Homebrew 7.0.0 is out, and the release notes are dense with performance improvements, security fixes, and changes to how the package manager handles older Macs and non-standard setups. The update drops support for macOS 10.15 and moves Intel Macs to Tier 3 status.
The headline feature is faster installations and upgrades. Homebrew now overlaps downloads, preparation, and installation work across multiple commands, so brew install, brew reinstall, and brew upgrade share download and build steps instead of repeating them. That reduces waits between packages when running a batch. The brew config command gathers system details concurrently, overlapping compiler, operating-system, and repository checks so diagnostic reports no longer depend on waiting for subprocesses to finish.
The Security Fixes
Homebrew 7.0.0 lists eight security fixes, each tied to a specific version where the fix landed. The most serious is GHSA-rg9r-ppxp-87hm, a High severity issue fixed in 6.0.12 where unsigned cask-removal metadata could execute commands with sudo. All recovery code and API accessors were deleted to address it.
Other fixes target:
- cask execution outside the macOS install sandbox
- Git and Subversion redirects
- download redirects that could expose secrets
Each is described in detail in the release notes, with the affected versions clearly noted.
What Changed For Everyone
The concurrent performance work applies across platforms unless otherwise stated. That means faster updates, faster installs, and faster brew cleanup for setups with many packages. The fetch phase for dependency downloads is ongoing, with formulae downloading with network access and writable caches, then install disabling networking and making those caches read-only.
Homebrew also blocks sandboxed reads of the home directory by default, keeping unrelated personal files out of package builds while allowing required Homebrew paths and private temporary directories for local communication.
Homebrew reuses parsed API data on warm runs while verifying signatures on every load, reducing preparation time for repeated package commands without dropping authenticity checks.
Who Else Is Affected
MacOS users see a native Homebrew app, built-in vulnerability checks, and an advisory database. Linux users get the performance and security work. Non-default prefix users will notice changes to trust and environment migrations. Security teams and auditors will find the structured diagnostics from brew doctor --json useful, while CI users running Homebrew in containers will want to know about the sandboxing limits.
Tap maintainers should prepare for the ongoing fetch migration, which changes how dependency downloads behave. The release notes note that tap trust remains the primary protection against malicious casks, and that sandboxing mainly limits accidental damage and adds installation safeguards.
The Bottom Line
Homebrew 7.0.0 is a substantial release, and the attention to detail in the security section is particularly strong. Each fix is described with its severity, the version that addressed it, and the underlying problem, which gives users a clear sense of what changed and why.
The performance work is likely to be felt immediately by anyone running large installs or upgrades. The sandboxing changes add friction for some workflows, but the release notes are explicit about what they protect against and what they don’t.
This release continues Homebrew’s pattern of transparent communication about security issues. It is worth upgrading at your earliest convenience, especially if you are running an older Mac or a non-standard prefix setup.