Show HN: Homebrew 6.0.0

TL;DR

For playersOffer from Amazon

Play games on Amazon Luna for your game nights, included with Prime

• A rotating selection of games, no download needed
• Play on TV, laptop or phone
• Fast, free delivery for your gear, too

Start playing with Prime →Free trial · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Homebrew 6.0.0 has been released, adding a new tap trust security mechanism, a faster internal JSON API, Linux sandboxing, and support for macOS 27. These updates aim to improve security, speed, and compatibility for users.

Homebrew has released version 6.0.0, introducing a new tap trust security mechanism, a faster internal JSON API, Linux sandboxing, and initial support for macOS 27 (Golden Gate). This update aims to enhance security, speed, and platform compatibility for users across macOS and Linux environments.

The key feature in Homebrew 6.0.0 is the implementation of tap trust, which requires third-party taps and their formulae to be explicitly trusted before code is run, reducing security risks from malicious taps. The update also replaces the default internal JSON API with a faster, smaller version that consolidates metadata downloads, improving update speed and reducing network load. Additionally, Linux now benefits from sandboxing via Bubblewrap, aligning it with macOS’s sandboxed build and install phases, which enhances security during package management.

Other notable improvements include default ask mode for developer commands, which prompts for confirmation before making changes; numerous enhancements to ‘brew bundle’ for parallel installation and support for Windows’ winget; performance optimizations such as faster startup and upgrade processes; and initial support for macOS 27, with plans to phase out Intel support by September 2026. Homebrew also addressed multiple security advisories, fixing issues related to download redirects, Git hooks, and installer package handling to improve overall security posture.

Impact of Security and Compatibility Enhancements

The addition of tap trust significantly enhances security by preventing untrusted or malicious third-party code from executing without explicit approval. The faster internal API improves user experience by reducing update times and network usage, especially for users with large or numerous packages. Linux sandboxing aligns Linux package management with macOS’s security model, reducing the risk of compromised builds or installations. Support for macOS 27 positions Homebrew as ready for the latest Apple operating system, though it also signals a forthcoming phase-out of Intel support, impacting users on older hardware. Overall, these updates strengthen Homebrew’s security, speed, and cross-platform compatibility, which are critical for both casual and professional users.

Background and Development Timeline

Homebrew has been the dominant package manager for macOS since its inception, with continuous updates to improve security, performance, and usability. Version 5.1.0 introduced several features, but the 6.0.0 release marks a major milestone with a comprehensive security overhaul, including tap trust, and platform support expansion. The move to support macOS 27 (Golden Gate) aligns with Apple’s latest OS release, which drops support for Intel-based Macs, prompting Homebrew to adapt accordingly. Previous updates also focused on performance improvements and expanding support for Windows via ‘brew bundle’. The current release builds on these efforts, emphasizing security enhancements and cross-platform consistency.

“Homebrew 6.0.0 introduces significant security and performance improvements, including tap trust and Linux sandboxing, to better serve our users.”

— Homebrew team

Remaining Questions About Future Support and Adoption

It is not yet clear how quickly users will adopt the new tap trust system or how it will impact third-party tap maintainers. The full implications of dropping Intel support on legacy hardware and existing workflows remain to be seen. Additionally, the long-term stability and security of the new internal API and sandboxing features are still under observation, as ongoing feedback and real-world testing continue.

Upcoming Homebrew Developments and User Guidance

Homebrew plans to continue refining tap trust, expand sandboxing features, and fully transition to support only Apple Silicon Macs with macOS 27. Users are advised to review the new tap trust documentation and prepare for phased support changes, including the eventual deprecation of Intel-based Macs. Future updates are expected to include further security enhancements, performance optimizations, and possibly additional platform support features.

Key Questions

What is tap trust in Homebrew 6.0.0?

Tap trust requires users to explicitly trust third-party taps before their code can be evaluated or run, enhancing security by preventing untrusted code execution.

How does the new internal JSON API improve performance?

The internal JSON API consolidates all metadata into a single download, reducing network requests and speeding up updates and package management operations.

Will Homebrew still support Intel Macs?

No. Support for Intel Macs will be phased out, with official support ending by September 2026, as Apple shifts entirely to Apple Silicon hardware.

What security vulnerabilities have been addressed in this release?

Homebrew fixed issues related to HTTPS redirects, Git hook vulnerabilities, and installer package handling to improve security and prevent potential exploits.

When will Homebrew fully support macOS 27?

Initial support is available now, with full support expected as Apple releases macOS 27 later in 2024. Ongoing updates will improve compatibility and security.

Source: Hacker News