TLDR Tech / InfoSec
Homebrew 6.0 released with new security mechanism, Linux sandbox, and more
Homebrew 6.0 adds tap trust, requiring explicit user agreement before third-party taps (which can run arbitrary Ruby) install or execute code, alongside Bubblewrap-based build sandboxing on Linux (on by default, matching macOS), a brew vulns command that checks installed packages against the OSV database, and an ask-mode confirmation prompt for brew install/upgrade. Project lead Mike McQuaid argues Homebrew's maintainer-curated naming, sha256-pinned downloads, and build-from-source model left it “less vulnerable 10-15 years ago than npm is today,” citing protection from this year's Trivy binary-replacement incident. Notably, the release leaned heavily on AI coding under a disclosure-and-human-review policy, and flags aggressive Intel macOS deprecation, with no new Intel bottles after September 2026 and full removal by September 2027.
Read the full story