Homebrew 7.0.0 Adds Built-In Vulnerability Scanner and Stronger Package Sandboxing

Homebrew has released version 7.0.0, introducing a native vulnerability scanner, a Homebrew-specific advisory database, stronger sandboxing, and faster package installation workflows.

The release also ends support for macOS Catalina 10.15 and moves Intel-based Macs to Tier 3 support. The most security-focused addition is the new brew vulns command.

It allows users and security teams to scan installed formulae for known vulnerabilities without installing a separate tap or Ruby gem. The command uses Homebrew’s new advisory database and OSV.dev vulnerability data to identify affected packages.

The scanner can check installed formulae, dependencies, and Brewfiles. Users can filter findings by severity, view packages with available fixes, identify vulnerabilities that have no current remediation, and list packages skipped because they came from untrusted taps.

Homebrew 7.0.0 Adds Vulnerability Scanner

This makes the command useful for developer workstations, CI pipelines, security audits, and software inventory reviews. Homebrew’s advisory database is designed to track vulnerabilities against the exact formula versions and revisions distributed by Homebrew.

This is important because Homebrew may backport a security patch without updating a package to the newest upstream version. The database can therefore help distinguish between a package that appears outdated and one that has already received a fix.

Homebrew also publishes advisory data through its formula API and a downloadable OSV-format index. The release strengthens package isolation on both macOS and Linux. On macOS, Homebrew now further restricts formula and cask operations inside its sandbox.

It blocks sandboxed reads from the user’s home directory by default, reducing the chance that a package build can access unrelated personal files. It also introduces private temporary directories for local build-tool communication without enabling network access.

Homebrew is also moving dependency downloads into a separate fetch phase. During fetching, packages can use network access and writable caches.

During installation, network access is disabled, and caches become read-only. This design reduces the risk of unexpected downloads or external network activity during a package build.

The update fixes a moderate-severity issue tracked as GHSA-5263-whxq-77hp. A malicious cask could potentially execute code outside the macOS installation sandbox through LaunchServices. Homebrew 7.0.0 restricts application launching, Mach services, and Unix socket connections to address the issue.

For Linux users, Homebrew replaces Bubblewrap sandboxing with Landlock. The project said Landlock avoids dependency and elevated Docker permission requirements that caused deployment issues with Bubblewrap. Systems without Landlock can still run Homebrew, but brew doctor will report the missing sandbox protection.

Homebrew 7.0.0 also improves performance by overlapping downloads, package preparation, and installation tasks. It reuses parsed API data while continuing to verify signatures, reduces startup subprocesses, and speeds up cleanup, fetch, update, and diagnostic commands.

macOS Catalina 10.15 is no longer supported. Intel Macs are now Tier 3, meaning they will not receive new prebuilt bottles and may need source builds for updated formulae. Homebrew plans to stop running on Intel Macs in September 2027.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.