Homebrew 7.0.0 Integrates Vulnerability Scanner and Enhances Package Sandboxing
The latest Homebrew release, version 7.0.0, introduces a built-in vulnerability scanner, 'brew vulns', and significantly strengthens package sandboxing on macOS and Linux.
Homebrew has rolled out version 7.0.0, a significant update that brings a native vulnerability scanner, a dedicated advisory database, enhanced sandboxing capabilities, and performance improvements to the popular package manager. This release also marks the end of support for macOS Catalina 10.15 and shifts Intel-based Macs to a Tier 3 support level.
The most notable security enhancement is the introduction of the 'brew vulns' command. This integrated scanner allows users and security professionals to check installed formulae for known vulnerabilities without requiring external tools. It leverages Homebrew's new advisory database, which tracks vulnerabilities specific to Homebrew formula versions and revisions, alongside data from OSV.dev. The scanner can analyze installed formulae, their dependencies, and Brewfiles, offering filtering by severity, identification of packages with available fixes, and flagging of vulnerabilities with no current remediation. This makes it a valuable tool for securing developer workstations, CI/CD pipelines, and for conducting security audits.
Homebrew's new advisory database is crucial because it can differentiate between a package that appears outdated and one that has already received a security patch, a common scenario where Homebrew backports fixes without updating to the latest upstream version. This detailed tracking ensures more accurate vulnerability reporting. The advisory data is also accessible via Homebrew's formula API and a downloadable OSV-format index.
In parallel with the vulnerability scanner, Homebrew 7.0.0 significantly bolsters package isolation on both macOS and Linux. On macOS, the sandbox restrictions for formula and cask operations have been tightened. By default, sandboxed builds are now prevented from accessing the user's home directory, mitigating the risk of malicious packages accessing unrelated personal files. Additionally, private temporary directories are now used for local build-tool communication, eliminating the need for network access during this phase.
The release also refines the package fetching and installation process. Downloads are now handled in a separate phase where network access is permitted and caches are writable. During the subsequent installation phase, network access is disabled, and caches become read-only. This separation minimizes the potential for unexpected network activity or unauthorized downloads during the build process.
Version 7.0.0 also addresses a moderate-severity security issue, GHSA-5263-whxq-77hp, where a malicious cask could have exploited LaunchServices to execute code outside the macOS installation sandbox. The update rectifies this by imposing stricter controls on application launching, Mach services, and Unix socket connections.
For Linux users, Homebrew has transitioned from Bubblewrap sandboxing to Landlock. This change aims to resolve deployment issues associated with Bubblewrap's dependency and elevated Docker permission requirements. While systems without Landlock can still operate Homebrew, the 'brew doctor' command will now flag the missing sandbox protection.
Beyond security, Homebrew 7.0.0 introduces performance enhancements, including overlapping download, preparation, and installation tasks, reusing parsed API data, and reducing startup subprocesses. Support for macOS Catalina 10.15 has been discontinued, and Intel Macs are now classified as Tier 3, indicating they will receive fewer prebuilt 'bottles' and may require source builds for updated formulae. Homebrew has indicated plans to cease support for Intel Macs entirely by September 2027.