Homebrew 7.0.0 ships brew vulns — scan your build machine

Homebrew put out 7.0.0 on September 13, and it is the rare package-manager release that changes your security posture rather than your package list. The headline for anyone running a shop on Macs: brew vulns is now a built-in command that scans what you already have installed against a real advisory database. No tap to add, no wrapper script. That closes a gap most small teams have never filled — the dev laptop is the one machine in the building nobody scans.

What actually happened

Homebrew's release post covers three things worth your attention.

A scanner. brew vulns checks installed formulae against Homebrew's own advisory database, published in OSV format, and against OSV.dev. It takes filters — Help Net Security notes --severity=high and --fix-available, which is the pair you actually want in CI. The Homebrew-published records matter because they track backported patches, so a formula whose version string looks old can still be marked fixed.

Eight advisories closed. One High, two Moderate, five Low. The High one let unsigned cask removal metadata run commands with sudo; it was fixed back in 6.0.12. The eighth lands in 7.0.0 itself — a malicious cask could execute code outside the macOS install sandbox via LaunchServices. Homebrew now restricts application launching, Mach services and Unix socket connections during installs.

Builds stop reading your home directory by default. That is the change with the widest blast radius and the quietest announcement. A formula's build step no longer gets a free look at ~/.aws, ~/.ssh, or ~/.config. On Linux, sandboxing moved from Bubblewrap to the kernel's Landlock, which drops the extra dependency and the elevated permissions it needed.

Also in the release: post_install blocks are being replaced by declared steps signed as data instead of arbitrary Ruby, build attestations extend to supported third-party tap bottles, taps made with brew tap-new publish attestations by default, and Intel Macs move to Tier 3 with new bottles ending after September 2027.

Why it matters for your business

A developer laptop is a production system with none of the controls. It holds cloud credentials, a signing key, a database tunnel and a browser session with your billing provider — and it installs software from a community repository, often by pasting a command out of a README.

Run the scan, then wire it up. brew update && brew upgrade && brew vulns --severity=high --fix-available on every Mac that builds or deploys. Then put it in a weekly job so it is a report and not a memory.

Upgrade to get the eighth fix. Seven of the eight advisories shipped in 6.0.x. The LaunchServices sandbox escape only closes when 7.0.0 is actually installed, so brew --version on each machine is the check.

Treat the home-directory change as a stress test. If a build breaks in 7.0.0 because it can no longer reach ~, that build was reading your credentials. Find out which one and why, rather than reaching for a flag to turn the sandbox off.

Put the Intel deadline on a calendar. September 2027 is far away until it is a fleet refresh you did not budget. Count your Intel Macs now while it costs you one command.

Sources: Homebrew 7.0.0 release announcement, Help Net Security.