Homebrew 7.0.0 Ships Built-In Vulnerability Scanning, an Advisory Database, and Linux Landlock Sandboxing
Homebrew 7.0.0 adds a brew vulns scanner and advisory database, swaps Linux Bubblewrap sandboxing for Landlock, and patches a cask sandbox-escape flaw.
Editor's Note ·
- Correction:
- The article quotes the GHSA-5263-whxq-77hp advisory as describing the cask sandbox as using "an allow-by-default approach, denying only specific capabilities while permitting most operations." The advisory's actual wording is: "This sandbox is an allow by default sandbox (a blacklist), that denies only specific capabilities, leaving most non-file operations allowed." The underlying description is accurate; the quoted wording is a paraphrase, not a verbatim quote.
- Correction:
- The article quotes the same advisory as stating: "This technique bypasses file-write denials and allows attackers to: Access explicitly denied paths (e.g., ~/.ssh, ~/.aws, ~/.docker); Write to any user-accessible location; Execute arbitrary code outside sandbox constraints." No such sentence appears in the advisory. Its Impact section instead reads: "Code running in the cask install sandbox can execute outside it with the full privileges of the invoking user. All restrictions the profile imposes are bypassed: Every path explicitly denied (e.g., ~/.ssh, ~/.aws) is accessible. Every path the invoking user have access two becomes writeable." The underlying facts (denied paths become accessible, arbitrary write and code execution are possible) are accurate; the quoted wording was not taken verbatim from the source.
Overview
Homebrew, the widely used open-source package manager for macOS and Linux, released version 7.0.0 on September 13, 2026, according to Homebrew’s blog. Announced by Mike McQuaid, the release centers on “faster installations and upgrades, stronger sandboxing, a native macOS app, built-in vulnerability checks and an advisory database, the end of macOS 10.15 support and Intel Macs moving to Tier 3,” according to Homebrew’s blog.
What We Know
Vulnerability scanning and an advisory database
Homebrew 7.0.0 introduces a built-in brew vulns command that checks installed and available formulae for known vulnerabilities using OSV.dev, without requiring additional taps or gems, according to Homebrew’s blog. The release also adds a new advisory database: “Homebrew’s new advisory database records vulnerabilities against the formula versions and revisions Homebrew ships, including backported security fixes,” according to Homebrew’s blog. Homebrew publishes its findings through the formula API and offers downloadable advisory indexes in OSV format under a CC0 license, according to Homebrew’s blog.
The GitHub release notes for 7.0.0 show ongoing engineering work tied to that system, including pull requests titled “vulns: keep unknown subjects unresolved” and “advisory-match: derive introduced boundaries,” according to GitHub.
Fixing a sandbox escape via LaunchServices
Among the security fixes bundled into 7.0.0 is GHSA-5263-whxq-77hp, a moderate-severity flaw with a CVSS score of 6.2 that affected every cask installation through version 6.0.22, according to the GitHub security advisory. The advisory says the cask-installation sandbox used “an allow-by-default approach, denying only specific capabilities while permitting most operations,” which let a malicious cask escape the sandbox through macOS’s LaunchServices, according to the GitHub security advisory. The advisory describes an attacker using osacompile to build a helper application and then opening it to run a shell command outside the sandbox’s restrictions. “This technique bypasses file-write denials and allows attackers to: Access explicitly denied paths (e.g., ~/.ssh, ~/.aws, ~/.docker); Write to any user-accessible location; Execute arbitrary code outside sandbox constraints,” according to the GitHub security advisory. Homebrew fixes the issue in 7.0.0 by restricting application launching, Mach services, and Unix socket connections inside the sandbox, according to Homebrew’s blog.
A separate high-severity issue, GHSA-rg9r-ppxp-87hm, involving unsigned cask-removal metadata that could execute commands with sudo, was already fixed in the earlier 6.0.12 point release, according to Homebrew’s blog.
Sandboxing changes on Linux
On Linux, Homebrew 7.0.0 replaces the Bubblewrap sandboxing introduced in version 6.0.0 with Landlock, a change Homebrew says requires no extra dependencies or elevated Docker permissions, addressing setup problems that Bubblewrap had caused, according to Homebrew’s blog. Kernels that don’t support Landlock continue running without Linux sandboxing, in what Homebrew describes as the less-secure pre-6.0.0 configuration, and brew doctor now reports the missing protection as an advisory, according to Homebrew’s blog.
Platform changes: a higher macOS floor, Intel Tier 3, and a new native app
The GitHub changelog for 7.0.0 lists a pull request titled “Raise minimum macOS to Big Sur (11)” among the merged changes, according to GitHub — consistent with the blog post’s framing of the release as marking “the end of macOS 10.15 support,” according to Homebrew’s blog. Homebrew also moves Intel x86_64 Macs to Tier 3 support starting in September 2026, meaning the project no longer provides routine bottle builds or support for that architecture, though it says Homebrew will keep running on Intel hardware until September 2027, according to Homebrew’s blog.
The release also ships BrewUI, which Homebrew describes as its “fully released official graphical interface for macOS.” It can be installed with brew install homebrew-app and requires macOS Tahoe 26 or later, according to Homebrew’s blog.
A migration deadline for formula and cask authors
Homebrew is deprecating the Ruby-based post_install and *flight blocks that formula and cask authors have used to run custom setup code, replacing them with declared *_steps. Official Homebrew taps already reject the legacy hooks, and third-party taps will receive warnings until the hooks are removed on December 11, 2027, according to Homebrew’s blog. Homebrew provides a brew style --fix command to convert common hooks automatically, though it says more complex migrations require rewriting a block’s contents by hand, according to Homebrew’s blog.
What We Don’t Know
Homebrew’s release materials do not specify how many formulae or casks are covered by the new advisory database at launch, or how quickly OSV.dev-sourced advisories propagate into brew vulns scan results. The project also has not published a timeline for extending Landlock support to systems running older Linux kernels that lack it, beyond noting that those systems will keep working without sandboxing until they can upgrade.