Homebrew 7.0.0 Adds Built-In Vulnerability Scanner and Stronger Package Sandboxing
Homebrew 7.0.0 ships a native brew vulns scanner, OSV-backed advisory database, stronger sandboxing, and fixes a sandbox-escape issue.
Homebrew 7.0.0 introduces a built-in 'brew vulns' command that scans installed formulae, dependencies, and Brewfiles against a new Homebrew-specific advisory database and OSV.dev data, distinguishing backported fixes from outdated versions. The release hardens sandboxing by blocking home-directory reads during builds, disabling network access at install time, and replacing Bubblewrap with Landlock on Linux. It also fixes moderate-severity GHSA-5263-whxq-77hp, where a malicious cask could execute code outside the macOS sandbox via LaunchServices, and drops macOS Catalina while moving Intel Macs to Tier 3.
- brew vulns scans formulae, dependencies, and Brewfiles via OSV.dev data
- Sandbox blocks home-directory reads and network during installation
- Fixes GHSA-5263-whxq-77hp: malicious cask escaped sandbox via LaunchServices
- Linux sandboxing switches from Bubblewrap to Landlock
- macOS Catalina dropped; Intel Macs moved to Tier 3 support
From the original article
2 min read at cybersecuritynews.com
Homebrew has released version 7. 0. 0, introducing a native vulnerability scanner, a Homebrew-specific advisory database, stronger sandboxing, and faster package installation workflows.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.