Homebrew 7: what's changing on your Mac (Intel included) and how to use brew vulns

Development
, , , , ,
1

Homebrew 7.0.0, released on September 13, 2026, leaves Intel Macs and Macs with macOS Sonoma 14 without new precompiled packages (Tier 3), drops support for Catalina, and adds brew vulns, a built-in command that scans your installed packages against known vulnerabilities. For most users the update arrives automatically; what determines whether it’s painless depends on which Mac you have and what version of macOS it runs.

Here’s what changes, who it affects, and how to run your first vulnerability scan.

What is Homebrew (brew) on Mac?

Homebrew—the brew command—is the package manager that most developers use on macOS, and it also works on Linux and WSL. It installs command-line tools, libraries and services (formulae) and desktop applications, fonts and plugins (casks), and keeps everything within its own prefix: /opt/homebrew on Apple Silicon, /usr/local on Intel Macs, and /home/linuxbrew/.linuxbrew on Linux. If you’ve ever run brew install node or brew install --cask docker, you’ve used it.

Homebrew is free and open source under the BSD-2-Clause license, and is maintained exclusively by volunteers.

How do you install Homebrew on Mac?

To install Homebrew on Mac, paste this command from brew.sh into Terminal:

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

The script explains what it’s going to do and pauses before doing it. On Apple Silicon you don’t need the Xcode Command Line Tools to install bottles (precompiled packages) or casks; you only need them if you compile from source code.

If you prefer a graphical installer or manage machines via MDM, Homebrew offers a .pkg installer at its latest GitHub release. As of version 7, that .pkg works only on Apple Silicon and requires macOS Sequoia 15 or later.

What changes in Homebrew 7?

Homebrew 7 brings new capabilities while also narrowing the range of Macs with full support.

What you gain:

  • Faster installations and updates. Concurrent downloads have been the default behavior since version 5.0; version 7 goes further and makes brew install, brew upgrade, and brew bundle overlap package preparation with downloads, so there’s less idle time between one and the other. The release notes don’t publish benchmarks, but the improvement is noticeable: several users in the Hacker News thread commented on it right after updating.
  • brew vulns, a built-in vulnerability scanner, backed by OSV.dev and a new Homebrew-specific security advisory database. It has its own section below.
  • Stricter sandboxing. Formula and cask operations run in a sandbox, and isolated builds can no longer read your home directory by default. On Linux, Landlock replaces Bubblewrap and doesn’t require additional dependencies.
  • BrewUI, an official native macOS app to explore, search, and manage packages.

What you lose:

  • Support for macOS Catalina 10.15 and earlier ends: you need macOS Big Sur 11 or later.
  • Intel Macs move to Tier 3, with no new bottles.
  • Apple Silicon Macs with macOS Big Sur 11 through Sonoma 14 also move to Tier 3.

You don’t have to do anything to update: Homebrew updates itself. If you set HOMEBREW_NO_AUTO_UPDATE, run brew update manually.

Does Homebrew still work on Intel Mac?

Yes, until September 1, 2027. After that date, Homebrew will no longer run on Intel Macs.

In the meantime you’re in Tier 3, and that has practical consequences. Bottles that already exist continue to work, but Homebrew no longer compiles new bottles for Intel: each time a formula updates, your Mac may have to compile it from source code, which is slower and requires development tools. Maintainers don’t commit to fixing bugs that only affect Tier 3 configurations, you’ll see configuration warnings when running commands, and support is limited to community responses on GitHub Discussions.

Homebrew is unusually straightforward about the alternative: the project itself recommends MacPorts for Intel Mac users, because it continues to support that architecture and will likely deliver better results. Its documentation adds a dated warning: at the time it was written, MacPorts still didn’t offer a complete set of binary packages for Intel Mac with Tahoe.

The reason is explained in the announcement. Apple dropped support for Intel in macOS 27 Golden Gate, and GitHub Actions is retiring its macOS Intel runners in autumn 2027. Homebrew’s CI infrastructure depends on both, and a volunteer-run project can’t replace what those two companies are withdrawing.

Not sure which Mac you have? Run brew --prefix: it returns /usr/local on an Intel Mac and /opt/homebrew on Apple Silicon.

Is my Apple Silicon Mac with Sonoma left unsupported?

Yes. This is the change that most coverage overlooks, and it affects far more people than the Intel one.

As of September 2026, Tier 1 (full support) on Apple Silicon covers only three macOS versions: Sequoia 15, Tahoe 26, and Golden Gate 27. Big Sur 11 through Sonoma 14 move to Tier 3, with the same consequences as Intel: bottles that are rarely compiled, no guarantee of fixes, and warnings on every run.

Here the solution is simpler: update to macOS Sequoia 15 or later and you’re back to Tier 1. There’s one more date to keep track of: support for Apple Silicon Mac with Big Sur 11 ends on September 1, 2027, so those machines need macOS Monterey 12 or later before that date.

Tier 1 also requires other conditions: official Apple hardware (not a virtual machine), the latest macOS patch version, the default prefix or a compatible custom one, using bottles instead of compiling from source code, and installation on internal storage.

How do you use brew vulns to detect vulnerabilities?

Run it without arguments and it scans all your installed formulae against the OSV.dev database:

brew vulns

These are your options, taken from the official Homebrew manual:

Option What it does
--severity=high (or low, medium, critical) Reports only findings of that severity or higher
--fix-available Shows only vulnerabilities that already have a fixed version published: what an update resolves
--no-fix-available Shows only vulnerabilities without a published fixed version, including those that only have a patch in an unreleased commit
--fix-type Filters by fix type: released, patch, any, none or unreleased
--deps Also checks dependencies of the formulae you specify
--brewfile Checks the formulae from a Brewfile (default ./Brewfile)
--list-skipped Lists packages omitted for not having a compatible source URL
--json Returns JSON for scripts and CI

A practical first step is brew vulns --fix-available: everything that appears is resolved with brew upgrade. Then, brew vulns --no-fix-available shows you what updating still won’t fix. If your project pins its tools in a Brewfile, brew vulns --brewfile audits the environment before a new team member installs it.

Keep two limitations in mind: brew vulns scans formulae, not casks, so your desktop applications are left out, and it skips packages from untrusted taps (and notifies you that it did).

The underlying change is in the data. Homebrew now maintains its own security advisory database, which records vulnerabilities against the exact versions it distributes, including security fixes that Homebrew applies on its own. That’s why brew vulns doesn’t flag a CVE that Homebrew has already patched in its own build. The records use OSV format and are published under CC0 license, so any other security tool can reuse them.

Does Homebrew have a graphical interface?

Yes, since version 7. BrewUI is Homebrew’s official native app for macOS:

brew install homebrew-app

It brings together package exploration, search, and details of installed versions in a single window, and shows the brew command that each action executes, so it teaches you how to use the CLI instead of hiding it.

The catch: at the time this note was published, BrewUI requires macOS Tahoe 26 or later. It won’t install on Sequoia, even though Sequoia is in Tier 1.

What else can break when updating?

These changes mainly affect CI pipelines and those who maintain taps:

  • CI images: ghcr.io/homebrew/ubuntu22.04 was removed; migrate to ghcr.io/homebrew/brew.
  • GitHub Actions: Homebrew/actions/*@master was removed. Pin a CalVer release or a full SHA; it’s also recommended to stop using @main.
  • Tap maintainers: post_install blocks for formulae and preflight/postflight for casks are deprecated in favor of declared *_steps. Official taps already reject old hooks; third-party taps receive warnings until December 11, 2027. brew style --fix converts the most common cases.
  • Wrappers: third-party wrappers over brew move to Tier 3. brew doctor warns you if another brew takes priority over yours in the PATH.
  • Linux: HOMEBREW_SANDBOX_LINUX is now disabled. Remove it: Landlock is used automatically when the kernel supports it.

What should you do today?

  1. Check what Mac you have with brew --prefix.
  2. If you use Apple Silicon with Sonoma 14 or earlier, plan an upgrade to Sequoia 15 or later.
  3. If you use Intel, you have until September 1, 2027. Decide between new hardware or MacPorts before a formula you depend on has to be compiled from source.
  4. Run brew vulns --fix-available and then brew upgrade.

If you use Homebrew to install local LLM tools, what Mac you have also defines what runs well on your machine. We discuss this in LM Studio, Ollama or llama.cpp: what actually runs on your machine and in Gemma 4 on your Mac with Ollama: which variant to choose based on your RAM.