Homebrew 7.0.0 adds parallel installs, stronger sandboxing and Intel Mac demotion

Homebrew 7.0.0 lands with performance and security focus

The Homebrew project has released version 7.0.0 of its package manager. According to the announcement published on brew.sh, the headline changes since 6.0.0 are quicker installation and upgrades, tighter sandboxing, a native macOS app, built-in vulnerability checks backed by an advisory database, the retirement of macOS 10.15 support, and Intel Macs being downgraded to Tier 3 support.

Upgrading happens automatically for most users via auto-update, or manually with brew update for those who have disabled automatic updates.

Concurrent work speeds up everyday commands

The performance work centres on doing more in parallel. According to the release post, brew install, brew reinstall and brew upgrade now overlap package preparation with downloads, including batches run through brew bundle, so a Brewfile shares the same coordinated work as a command naming several packages.

Several other commands were touched: brew config gathers system details concurrently instead of waiting on each subprocess in turn, and brew tap-info pulls tap metadata in parallel while keeping its output order stable for scripts. brew cleanup no longer rescans the cache repeatedly, and brew fetch can start downloads straight from API metadata without loading full package definitions just to find URLs and checksums.

There are also smaller wins: brew update prebuilds Ruby caches so follow-up commands start faster, parsed API data is reused between warm runs while signatures are still verified on every load, and the tool spawns fewer subprocesses during startup.

Security fixes and expanded sandboxing

The announcement lists a set of security advisories. The highest severity, GHSA-rg9r-ppxp-87hm, was fixed in 6.0.12: unsigned cask-removal metadata could execute commands with sudo, and the vulnerable recovery code and API accessors have since been deleted. A moderate issue fixed in 7.0.0 itself, GHSA-5263-whxq-77hp, allowed a malicious cask to break out of the macOS install sandbox through LaunchServices; Homebrew now restricts application launching, Mach services and Unix socket connections. Another moderate fix in 6.0.12 made the macOS installer ignore prefix-owned Git configuration that could run programs as root, and a series of low-severity patches addressed redirect handling, tap restriction bypasses, Subversion URL injection and patch targets escaping the staged source tree.

On the sandboxing side, structured setup is now delivered as signed data and formula and cask operations run sandboxed, reducing arbitrary Ruby execution. Dependency downloads are being migrated into a dedicated fetch phase: migrated formulae download with network access and writable caches, then install proceeds with networking disabled and caches made read-only. Sandboxed builds can no longer read the home directory by default, and installations that switch between different real and effective user IDs are rejected outright.

The announcement is candid about limits: tap trust remains the main defence against malicious third-party casks, the sandbox mostly limits accidental damage, and vendor .pkg installers still run outside it.

Platform support narrows

Several long-signalled removals take effect immediately. macOS 10.15 and earlier are no longer supported at all, requiring macOS 11 or later. macOS Sonoma 14 drops to Tier 3, meaning users need Sequoia 15 or newer for bottles and .pkg installations, while macOS Golden Gate 27 on Apple Silicon is fully supported at Tier 1 with prebuilt bottles.

The most consequential change for hardware planning: Intel Macs on macOS 11 or later move to Tier 3 with no new bottles, and the project recommends migrating to MacPorts before Homebrew stops running there on 2027-09-01. Apple Silicon machines on macOS 11 face the same end date and should upgrade to macOS 12 or later.

Other dated deadlines include the frozen Homebrew/brew master bootstrap, which users must move off before 2027-03-01, and the deprecation of third-party formula post_install and cask flight blocks in favour of *_steps, enforced from 2027-12-11, with brew style --fix available to convert common hooks. CI users are affected too: the Ubuntu 22.04 image is gone in favour of ghcr.io/homebrew/brew, and GitHub Actions references to @master or @main no longer work, requiring a pinned CalVer release or commit SHA. Third-party brew wrappers are also demoted to Tier 3.

Smaller command and workflow improvements

The release also polishes day-to-day commands. brew install --dry-run previews formulae and casks together, brew list --no-installed-on-request isolates dependency-only packages, and brew info now distinguishes uninstallable packages from merely uninstalled ones while flagging unmet operating-system or architecture requirements. brew services gains persistent per-formula environment overrides that survive upgrades, brew bundle can restore Cargo Git dependencies and uv tools from declared sources, and brew doctor -- emits structured diagnostics for automation.

Why it matters

Homebrew is the default package manager for a large share of macOS developers, so these changes ripple outward quickly. Faster, concurrent installs shave time off routine workflows, while the sandbox expansion and advisory database raise the security floor at a moment when supply-chain attacks on package ecosystems are a persistent concern. The support changes are the harder news: anyone on pre-Catalina or Intel hardware now has a clock running, with a concrete September 2027 deadline and a suggested MacPorts migration path, and CI pipelines pinned to old branches or images will break until updated.