60
30
60
30
60
60
30
42
55
30
55
30
Homebrew 7.0.0 Adds Built-In Vulnerability Scanner and Stronger Package Sandboxing
Homebrew 7.0.0 ships a native brew vulns scanner, OSV-backed advisory database, stronger sandboxing, and fixes a sandbox-escape issue.
Homebrew 7.0.0 introduces a built-in 'brew vulns' command that scans installed formulae, dependencies, and Brewfiles against a new Homebrew-specific advisory database and OSV.dev data, distinguishing backported fixes from outdated versions. The release hardens sandboxing by blocking home-directory reads during builds, disabling network access at install time, and replacing Bubblewrap with Landlock on Linux. It also fixes moderate-severity GHSA-5263-whxq-77hp, where a malicious cask could execute code outside the macOS sandbox via LaunchServices, and drops macOS Catalina while moving Intel Macs to Tier 3.
35
42
42
55
57
30
30
30
30
30
30
42
55
55
42
60
60
60
30
30
30
30
30
30
Homebrew 7.0.0 gets built-in GUI, better security controls
Homebrew 7.0.0 adds a built-in vulnerability scanner (brew vulns), a Homebrew advisory database, stronger sandboxing, and the BrewUI GUI.
Homebrew 7.0.0 ships a native BrewUI graphical interface for macOS 26 Tahoe and later, plus a new 'brew vulns' command that queries OSV.dev in batch to flag vulnerabilities in installed formulae, specific packages, or Brewfile dependencies. The release also introduces a Homebrew-specific OSV-format advisory database distinguishing outstanding vulnerabilities from backported fixes. Sandbox improvements block home directory access by default and separate network-enabled dependency downloads from offline installs.
40
60
30
30