Homebrew 7.0.0 Gets Built-In GUI, Better Security Controls

Homebrew 7.0.0 Ships With a Native GUI and a Built-In Vulnerability Scanner

Homebrew, the widely-used package manager for macOS and Linux (49k GitHub stars, roughly 11k forks), released version 7.0.0 on September 13, 2026 — its first major version since June's 6.0.0. The release pairs two headline user-facing features, a fully-released native graphical interface called BrewUI and a built-in vulnerability scanner (brew vulns), with a set of security-hardening changes to sandboxing and two patched vulnerabilities.

The announcement carried the byline of longtime project lead Mike McQuaid. BleepingComputer covered the release on September 14, 2026, noting that Homebrew's popularity has made it a recurring target for threat actors distributing info-stealer malware through fake/clone sites and ClickFix-style social-engineering campaigns — context that makes built-in supply-chain-risk tooling directly relevant to the project's user base.

Release Summary

What's New

BrewUI: Now Fully Released

Homebrew's official graphical interface, previously in preview, is now a full release. It's a native macOS application installed with:

brew install homebrew-app

BrewUI requires macOS Tahoe 26 or later and brings package browsing, search, installed-version details, and dependency information into a single window. A notable design choice: the app displays the underlying brew command for each action it performs, so users moving between the GUI and the terminal can see exactly what command their click would map to.

brew vulns: A Built-In Vulnerability Scanner

Homebrew now ships a native vulnerability scanner that checks installed formulae against OSV.dev without requiring a separate tap or gem. It's backed by a new Homebrew-specific advisory database that records vulnerabilities against the exact formula versions and revisions Homebrew ships, including backported security fixes — and the project says its OSV-format records are freely reusable under CC0, so external security tools and teams can consume the same data.

The command supports targeted scanning through flags including:

• --severity=high — filter by severity
• --deps — include dependencies in the scan
• --brewfile — scan packages declared in a Brewfile
• --fix-available / --no-fix-available — filter to vulnerabilities with or without an available fix
• --list-skipped — show formulae skipped because they come from untrusted taps

Sandboxing: Landlock Replaces Bubblewrap on Linux

Linux sandboxing moves from Bubblewrap to the kernel-native Landlock security module, which the project says eliminates a class of dependency and permission complications Bubblewrap introduced. The new sandboxing supports Landlock ABI 2 on Linux 6.1 and later; on kernels without Landlock support, Homebrew continues to function but with reduced sandbox protections, and brew doctor now reports this as an advisory rather than a silent gap.

Two Vulnerabilities Patched

The release notes recap two security fixes:

• GHSA-rg9r-ppxp-87hm — unsigned cask-removal metadata could be used to execute commands with sudo. This was already fixed in Homebrew 6.0.12.
• GHSA-5263-whxq-77hp — malicious casks could execute code outside the macOS install sandbox via LaunchServices. This is newly fixed in 7.0.0, and the fix adds restrictions on application launching, Mach services, and Unix socket connections during cask installs.

Default Security Hardening

Beyond the two named CVEs, Homebrew 7.0.0 tightens default behavior: home directory access is now blocked by default during package operations, and dependency downloads are now isolated from the offline installation step — separating network-enabled and network-free phases of an install.

Platform and Support Changes

• macOS 10.15 (Catalina) and earlier are no longer supported — macOS 11 or later is now required.
• Intel Macs move to Tier 3 support: existing bottles remain available, but formulae updated going forward may require building from source on Intel hardware. Homebrew points Intel holdouts toward MacPorts as an alternative, ahead of Apple and GitHub Actions dropping Intel support entirely by late 2027.
• The .pkg installer is now Apple Silicon-only and requires macOS Sequoia 15 or later.

Deprecated Install Hooks

Formula post_install blocks and cask preflight/postflight-style flight blocks are deprecated in favor of declared *_steps. Homebrew's official taps already reject the legacy hooks; third-party taps have until December 11, 2027 before the old syntax stops working. brew style --fix can auto-convert common patterns, though some migrations will require manually rewriting block contents as declared steps.

Performance Improvements

brew install, reinstall, and upgrade now overlap package downloads with preparation instead of running them sequentially. brew config gathers system details concurrently, brew cleanup avoids repeated cache scans, and brew fetch reads package metadata directly from APIs instead of loading full formula definitions — together speeding up routine update and install operations.

Why It Matters For Security

Homebrew sits in the dependency chain of a large share of macOS and Linux developer workstations, which is precisely why it has become a repeat target for info-stealer campaigns using fake Homebrew sites and ClickFix-style clipboard-hijacking lures to trick users into running malicious install commands. Built-in tooling like brew vulns lowers the bar for developers and security teams to check whether the packages they've already installed carry known vulnerabilities, without needing a separate SCA tool or third-party tap.

The sandboxing shift from Bubblewrap to Landlock also matters beyond convenience: Landlock is a Linux kernel security module, so enforcement happens closer to the OS rather than relying entirely on a userspace sandboxing layer. And the newly-patched LaunchServices sandbox escape (GHSA-5263-whxq-77hp) closes a real path by which a malicious cask could have broken out of Homebrew's install-time sandbox — the kind of flaw that matters specifically because Homebrew installs run with a user's own privileges on developer machines that often hold credentials, SSH keys, and cloud access.

How to Upgrade

• Run brew update && brew upgrade to pick up 7.0.0 on an existing Homebrew install.
• To get the native GUI, run brew install homebrew-app (macOS Tahoe 26+ required).
• After upgrading, run brew vulns to scan currently installed formulae for known vulnerabilities.
• Confirm your OS meets the new minimums: macOS 11+ is required, and Intel Mac users should note the move to Tier 3 support.
• Users still relying on post_install or cask flight blocks in custom taps should begin migrating to declared *_steps ahead of the December 11, 2027 cutoff.

Sources

• BleepingComputer — Homebrew 7.0.0 gets built-in GUI, better security controls
• Homebrew — 7.0.0 release announcement