Homebrew 7.0.0 Release: Key Security Updates Explained

Post Views: 1

Homebrew, a package manager for macOS and Linux, facilitates the installation of command-line tools and desktop applications via the terminal, commonly used by developers to configure their systems.

Homebrew 7.0.0 Release Addresses Multiple Security Enhancements

Security Vulnerabilities Addressed

Homebrew, a package manager for macOS and Linux, facilitates the installation of command-line tools and desktop applications via the terminal, commonly used by developers to configure their systems. The project recently released version 7.0.0, addressing eight security vulnerabilities across its ecosystem. These updates include critical fixes for command execution risks, sandbox escape vectors, and improved dependency management. The most severe vulnerability in the update allowed unsigned removal metadata associated with a cask—Homebrew’s method for installing prebuilt applications—to execute commands with elevated privileges. This flaw was resolved by removing the affected recovery code and API accessors.

Security Ratings and Mitigations

Seven of the eight advisories were already addressed in prior 6.0.x releases, meaning systems with automatic updates are already protected. The remaining issue, resolved in 7.0.0, enables a malicious cask to bypass macOS sandbox restrictions through LaunchServices. Security ratings for the advisories include one High, two Moderate, and five Low severity flaws. The High-risk vulnerability involved a sudo path exploit, mitigated in version 6.0.12. A Moderate flaw prevented the macOS installer from accessing Git configurations owned by the Homebrew prefix, which could have executed root-level processes. Another Moderate issue, the LaunchServices escape, was addressed by restricting application launches, Mach services, and Unix socket connections.

Previous Fixes in 6.0.x

Low-severity fixes, resolved in 6.0.6 and 6.0.7, included mitigations for unintended file path interactions. These covered scenarios such as redirects leaking sensitive headers, Git redirects circumventing tap restrictions, Subversion URLs functioning as command options, and patches writing outside the staged source tree.

New Security Features in 7.0.0

brew vulns Tool

Homebrew 7.0.0 introduces a built-in package scanning tool, ‘brew vulns,’ which evaluates installed formulae against known vulnerabilities using the OSV.dev database. This feature requires no additional taps or gems and allows teams to filter results using flags like –severity=high, –deps, and –fix-available. The tool leverages an updated advisory database that tracks vulnerabilities against specific formula versions and revisions, including backported fixes. This reduces false positives by correlating patch status with upstream version numbers.

Provenance Verification

Provenance verification has been expanded to include supported third-party tap bottles, ensuring build attestations are validated. New taps created via ‘brew tap-new’ automatically publish these attestations, enhancing trust in third-party sources.

Sandboxing and Trust Considerations

Sandboxing Improvements

Homebrew’s sandboxing mechanisms now restrict formula and cask operations, with setup instructions delivered as signed data. This reduces reliance on arbitrary Ruby scripts during installation, deprecating older post_install and cask flight blocks. These deprecated methods will no longer be supported after December 11, 2027.

Trust in Third-Party Casks

Despite sandboxing improvements, trust in third-party casks remains a critical defense against malicious payloads.

Homebrew explicitly states that sandboxing alone cannot secure untrusted software.

Installed applications operate under user privileges, and vendor.pkg installers run outside the sandbox, potentially requesting sudo access.

Linux and Intel Mac Support Changes

Linux Sandboxing Changes

On Linux, Homebrew replaced the Bubblewrap sandboxing framework with Landlock, a kernel-level facility that eliminates dependency on Docker or elevated permissions. Systems lacking Landlock support will continue using older configurations, with ‘brew doctor’ issuing advisories for this gap.

Intel Mac Support Downgrade

Intel x86_64 architecture has been downgraded to Tier 3 due to infrastructure challenges, halting routine bottle builds. Existing bottles remain accessible, but updates may require local compilation. Homebrew will cease supporting Intel Macs after September 1, 2027, recommending alternatives like MacPorts.

macOS Version Support

Apple’s macOS 27 and GitHub’s Intel runners will also retire in autumn 2027, further limiting long-term viability. Additional updates include the removal of macOS 10.15 and earlier support, with Sonoma 14 moved to Tier 3. No new bottles will be built for these versions.

Additional Updates

Infrastructure and Support

The release underscores Homebrew’s ongoing efforts to balance usability with security, addressing both immediate threats and long-term infrastructure sustainability.