Homebrew 6.0.0 Release Notes

Homebrew 6.0.0 introduces enhanced security and performance

Homebrew 6.0.0 focuses on mitigating supply-chain risks through a new tap trust mechanism and Linux sandboxing, while significantly improving update speeds via a new default internal JSON API. The release also introduces initial support for macOS 27 (Golden Gate) and expands brew bundle capabilities.

Security Enhancements

Tap Trust Mechanism

Homebrew 6.0.0 implements a mandatory trust model for third-party taps to prevent the execution of arbitrary, unsandboxed Ruby code. Taps and tap-qualified formulae or casks must now be explicitly trusted before their code is evaluated or run. Official Homebrew taps remain trusted by default.

Key technical changes include:

  • Enforcement: Untrusted taps are flagged before code execution, and auto-tapping of untrusted taps is disabled.
  • Management: New brew tap commands allow users to manage trust, including trusting taps via remote URLs.
  • Integration: brew bundle now honors a trusted: option, and brew bundle dump records trusted entries.

Linux Sandboxing

To align Linux with macOS, Homebrew now utilizes the Bubblewrap sandbox for build, test, and postinstall phases. This is currently enabled by default for developers. The implementation includes hardened install phases and sandboxed cask executable hooks.

Security Advisories and Fixes

This release addresses three critical security vulnerabilities:

  • GHSA-7699-qf8c-q47m: Fixed a bypass in the POST download strategy that allowed HTTPS-to-HTTP redirect protection to be ignored.
  • GHSA-6689-q779-c33m: Resolved a root code execution vulnerability via Git hooks in the macOS .pkg postinstall.
  • GHSA-59v8-x8q4-px5c: Fixed a vulnerability where the macOS installer package trusted a user-controlled /var/tmp plist, potentially allowing local attackers to assign Homebrew ownership.

Performance and Infrastructure

Default Internal JSON API

The internal JSON API is now the default, replacing the previous opt-in system (HOMEBREW_USE_INTERNAL_API is now deprecated). By combining metadata into a single download, Homebrew reduces network requests and accelerates the update process.

General Speed Improvements

Users will notice faster performance across several areas:

  • Startup: Tweaks to Ruby library loading and general startup logic.
  • Command Speed: brew leaves is approximately 30% faster.
  • Upgrade Process: Parallelized bottle tab fetching during upgrades.

Feature Updates

brew bundle Improvements

brew bundle has received significant functional expansions:

  • Parallel Installation: Formula installation now runs jobs in parallel by default.
  • New Extensions: Added support for npm, krew, and Windows winget.
  • Enhanced Cleanup: Added cleanup support for npm, cargo, go, and uv extensions.

User Experience and Defaults

Based on a user survey, Homebrew has changed several defaults to be more transparent:

  • Ask Mode: Now the default for developers. brew install and brew upgrade now provide a dependency summary and require confirmation before proceeding.
  • brew info: Output is now more consistent, featuring a new "Binaries" section listing executables and clearer recursive runtime dependency information.

New Commands

  • brew exec: A new command similar to npx that supports formulae environments.
  • brew vulns: A new tap and subcommand used to check installed packages for known vulnerabilities.
  • brew as-console-user: Designed for running Homebrew correctly under MDM or root environments.

Platform Support and Deprecations

macOS 27 (Golden Gate)

Homebrew adds initial support for macOS 27. Notably, because macOS 27 drops Intel support, Homebrew will follow a phased deprecation for macOS Intel x86_64:

  • September 2026: Moves to Tier 3 (no CI support, no new binary bottles).
  • September 2027: Entirely unsupported; all related code will be deleted.

The brew-rs Experiment

The experiment to move the Ruby frontend to Rust (brew-rs) has concluded. Benchmarks indicated that the Rust frontend only provided gains in narrow, cached bottle fetch scenarios and did not improve representative full installs. Performance efforts have returned to optimizing Ruby and improving I/O timing.

Community Insights and Counterpoints

While the release was generally well-received for its performance and security gains, community discussion highlighted several points of contention:

  • Intel Deprecation: Some users expressed concern over the aggressive timeline for dropping Intel support, noting that many Mac servers run on older Intel hardware.
  • Version Pinning: Users continue to request more robust pinning and rollback mechanisms to avoid "forced upgrades" that can break specific environments.
  • Alternative Tooling: Some developers mentioned migrating to tools like mise or Nix for better version management of language-specific runtimes (Python, Node.js) or for total environment reproducibility.

"I have switched my full OS-level dev env to mise... zero glue code to 'repackage', zero version lag. You can install any arbitrary version of a package... and dynamically adjust which ones are active per working folder."

"I recently switched back to Homebrew from Nix... Brew seems to have better support for the packages it has... Better Mac support... Better UX."

Sources