Homebrew 7.0.0 ships a native Mac app, a built-in vulnerability scanner, and installs that run with no network access at all. But the change most developers need to act on is the one that finally retires the Intel Mac. Ten changes, ranked by urgency.
In June we covered Homebrew 6.0.0 and ended on the line that, for Intel Mac owners, the clock was officially ticking. Three months later it has stopped.
Homebrew 7.0.0, announced by project lead Mike McQuaid on September 13, 2026, is the biggest release the project has shipped in years: a native macOS app, a built-in vulnerability scanner with its own advisory database, sandboxes that cut network access during installs, and the end of the road for a whole generation of Macs.
There is far too much in it for a tidy walkthrough, so here are the ten changes that actually matter — ordered by how soon each one is likely to affect you.
1. Intel Macs have dropped to Tier 3
This is the one to plan around. Intel x86_64 macOS is now Tier 3: no new bottles are being built as of September 2026, and support ends entirely on September 1, 2027.
In practice, "no bottles" means no prebuilt binaries. Every formula you install or upgrade on an Intel Mac from here on compiles from source — slower, hotter, and increasingly likely to break as maintainers stop testing that path. Homebrew is blunt about the reason: it is a volunteer project, and both Apple and GitHub have discontinued Intel x86_64 themselves. The official suggestion is to migrate to Apple Silicon, or to MacPorts if you are staying on the hardware.
2. Catalina and earlier are gone as of today
Not deprecated — removed. macOS Catalina 10.15 and earlier lost support in this release, with no transition window.
The rest of the support map shifted too. macOS Sonoma 14 drops to Tier 3 with no new bottles. macOS Big Sur 11 on Apple Silicon now has a hard end date of September 1, 2027 — the same day Intel support ends. On the other side of the ledger, macOS Golden Gate 27 is fully supported with prebuilt bottles from day one.
3. brew vulns is built in now
Homebrew 6.0.0 introduced brew vulns. In 7.0.0 it becomes a first-class, built-in command — no extra tap, no extra gem — and it is backed by a real advisory database.
It scans your installed formulae and tells you what is exposed. The flags are where it gets useful:
--severity=high— cut the noise down to what deserves attention today.--depsand--brewfile— scope the scan to a dependency tree or a project'sBrewfile.--fix-available/--no-fix-available— separate "you can act on this now" from "upstream has nothing yet."--fix-type— distinguishes a fix that shipped in a release from one that only exists as a patch.--list-skipped— shows coverage gaps, including formulae skipped because they come from an untrusted tap.
The advisory data is published in the formula API and as a downloadable index, in OSV format under CC0, so it is freely reusable in your own tooling. Homebrew also now reads the resolves annotation on security patches to avoid double-reporting a vulnerability that a formula has already patched, and adds upstream package identifiers to its software bills of materials. Bottle attestations from third-party taps are verified.
4. Your tap's post_install hooks are on a countdown
If you maintain a tap, read this one twice. The legacy install hooks are deprecated in favour of declarative step blocks:
- Formula
post_install→post_install_steps - Cask
preflight→preflight_steps - Cask
postflight→postflight_steps - Cask
uninstall_preflight/uninstall_postflight→uninstall_preflight_steps/uninstall_postflight_steps
The point is that steps are declared rather than executed as arbitrary Ruby, so Homebrew can validate file operations and configuration writes before running them. Official taps reject the legacy hooks immediately. Third-party taps get warnings until December 11, 2027. brew style --fix converts the common cases automatically; anything unusual needs rewriting by hand.
A few other dated migrations landed alongside it. The Homebrew/brew master branch is frozen and disappears on March 1, 2027 — switch to main. The ghcr.io/homebrew/ubuntu22.04 CI image is gone, replaced by the general-purpose ghcr.io/homebrew/brew. And Homebrew/actions/*@master has been removed outright; pin to a CalVer release or a full SHA.
5. Installs no longer have network access
The sandbox model got a structural change rather than a tweak. Dependency downloads have moved into a separate fetch phase that has network access — and the install phase that follows has networking disabled entirely.
That is a meaningful shift. A formula can no longer quietly reach out to the internet while it is being installed, because by then there is no internet to reach. On top of it: home directory reads are blocked by default inside the sandbox, private temporary directories let local tools talk to each other without opening the network, setup delivery is structured and sandboxed for both formulae and casks, and Homebrew now rejects mismatched real and effective UIDs before it reads any configuration — closing the door on setuid wrapper tricks.
6. Linux traded Bubblewrap for Landlock
Linux sandboxing shipped in 6.0.0 using Bubblewrap. In 7.0.0 it has been replaced by Landlock, the kernel's own access-control system, which needs no dependencies and no escalated permissions to work.
brew config now reports the Landlock ABI it detected. ABI 2 is supported on Linux 6.1 with warnings about the network restrictions it cannot enforce. Because the old implementation is gone, HOMEBREW_SANDBOX_LINUX has been removed, and both HOMEBREW_NO_SANDBOX_LINUX and HOMEBREW_ARCH are deprecated with a December 11, 2027 removal date. AppImages now install to the application destination, matching how .app bundles are handled on macOS.
7. Eight security advisories, one of them High
The release closes eight security advisories. The one worth knowing about is GHSA-rg9r-ppxp-87hm (High): unsigned cask-removal metadata could execute commands with sudo.
Two Moderate issues follow — malicious cask code escaping the sandbox via LaunchServices (GHSA-5263-whxq-77hp), and the macOS installer ignoring prefix-owned Git configuration (GHSA-hqpg-hjr9-c7j8). The remaining five are Low severity and cluster around the same theme: redirects and URL handling in brew livecheck, download secret headers, Git tap restrictions, Subversion external URLs, and patch target escapes.
8. It's genuinely faster
Performance work in 7.0.0 is mostly about not waiting on things sequentially. Package preparation and downloads now overlap during brew install, brew reinstall, brew upgrade and brew bundle. brew config gathers system details concurrently instead of one at a time, as does tap metadata collection.
brew cleanup no longer rescans the cache repeatedly. brew fetch goes straight to API metadata for bottles and casks rather than loading full package definitions. brew update warms Ruby caches so later commands start faster, API data is reused on warm runs without dropping signature verification, and startup launches fewer subprocesses. None of these are headline features individually; together they are the difference you will actually feel.
9. BrewUI is real, and it ships
Our 6.0.0 write-up noted that a graphical BrewUI "remains in development." It has landed. Homebrew now has an official native macOS app, installed the way you would expect:
brew install homebrew-app— macOS Tahoe 26 or later.
It handles browsing, search, and installed-version details. The detail we like: it displays the underlying brew command behind each action, so it teaches the CLI rather than hiding it. Note that the .pkg installer is now Apple Silicon only and requires macOS Sequoia 15 or later, and prebuilt casks no longer need Xcode Command Line Tools installed first.
10. The quality-of-life pile
Finally, the small things that add up:
brew install --dry-runnow previews formulae and casks together.brew doctor --jsonemits structured diagnostics, and warns when anotherbrewon yourPATHis shadowing your installation.brew list --no-installed-on-requestsurfaces packages that are only there as dependencies.brew infonow distinguishes uninstallable packages (⊘) from merely uninstalled ones (✘).brew deps --brewfileinspects a Brewfile's dependencies;brew untapoffers to uninstall a tap's packages before removing it.brew linkandbrew unlinkaccept--cask/--formulawith--dry-run, and formula links now take precedence when a cask provides the same command.- Services can declare
stop_timeoutfor a graceful shutdown window, and read persistent overrides from$HOMEBREW_USER_CONFIG_HOME/services/<formula>.env. HOMEBREW_AUTO_UPDATE_QUIETsuppresses auto-update chatter.
One gotcha hiding in that list: service identifiers have changed to sh.brew.<formula> on both macOS and Linux. If you have scripts or monitoring that reference the old identifiers, they will need updating.
How to get it
The upgrade itself is two commands:
brew updatebrew upgrade
Then, depending on who you are: run brew vulns to see what your machine has been quietly carrying, and if you maintain a tap, run brew style --fix and start on the install-steps migration while December 2027 is still comfortably far away.
As with 6.0.0, it is worth noting that Homebrew/brew shipped this release with zero open issues — still a remarkable thing for a project this widely depended on, and still run entirely by volunteers as a non-profit.
And if you are reading this on an Intel Mac: the clock we mentioned in June has run out. Time to plan the move.
Source: Homebrew 7.0.0 — brew.sh
