can start with a normal update and scan:
brew update
brew upgrade
brew vulnsFor triage, Homebrew documents flags such as --severity=high, --deps, --brewfile, --fix-available, --no-fix-available, --fix-type, and --list-skipped. The practical workflow is to scan what is installed, prioritize issues with available fixes, and pay attention to skipped packages from untrusted taps because those are visibility gaps rather than clean bills of health.
Why Homebrew tightened installs
Homebrew 7.0.0 also lands with several security advisories closed across the 6.0.x and 7.0.0 line. The most serious was a high-severity issue fixed in 6.0.12 where unsigned cask-removal metadata could run commands with sudo. Another moderate issue fixed in 7.0.0 involved a malicious cask escaping the macOS install sandbox through LaunchServices.
The project’s answer is not to pretend sandboxing makes arbitrary software safe. Homebrew is explicit that applications still run with the user’s privileges, and vendor .pkg installers can run outside the sandbox and may require administrator privileges. The stronger controls are about reducing what package definitions, install steps, redirects, and build processes can do before the user knowingly runs the installed software.
Two changes stand out for teams with stricter endpoint controls. Homebrew is delivering more setup behavior as signed structured data instead of arbitrary Ruby evaluation, and it is deprecating formula post_install blocks and cask flight blocks in favor of declared install steps. Official taps already reject the legacy hooks; third-party taps get warnings until December 11, 2027.
That gives tap maintainers a migration runway, but it also gives companies a useful review question: which developer machines depend on third-party taps that still use older executable hooks? The answer matters because Homebrew’s official taps and a random private tap should not carry the same trust assumptions.
BrewUI changes the admin conversation
BrewUI, Homebrew’s official native macOS app, is now fully released. It can be installed with brew install homebrew-app on macOS Tahoe 26 or later, according to the release notes, and brings browsing, search, installed-version details, and package operations into a graphical interface.
The useful design choice is that BrewUI shows the underlying brew commands for package operations. That matters in environments where admins are trying to make GUI-driven work understandable, auditable, and teachable. A user can discover software in the app while still seeing the terminal action Homebrew will perform.
For managed Macs, BrewUI is also a policy prompt. If an organization already allows Homebrew, the app may help less terminal-heavy users keep packages visible and updated. If Homebrew is unofficially tolerated but not managed, BrewUI makes that gap harder to ignore. Teams should decide whether BrewUI belongs in their app catalog, whether it should be blocked, and how Homebrew inventory fits into MDM, EDR, and vulnerability-management reporting.
The migration items to check now
The Homebrew 7.0.0 migration guide is worth reading before updating scripts, Brewfiles, and CI jobs. Several interfaces are disabled or removed now, while others have future deadlines.
- macOS Catalina 10.15 and earlier are no longer supported.
- Intel macOS has moved to Tier 3, with no new bottles; Homebrew says Intel support ends September 1, 2027.
- macOS Sonoma 14 is Tier 3; Homebrew recommends Sequoia 15 or later for bottles and
.pkginstalls. Homebrew/actions/*@masteris removed in GitHub Actions workflows; jobs should pin a versioned release or full SHA.- The
Homebrew/brewmasterbootstrap is frozen and scheduled for removal on March 1, 2027. - Legacy formula and cask install hooks are deprecated until December 11, 2027.
Linux users get a meaningful sandboxing change too. Homebrew 7.0.0 replaces Bubblewrap with Landlock where available, reducing dependency and container-permission friction. Systems without usable Landlock continue to work without Linux sandboxing, and brew doctor reports that as an advisory.
What developers and security teams should do
The safest first step is not complicated: update Homebrew, run brew vulns, and document what the command does and does not cover in your environment. A clean result from Homebrew’s scanner should be treated as one signal, not a full endpoint assessment, especially when third-party taps, manually installed apps, language-specific package managers, and vendor installers sit outside the same visibility boundary.
Mac admins should also review third-party taps, Brewfiles, and onboarding scripts. Look for removed flags, legacy GitHub Actions references, Intel Mac assumptions, and package sources that were added once and never reviewed again. Homebrew’s newer trust, sandboxing, and advisory features are most valuable when teams stop treating every tap and cask as equally safe.
For developers, Homebrew 7.0.0 is a reminder that the local package manager is part of the software supply chain. It installs compilers, runtimes, databases, shells, cloud CLIs, security tools, and desktop apps that often touch credentials and production systems. A built-in scanner will not remove that risk, but it makes routine package hygiene easier to perform and harder to postpone.
