Today, I’m proud to announce Homebrew 7.0.0. The most significant changes since 6.0.0 are faster installations and upgrades, stronger sandboxing, a native macOS app, built-in vulnerability checks and an advisory database, the end of macOS 10.15 support and Intel Macs moving to Tier 3. Upgrading is automatic via brew update or manual brew update if $HOMEBREW_NO_AUTO_UPDATE is set. Deprecated interfaces warn until disablement; disabled interfaces reject use; removed interfaces are unavailable.

macOS 10.15 or earlier users must upgrade to macOS 11 or later. Minimum version is now macOS Sonoma 14. Intel Macs are Tier 3; upgrade to Sequoia 15+ for bottles and .pkg installations. Apple Silicon macOS Sonoma 27 is fully supported (Tier 1) with prebuilt bottles. The ghcr.io/homebrew/ubuntu22.04 image is removed; migrate to ghcr.io/homebrew/brew. Homebrew/actions/*@master or @main is removed; pin a Cal Ver release or full SHA.

Setuid wrappers with different real and effective UIDs are rejected; run as the installation’s owner without a wrapper. Third-party brew wrappers are Tier 3; internal commands bypass wrappers. Homebrew/brew master is frozen bootstrap; switch to main before removal on 2027-03-01. Bootstrap Intel macOS 11 or later is Tier 3; no new bottles; migrate to MacPorts before Homebrew stops running on 2027-09-01. Apple Silicon macOS 11 users must upgrade to macOS 12 or later before support ends on 2027-09-01. Third-party formula post_install and cask flight blocks are deprecated; migrate to *_steps; brew style --fix converts common hooks by 2027-12-11.

Performance improvements include greater concurrency across downloads, preparation, and installation. brew install, reinstall, and upgrade overlap package preparation and downloads. brew config gathers system details concurrently. brew tap-info collects tap metadata concurrently. brew cleanup avoids repeated cache scans. brew fetch reads download information directly from API metadata. brew update prepares Ruby caches for faster subsequent commands. Homebrew reuses parsed API data on warm runs while verifying signatures on every load. Fewer subprocesses are launched during startup, and terminal dimensions are read directly to avoid hangs with uutils stty.

Security includes various fixes and new installation protections. The first fixed releases include GHSA-rg9r-ppxp-87hm (High, fixed in 6.0.12): unsigned cask-removal metadata could execute commands with sudo; all vulnerable recovery code and API are addressed.