From Homebrew · MikeMcQuaid · · 4m
Homebrew 7.0.0 cuts Intel Macs loose
Faster installs, real sandboxing, a built-in vulnerability scanner, a native Mac app, and a hard goodbye to Intel.
In brief
Faster installs, real sandboxing, a built-in vulnerability scanner, a native Mac app, and a hard goodbye to Intel. Homebrew 7.0.0 is worth the upgrade for speed and built-in security scanning, but Intel Mac users now have a two-year clock and should start planning a move to MacPorts. Originally reported by Homebrew.
Homebrew 7.0.0 lands
Released 13 September 2026, the headline changes are concurrent installs, stronger sandboxing, a native Mac app, built-in vulnerability checks, and the end of Intel support.
“Today, I'm proud to announce Homebrew 7.0.0.”
You already have it
Auto-update pulls 7.0.0 down for you. If you set HOMEBREW_NO_AUTO_UPDATE, run brew update yourself. Deprecated features warn, disabled ones refuse, removed ones are simply gone.
Installs overlap now
brew install, reinstall and upgrade run downloads and preparation at the same time. A Brewfile gets the same shared work as naming several packages on one command line.
Diagnostics stop waiting
brew config gathers compiler, OS and repo checks concurrently instead of queueing subprocesses. brew tap-info does the same for tap metadata while keeping script-safe output order.
Less work on warm runs
brew cleanup skips repeated cache scans, brew fetch pulls URLs and checksums straight from API metadata, and parsed API data is reused, with signatures still verified every load.
Eight advisories fixed
The worst, rated High, let unsigned cask-removal metadata run commands with sudo. The vulnerable recovery code and API accessors were deleted, not patched around.
“unsigned cask-removal metadata could execute commands with sudo”
Casks escaped the sandbox
A moderate flaw let a malicious cask run code outside the macOS install sandbox via LaunchServices. Homebrew now restricts app launching, Mach services and Unix socket connections.
Sandboxing has limits
Tap trust is still the real defense. Apps run with your privileges and vendor .pkg installers run outside the sandbox, sometimes with sudo. Sandboxing mostly limits accidents.
“It cannot make untrusted software safe to run”
Downloads split from builds
Migrated formulae fetch with network access and writable caches, then install with networking off and caches read-only. Sandboxed reads of your home directory are blocked by default.
Commands say more
brew info now marks uninstallable packages with ⊘ versus ✘ for merely uninstalled, and flags unmet OS and architecture requirements before you start an install.
Service settings that survive
brew services reads persistent overrides from a per-formula .env file, so local settings outlive upgrades and apply on restart without editing generated service files.
Cask links, unlinked
brew link and unlink accept, cask and, formula, so cask binaries, manpages and completions can be disabled or restored without a reinstall., dry-run previews the change.
Intel drops to Tier 3
No new bottles, so updated formulae may need source builds. Homebrew still runs on Intel until September 2027, unsupported. macOS 10.15 and earlier are gone now.
Why Intel had to go
Apple dropped Intel from macOS 27, and GitHub retires its Intel macOS runners in autumn 2027. A volunteer project cannot replace what two of the biggest tech companies walked away from.
“sadly neither can Homebrew”
MacPorts for Intel users
Homebrew points Intel Mac owners at MacPorts, which still supports x86_64 and is likely to give better binary package coverage. The .pkg installer is Apple Silicon and Sequoia 15+ only.
BrewUI ships
brew install homebrew-app puts an official native GUI on macOS Tahoe 26 or later. Browsing, search and installed versions in one window, with the underlying brew commands shown.
Landlock replaces Bubblewrap
Linux sandboxing now uses Landlock, which needs no dependencies or extra Docker permissions. Kernels without it keep working, and brew doctor flags the missing protection.
brew vulns is built in
A new advisory database tracks vulnerabilities against the exact formula versions Homebrew ships, including backported fixes, and checks them against OSV.dev with no extra tap or gem.
Scan, then prioritise
brew vulns takes, severity=high, deps and, brewfile to narrow the scan, plus, fix-available and, fix-type to sort what you can actually act on today.
Ruby hooks are on notice
post_install and cask flight blocks give way to declared *_steps that Homebrew can validate and sandbox. Official taps reject them now, third-party taps get warnings until December 2027.
In short
Homebrew 7.0.0 is worth the upgrade for speed and built-in security scanning, but Intel Mac users now have a two-year clock and should start planning a move to MacPorts.
