Show HN: Homebrew 6.0.0

TL;DR

Buying for a business?Offer from Amazon

Get business pricing on tech for your team

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

Homebrew 6.0.0 has been released, featuring a new tap trust mechanism, a faster internal JSON API, Linux sandboxing, and initial support for macOS 27. These updates aim to improve security, speed, and compatibility.

Homebrew has officially released version 6.0.0, introducing significant security and performance improvements, including a new tap trust mechanism, a faster internal JSON API, Linux sandboxing, and initial support for macOS 27.

The update’s most notable feature is the new tap trust system, which requires third-party taps to be explicitly trusted before their code runs, reducing security risks from malicious taps. This mechanism manages trust via commands like brew trust and enforces trust flags for taps and formulae.

Additionally, Homebrew now defaults to an internal, more efficient JSON API, which consolidates metadata into a single download, speeding up updates and reducing network load. The internal API was previously optional; now it is the standard, with the old variable HOMEBREW_USE_INTERNAL_API deprecated.

On Linux, Homebrew has implemented Bubblewrap sandboxing, aligning Linux with macOS by sandboxing build, test, and postinstall phases, which enhances security and consistency across platforms. The sandboxing features are enabled by default for developers and improve isolation during package management.

Other improvements include making ask mode the default for developers, which prompts for confirmation during installs and upgrades, and numerous enhancements to brew bundle for parallel installation, support for npm, krew, and Windows’ winget, and better cleanup procedures. Performance across the board has been optimized, with startup times reduced and faster bottle fetching during upgrades.

Support for macOS 27, codenamed Golden Gate, is now initial, with plans to phase out Intel support entirely by September 2027. Homebrew also published three security advisories addressing HTTPS redirect bypass, Git hook vulnerabilities, and installer package issues.

Impact of Security and Compatibility Enhancements

The release of Homebrew 6.0.0 marks a significant step in strengthening package management security, especially with the tap trust system that mitigates risks from untrusted third-party sources. The faster internal API improves user experience by reducing update times, while Linux sandboxing aligns the platform with macOS security standards. Support for macOS 27 prepares users for upcoming Apple OS releases, ensuring compatibility and future-proofing the ecosystem.

These updates are likely to influence how developers and power users manage packages, emphasizing security and efficiency, especially in multi-platform environments.

Background of Homebrew’s Recent Developments

Homebrew has been the dominant package manager for macOS and Linux, regularly updating features to improve security, speed, and usability. Prior to version 6.0.0, the project introduced a JSON API for faster updates and began supporting macOS 27 early in its development cycle. The new tap trust system was announced as a security enhancement following concerns about third-party taps containing malicious code. Support for macOS 27, expected to drop Intel support entirely, reflects Apple’s transition to Apple Silicon and the shift away from x86 architecture. The project has also addressed security vulnerabilities through multiple advisories, reinforcing its commitment to safety and reliability.

“Homebrew 6.0.0 introduces a new tap trust mechanism, significantly enhancing security for users by requiring explicit trust before executing third-party code.”

— Homebrew team

Remaining Questions About Future Support and Security

It is still unclear how widely adopted the new tap trust system will become, or how it will impact third-party tap developers. The long-term effects of dropping Intel support for macOS 27 are also uncertain, particularly concerning existing hardware and third-party software compatibility. Additionally, while security advisories addressed recent vulnerabilities, ongoing security challenges in package management remain, and further updates may be needed to address emerging threats.

Upcoming Milestones and User Adoption Expectations

Following this release, Homebrew will likely focus on promoting the new tap trust system and gathering user feedback. Developers will monitor adoption rates and any issues arising from the new security measures. The project will also prepare for the full transition away from Intel support on macOS 27, expected by September 2027, and continue to refine sandboxing and performance features. Users should watch for further updates and security advisories in the coming months.

Key Questions

What is the tap trust system in Homebrew 6.0.0?

The tap trust system requires users to explicitly trust third-party taps before their code runs, enhancing security by preventing untrusted code execution.

How does the internal JSON API improve Homebrew?

The internal JSON API consolidates metadata into a single download, speeding up updates and reducing network usage.

Will Homebrew support macOS 27 fully?

Initial support is now available, but full support, including removal of Intel architecture, is planned for September 2027.

What security vulnerabilities were addressed in this release?

Vulnerabilities related to HTTPS redirects, Git hooks, and installer package handling were fixed to improve overall security.

Does this update affect Linux users?

Yes, Linux users benefit from sandboxing improvements that align Linux with macOS security standards, enhancing safety during package management.

Source: Hacker News