The open-source package manager project has officially released Homebrew 6.0.0 with major security updates and performance improvements. This release introduces a new tap trust security mechanism alongside a default internal JSON API to accelerate package updates.
According to the project maintainers, the update addresses several security vulnerabilities while optimizing the installation process for developers. Users can access the update immediately through their terminal environments on macOS and Linux systems.
Security Enhancements in Homebrew 6.0.0
The primary security addition in Homebrew 6.0.0 is the tap trust mechanism. Because third-party taps contain unsandboxed Ruby code, the manager requires users to trust them before running their code. Official taps remain trusted by default, reducing risks associated with compromised repositories.
Additionally, the release addresses three specific security advisories. These include a redirect vulnerability in the POST download strategy and a root code execution risk via Git hooks. A local privilege escalation vulnerability was also resolved. The development team has also integrated a new subcommand, brew vulns, to help users audit their installed apps for known vulnerabilities.
Performance and API Upgrades
The update transitions the internal JSON API to the default setting. This change combines metadata into a single download, which reduces network requests and speeds up the update process. Consequently, the HOMEBREW_USE_INTERNAL_API environment variable is now deprecated.
Performance benchmarks show that the software is faster across multiple operations. Specifically, the brew leaves command is approximately 30% faster, and startup times have been reduced by loading fewer Ruby libraries. The project also concluded its experiment with a Rust-based frontend. Maintainers chose to focus performance efforts back on Ruby after benchmarks showed limited advantages for Rust.
Linux Sandboxing and Developer Defaults
For Linux users, Homebrew 6.0.0 introduces the Bubblewrap sandbox by default for developers. This aligns the Linux build, test, and postinstall phases with the existing sandboxing standards on macOS. The sandbox helps isolate installation processes to protect the host operating system.
Furthermore, developer defaults have been adjusted based on user survey results. The “ask mode” is now active by default for developers. This means commands like brew install will display a dependency summary and confirmation prompt before executing changes. The brew bundle utility also receives parallel formula installation by default and supports winget on Windows computers.
Future macOS Support and Deprecations
The release includes initial support for macOS 27 (Golden Gate). However, the maintainers noted that macOS 27 drops support for Intel hardware. As a result, Homebrew will move macOS Intel x86_64 to Tier 3 in September 2026. Support will end entirely by September 2027. This transition highlights the changing status of hardware compatibility for modern operating systems.
