Homebrew 7.0.0 Adds Built-In Vulnerability Scanner and Stronger Package Sandboxing

Key Takeaways

• Homebrew has released version 7.0.0, introducing a native vulnerability scanner and enhanced package sandboxing.
• The new brew vulns command allows users to scan installed packages for known vulnerabilities using Homebrew’s internal advisory database and OSV.dev data.
• Security enhancements include stricter macOS sandboxing, private temporary directories, and a separated fetch/installation process to mitigate supply chain risks.
• The update addresses a moderate-severity vulnerability (GHSA-5263-whxq-77hp) related to malicious cask execution outside the sandbox.
• Support for macOS Catalina 10.15 has ended, and Intel-based Macs are now in Tier 3 support, with planned deprecation by September 2027.

Homebrew, the popular package manager for macOS and Linux, has rolled out version 7.0.0, bringing significant security enhancements, performance improvements, and changes to its supported platforms. The update introduces a built-in vulnerability scanner, strengthens package isolation, and refines the installation workflow, aiming to bolster the integrity and security of installed software.

Native Vulnerability Scanning with brew vulns

A standout feature in Homebrew 7.0.0 is the integration of a native vulnerability scanner, accessible via the new brew vulns command. This functionality enables users and security teams to identify known vulnerabilities within their installed formulae without needing external tools or Ruby gems. The scanner leverages Homebrew’s proprietary advisory database, which meticulously tracks vulnerabilities specific to the exact versions and revisions of packages distributed by Homebrew, alongside data from OSV.dev.

This dedicated advisory database is crucial because Homebrew frequently backports security patches without necessarily updating a package to its latest upstream version. The database therefore provides an accurate assessment, differentiating between genuinely vulnerable packages and those that have already received a fix despite an older version number. The scanner can analyze installed formulae, their dependencies, and Brewfiles, offering filtering options by severity and the ability to distinguish between remediated and unfixable vulnerabilities. It also flags packages originating from untrusted taps, enhancing visibility into potential risks.

The utility of brew vulns extends beyond individual developer workstations, proving valuable for integration into CI/CD pipelines, security audits, and comprehensive software inventory reviews. Homebrew also publishes its advisory data through its formula API and provides a downloadable OSV-format index, as detailed in the Homebrew advisory.

Enhanced Sandboxing and Isolation

Version 7.0.0 significantly bolsters package isolation across both macOS and Linux environments. On macOS, Homebrew now imposes stricter restrictions on formula and cask operations within its sandbox. By default, sandboxed reads from the user’s home directory are blocked, substantially reducing the attack surface where a package build could illicitly access personal files. The update also introduces private temporary directories, facilitating secure communication between local build tools without enabling network access during the process.

A key architectural change involves moving dependency downloads into a distinct “fetch” phase. During this phase, packages are permitted network access and can utilize writable caches. However, during the subsequent installation phase, network access is entirely disabled, and caches become read-only. This separation minimizes the risk of unexpected downloads or unauthorized external network activity during the critical package build process, enhancing supply chain security.

Addressing a Moderate-Severity Vulnerability

The update also includes a fix for a moderate-severity vulnerability identified as GHSA-5263-whxq-77hp. This flaw could have allowed a malicious cask to execute arbitrary code outside the macOS installation sandbox, leveraging LaunchServices. Homebrew 7.0.0 mitigates this risk by restricting application launching, Mach services, and Unix socket connections, thereby preventing such unauthorized execution.

Linux Sandboxing and Performance Improvements

For Linux users, Homebrew 7.0.0 transitions from Bubblewrap sandboxing to Landlock. This change addresses deployment challenges associated with Bubblewrap, specifically its dependency and elevated Docker permission requirements. Systems not supporting Landlock can still run Homebrew, though brew doctor will issue a warning about the absence of sandbox protection.

Beyond security, the release brings notable performance enhancements. Homebrew 7.0.0 optimizes operations by overlapping downloads, package preparation, and installation tasks. It reuses parsed API data while maintaining signature verification, reduces startup subprocesses, and accelerates cleanup, fetch, update, and diagnostic commands, resulting in a more efficient user experience.

Platform Support Changes

With this release, Homebrew officially discontinues support for macOS Catalina 10.15. Furthermore, Intel-based Macs have been reclassified to Tier 3 support. This means Intel users will no longer receive new prebuilt bottles and may need to compile formulae from source for updates. Homebrew has also announced its intention to cease running on Intel Macs entirely by September 2027.

What You Should Do

• Upgrade Immediately: All Homebrew users should upgrade to version 7.0.0 to benefit from the new security features and vulnerability fixes.
• Run Vulnerability Scans: Utilize the new brew vulns command regularly to scan your installed packages for known vulnerabilities and prioritize remediation.
• Review Brewfiles: Inspect your Brewfiles and the taps you use, paying close attention to any packages flagged by the vulnerability scanner, especially those from untrusted sources.
• Stay Informed: Keep an eye on Homebrew’s official announcements regarding future updates and platform support changes.
• Consider Platform Migration: If you are on an Intel Mac, begin planning for a transition to Apple Silicon or a supported Linux environment before the planned deprecation in September 2027.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.