What shipped on September 13

Homebrew 7.0.0 arrived on 13 September 2026. The release notes, written by project lead Mike McQuaid, group the changes into faster installs and upgrades, stronger sandboxing, a native macOS app, built-in vulnerability checks with a new advisory database, and a support change that touches every Intel Mac. An auto-update, or a manual brew update for anyone who turned auto-update off, moves an existing installation to the new version.

The support change is the one that forces a decision. macOS Catalina 10.15 and earlier are out, and every Intel Mac is now Tier 3, which Homebrew defines as unsupported. The rest of this release is about daily work: quicker package commands, a graphical app, and a scanner that reports known vulnerabilities in what you already installed.

Faster installs, a tighter sandbox

brew install, brew reinstall and brew upgrade now overlap package preparation with downloads, including batches that come from a Brewfile, so a command naming several packages no longer waits for each one to finish before starting the next. Other commands collect their information concurrently too: brew config gathers compiler, operating system and repository details in parallel, brew tap-info --installed shortens tap inventory requests, and brew cleanup stops rescanning the same cache. brew fetch reads bottle and cask URLs and checksums straight from API metadata instead of loading whole package definitions to find them, and brew update prepares Ruby caches so later commands start faster.

Sandboxing changed in two ways. Package builds can no longer read the home directory by default, and Homebrew is migrating dependency downloads into a separate fetch phase: downloads happen with network access and a writable cache, then the install phase turns networking off and makes those caches read-only. Build tools that need to exchange data locally get private temporary directories rather than network access. The release notes also list a moderate advisory fixed in this version, where a malicious cask could execute code outside the macOS install sandbox through LaunchServices; Homebrew now restricts application launching, Mach services and Unix socket connections.

A native app and a built-in scanner

BrewUI is Homebrew's official macOS app, and brew install homebrew-app adds it on macOS Tahoe 26 or later. It browses and searches packages, shows installed versions and dependencies, and prints the brew command behind each action, which keeps the graphical and terminal workflows connected.

brew vulns ships in the same release and checks installed formulae against known vulnerabilities using OSV.dev, with no extra tap or gem. --severity=high narrows the list to the advisories that usually need action, --deps includes dependencies, and --brewfile checks the packages a Brewfile would install. --fix-available and --no-fix-available separate packages with a released or patched fix from those without one, and --list-skipped reports what was not checked, including formulae from untrusted taps. The advisory database behind the command is published in OSV format under CC0, and advisory findings also appear in the formula API and a downloadable index, so security teams can reuse the data instead of scraping it.

Generic software-package blocks sit beside a magnifying lens and blank advisory cards connected by fine lines.
Concept illustration of Homebrew's built-in brew vulns command checking installed formulae against known advisories; it shows no specific finding and does not guarantee complete coverage.

Which Macs lose prebuilt bottles

macOS Catalina 10.15 and earlier are unsupported as of 7.0.0, and those machines need macOS 11 or later to keep running Homebrew. macOS Sonoma 14 and every Intel Mac on macOS 11 or later now sit in Tier 3, which the project's support documentation defines as unsupported: bottles are rarely built or published, loud configuration warnings appear at runtime, and maintainers do not commit to fixing bugs that affect those systems.

Intel installations keep working for another year. Existing bottles remain, and Homebrew still runs on Intel until September 2027, but updated formulae may fall back to building from source now that routine bottle updates have stopped. The .pkg installer is Apple Silicon only and requires Sequoia 15 or later, so Intel users install through the script. Homebrew's own recommendation is MacPorts, which it says is likely to provide better results on Intel hardware. The project points to two decisions a volunteer team cannot absorb: Apple's macOS 27 no longer supports Intel Macs, and GitHub is retiring its Intel macOS runners in autumn 2027.

On Apple Silicon, Sequoia 15, Tahoe 26 and Golden Gate 27 are Tier 1 and receive bottles. Big Sur 11 on Apple Silicon is scheduled for removal on 1 September 2027.

Linux moves from Bubblewrap to Landlock

Linux sandboxing changed implementation. Homebrew 6.0.0 introduced Bubblewrap, which needed dependencies and escalated Docker permissions and caused setup problems. Version 7.0.0 uses Landlock instead, and the release notes say no dependencies are required. Kernels without Landlock keep working in the pre-6.0.0 configuration, without sandboxing, and brew doctor reports the missing protection as an advisory rather than an error. brew config prints the Landlock ABI for troubleshooting, Homebrew supports ABI 2 on Linux 6.1, and it warns when the kernel cannot enforce network restrictions. The HOMEBREW_SANDBOX_LINUX setting is disabled and HOMEBREW_NO_SANDBOX_LINUX is deprecated without a replacement.

Prefix limits, install hooks and 2027 dates

Three changes have dates later than the release. Formula post_install and cask preflight, postflight and uninstall flight blocks are deprecated in favour of declared steps; official taps reject the legacy hooks now, while third-party taps keep working with warnings until 11 December 2027. The master branch of Homebrew/brew is frozen as a bootstrap and is scheduled for removal on 1 March 2027, so anything that clones it should point at main. The container image ghcr.io/homebrew/ubuntu22.04 has been removed in favour of ghcr.io/homebrew/brew, and Homebrew/actions no longer has a master branch.

Bottles are also becoming relocatable to shorter prefixes. The current limits are 13 bytes on Apple Silicon macOS, 26 bytes on Linux and 10 bytes for existing Intel macOS bottles, and the full path counts, slashes included. Padded builds that would raise the limit to 64 bytes on Apple Silicon and both Linux architectures are planned without a rollout date, and non-default prefixes remain unsupported for now.

What the release notes leave unsettled

Several questions stay open. Homebrew has not said when the migration of dependency downloads into the fetch phase will cover every formula, so some builds still download during installation. There is no published list of which formulae now require a source build on Intel, and no date beyond September 2027 for when Homebrew stops running there. The padded-build work has no schedule. The project has not said whether a community fork will maintain Intel bottles after it stops, and it has not published a policy for how long Tier 1 macOS versions keep receiving bottles beyond the three-version window its CI coverage implies.

What to check before the next update

Run brew update and check brew --version before relying on any of the new commands. On Intel, decide early whether to keep building from source or to move to MacPorts while the tooling still installs. brew vulns --severity=high gives a short list of advisories worth acting on, and brew doctor will now name any Tier 3 condition on the machine, including a wrapper or a prefix that is too long. Anyone whose CI builds on the retired Ubuntu 22.04 image or on Homebrew/actions@master should update those references before the 2027 removals arrive.