Homebrew 6.0.0 Is Here: Tap Trust, Sandboxing, and a Faster Default

The package manager that practically every Mac developer reaches for on day one just shipped a major version. Homebrew 6.0.0, announced by project lead Mike McQuaid on June 11, 2026, is less about flashy new commands and more about tightening the foundation: stronger supply-chain security, sandboxed builds on Linux, and a faster default experience — all while drawing a clear line under the Intel Mac era.

Tap trust: third-party code no longer runs by default

The headline change is a new tap trust mechanism. Until now, adding a third-party tap meant Homebrew would happily evaluate its Ruby code. In 6.0.0, third-party taps must be explicitly trusted before their code runs, shrinking the attack surface for malicious taps. Official Homebrew taps remain trusted by default, so the everyday brew install flow is unchanged — but pulling in someone else's repo now asks for your consent first.

Sandboxing comes to Linux

macOS builds have run in a sandbox for years. Homebrew 6.0.0 brings the same protection to Linux using Bubblewrap, sandboxing the build, test, and postinstall phases. Combined with the tap trust change, the release leans hard into the principle that installing software shouldn't hand arbitrary code the keys to your machine.

The faster JSON API is now the default

The internal JSON API — which bundles all package metadata into a single download — is now the default, replacing the older approach and cutting both update time and network traffic. The HOMEBREW_USE_INTERNAL_API environment variable that used to opt you in is now deprecated because it's simply how Homebrew works. Alongside it: parallelized bottle metadata fetching during upgrades, less Ruby loaded at startup, and a roughly 30% faster brew leaves.

"Ask mode" on by default for developers

Following a user survey, brew install and brew upgrade now show a dependency summary and ask for confirmation before making changes. It's a small but meaningful shift toward "show me what's about to happen" over "just do it" — and a sign the team is listening to how people actually use the tool.

New commands and capabilities

• brew exec — run a tool in a Homebrew-managed environment, conceptually similar to npx.
• brew vulns — a new subcommand for checking installed packages against known vulnerabilities.
• brew as-console-user — useful in MDM and root environments.
• Cask pinning, plus AppImage support and freedesktop trash integration on Linux.
• brew bundle gains winget support on Windows and new npm and krew extensions.
• An "install steps" framework to standardize common postinstall behavior.

Security fixes and hardening

The release ships fixes for three security advisories: an HTTPS-to-HTTP redirect bypass in the POST download strategy (GHSA-7699-qf8c-q47m), root code execution via Git hooks in macOS .pkg postinstall (GHSA-6689-q779-c33m), and an installer trusting a user-controlled plist in /var/tmp (GHSA-59v8-x8q4-px5c). On top of those, Homebrew now filters sensitive environment variables during Ruby evaluation, runs forbidden-package checks before downloading, and lets casks require checksums via HOMEBREW_CASK_OPTS_REQUIRE_SHA. There's also new Supply Chain Security documentation worth a read.

The Intel Mac sunset, on the calendar

This is the change to plan around. Homebrew has published a concrete timeline for retiring Intel (x86_64) macOS support:

• September 2026: Intel macOS drops to Tier 3 — no CI, and no new bottles (prebuilt binaries) will be built. You'll be building more from source.
• September 2027: Intel macOS becomes entirely unsupported, and the related code is removed.

Casks that fail macOS Gatekeeper checks are still on track for disablement in September 2026. Meanwhile, 6.0.0 adds initial support for macOS 27 "Golden Gate" and recognizes Apple's M5 and M5 Pro/Max chips — the future the project is steering toward.

Notes from a healthy project

A couple of details say a lot about the state of things. At release, Homebrew/brew had zero open issues — a rare and telling milestone for a project this widely used. The team also wrapped up its brew-rs Rust frontend experiment and is refocusing on optimizing the existing Ruby implementation, while a graphical BrewUI remains in development. Homebrew continues to run as a non-profit powered entirely by volunteers.

How to get it

If Homebrew is already installed, you're one command away:

• Run brew update to pull the latest version.
• Then brew upgrade — and note the new confirmation prompt before it proceeds.

For most developers the upgrade is seamless. The one thing to internalize: if you're still on an Intel Mac, the clock is now officially ticking.

Source: Homebrew 6.0.0 — brew.sh