The Homebrew project released version 7.0.0 on September 14, 2026, introducing a range of changes that go beyond the usual package-management improvements. The release includes a built-in vulnerability scanner, stronger controls for isolating installation processes, an OSV-format advisory database, and the full launch of the native BrewUI graphical interface on macOS 26 Tahoe and later.
Homebrew is widely used on macOS to install software and manage its dependencies in a way similar to package managers on Linux systems. Its ecosystem includes “formulae” for defining Ruby-based packages and “casks” for installing applications, fonts, extensions, and other macOS software.
Vulnerability scanning becomes part of the package manager
The release introduces a new command called brew vulns to scan installed formulae, a specific formula, or the formulae and their declared dependencies listed in a Brewfile. For each formula, Homebrew identifies the source-code repository and the associated version number or tag. For installed packages, it relies on information available in a software bill of materials (SBOM), or derives the source from the formula definition.
Homebrew then sends the source repository and the version number or tag to OSV.dev in a batched query, retrieves vulnerability records, and checks for potential matches, with support for optional filters based on severity level. It also checks whether Homebrew has included a security fix for the relevant formula.
A database for Homebrew fixes
The platform adds its own advisory database, recording vulnerabilities that affect formula versions and revisions distributed through Homebrew. This is important because it allows fixes that were applied or backported to an older version of the software to be documented without changing the upstream version number.
Homebrew publishes these results through the formula API and a downloadable advisory index, helping other tools distinguish between vulnerabilities that remain unresolved and those that have already been addressed. The database records are available in OSV format under a CC0 license, allowing security teams to reuse them.
Better isolation and a native graphical interface
Homebrew 7.0.0 blocks installation processes from accessing users’ home directories by default and separates the downloading of network-dependent dependencies from offline installation processes. This comes as attackers sometimes target the project through clone sites and ClickFix lures to distribute information-stealing malware, according to the source article.
BrewUI allows users to browse and search for packages, inspect their dependencies, and manage them through a native graphical interface, but it is available only on macOS 26 Tahoe and later. The release also adds the ability to download, prepare, and install packages in parallel, making installation and upgrade operations faster according to Homebrew.
Why does this update matter?
The release moves part of software supply-chain risk scanning into the package manager itself, rather than leaving users or security teams to collect version and fix information manually. The effectiveness of the results remains dependent on the accuracy of the formula definition, source information, and OSV records, while BrewUI availability is limited to newer macOS versions. Homebrew 7.0.0 therefore provides clearer security tools, but it does not eliminate the need to review scan results and assess whether the announced fix applies to the environment in use.