Homebrew 7.0.0

7.0.0 13 September 2026 MikeMcQuaid Today, I’m proud to announce Homebrew 7.0.0. The most significant changes since 6.0.0 are faster installations and upgrades, stronger sandboxing, a native macOS app, built-in vulnerability checks and an advisory database, the end of macOS 10.15 support and Intel Macs moving to Tier 3. 2026 年 9 月 13 日，MikeMcQuaid：今天，我很荣幸地宣布 Homebrew 7.0.0 正式发布。自 6.0.0 版本以来，最显著的变化包括：更快的安装与升级速度、更强的沙盒机制、原生的 macOS 应用程序、内置漏洞检查及建议数据库，同时停止了对 macOS 10.15 的支持，并将 Intel 架构的 Mac 移至三级（Tier 3）支持。

⬆️ Upgrading

⬆️ 升级

An auto-update or manual brew update (if you have $HOMEBREW_NO_AUTO_UPDATE set) will upgrade Homebrew for you. Now means 7.0.0. Deprecated interfaces warn until disablement; disabled interfaces reject use and removed interfaces are unavailable. 通过自动更新或手动执行 brew update（如果您设置了 $HOMEBREW_NO_AUTO_UPDATE），即可将 Homebrew 升级至 7.0.0 版本。已弃用的接口在被禁用前会发出警告；被禁用的接口将拒绝执行；而已移除的接口则无法再使用。

🏎️ Performance

🏎️ 性能

Greater concurrency across downloads, preparation and installation maximises performance while coordinating failures and summaries. brew install, brew reinstall and brew upgrade overlap package preparation and downloads, including brew bundle batches, reducing waits between packages and allowing a Brewfile to benefit from the same shared installation work as a command naming several packages. 通过在下载、准备和安装过程中实现更高的并发性，在协调错误处理和汇总的同时最大化了性能。brew install、brew reinstall 和 brew upgrade 现在可以重叠处理软件包的准备与下载工作（包括 brew bundle 批处理），从而减少了软件包之间的等待时间，并使 Brewfile 能像同时安装多个软件包的命令一样，受益于共享的安装工作流。

brew config gathers independent system details concurrently, so compiler, operating-system and repository checks overlap instead of making diagnostic reports wait for every subprocess in turn. brew tap-info —installed —json=v1 collects tap metadata concurrently, shortening inventory requests when several repositories need Git or network checks while preserving the output order expected by scripts. brew config 现在可以并发收集独立的系统详细信息，因此编译器、操作系统和仓库检查可以并行执行，无需让诊断报告等待每一个子进程依次完成。brew tap-info --installed --json=v1 可以并发收集 Tap 元数据，在多个仓库需要进行 Git 或网络检查时缩短了清单请求时间，同时保持了脚本所预期的输出顺序。

brew cleanup avoids repeated cache scans, speeding up cleanup for installations with many packages. brew fetch reads download information directly from API metadata for bottles and casks, starting downloads without loading complete package definitions merely to discover URLs and checksums. brew update prepares Ruby caches so subsequent commands start faster. Homebrew reuses parsed API data on warm runs while verifying signatures on every load, reducing preparation time for repeated package commands without dropping authenticity checks. Homebrew launches fewer subprocesses during startup, reducing command overhead, and reads terminal dimensions directly, avoiding hangs with uutils stty. brew cleanup 避免了重复的缓存扫描，加快了拥有大量软件包的安装环境的清理速度。brew fetch 直接从 Bottle 和 Cask 的 API 元数据中读取下载信息，无需加载完整的软件包定义即可开始下载，仅为了获取 URL 和校验和。brew update 会预先准备 Ruby 缓存，从而加快后续命令的启动速度。Homebrew 在热启动时会重用已解析的 API 数据，同时在每次加载时验证签名，在不降低真实性检查的前提下减少了重复软件包命令的准备时间。Homebrew 在启动时启动的子进程更少，降低了命令开销，并直接读取终端尺寸，避免了使用 uutils stty 时可能出现的挂起问题。

🔒 Security

🔒 安全

Homebrew 7.0.0 includes various security fixes and new installation protections. Homebrew 7.0.0 包含了多项安全修复和全新的安装保护机制。

Security advisories

安全建议

The first fixed releases are listed below. 以下列出了首批修复的版本：

GHSA-rg9r-ppxp-87hm (High, fixed in 6.0.12): unsigned cask-removal metadata could execute commands with sudo; all vulnerable recovery code and API accessors have been deleted. GHSA-rg9r-ppxp-87hm（高危，在 6.0.12 中修复）： 未签名的 Cask 移除元数据可能以 sudo 权限执行命令；所有易受攻击的恢复代码和 API 访问器已被删除。
GHSA-5263-whxq-77hp (Moderate, fixed in 7.0.0): a malicious cask could execute code outside the macOS install sandbox through LaunchServices; Homebrew restricts application launching, Mach services and Unix socket connections. GHSA-5263-whxq-77hp（中危，在 7.0.0 中修复）： 恶意的 Cask 可能通过 LaunchServices 在 macOS 安装沙盒之外执行代码；Homebrew 现已限制了应用程序启动、Mach 服务和 Unix 套接字连接。
GHSA-hqpg-hjr9-c7j8 (Moderate, fixed in 6.0.12): the macOS installer ignores prefix-owned Git configuration that could execute programs as root. GHSA-hqpg-hjr9-c7j8（中危，在 6.0.12 中修复）： macOS 安装程序会忽略由前缀所有者拥有的 Git 配置，这可能导致以 root 权限执行程序。
GHSA-x82f-cj53-gqfr (Low, fixed in 6.0.7): brew livecheck restricts redirects to prevent server-side request forgery. GHSA-x82f-cj53-gqfr（低危，在 6.0.7 中修复）： brew livecheck 限制了重定向，以防止服务器端请求伪造（SSRF）。
GHSA-3m5g-jfx7-3p65 (Low, fixed in 6.0.7): download redirects cannot forward secret headers to other hosts. GHSA-3m5g-jfx7-3p65（低危，在 6.0.7 中修复）： 下载重定向无法将机密标头转发给其他主机。
GHSA-r9gp-p4vv-f93x (Low, fixed in 6.0.6): Git redirects cannot bypass tap restrictions. GHSA-r9gp-p4vv-f93x（低危，在 6.0.6 中修复）： Git 重定向无法绕过 Tap 限制。
GHSA-9g4r-vmj2-j2gj (Low, fixed in 6.0.7): Subversion external URLs cannot become command options. GHSA-9g4r-vmj2-j2gj（低危，在 6.0.7 中修复）： Subversion 外部 URL 无法成为命令选项。
GHSA-r7qx-325v-4ccx (Low, fixed in 6.0.6): patch targets cannot escape the staged source tree. GHSA-r7qx-325v-4ccx（低危，在 6.0.6 中修复）： 补丁目标无法逃逸出暂存的源代码树。

Installation and tap protection

安装与 Tap 保护

Tap trust remains the primary protection against malicious third-party casks; sandboxing mainly limits accidental damage and adds installation safeguards. It cannot make untrusted software safe to run: applications execute with the user’s privileges, and vendor .pkg installers run outside the sandbox and may require sudo. We balance tighter restrictions with keeping existing software working. Tap 信任仍然是防范恶意第三方 Cask 的主要保护手段；沙盒机制主要用于限制意外损坏并增加安装安全保障。它无法使不受信任的软件变得安全：应用程序仍以用户权限执行，且供应商提供的 .pkg 安装程序在沙盒外运行，可能需要 sudo 权限。我们在加强限制与保持现有软件正常运行之间取得了平衡。

Homebrew delivers structured setup as signed data and sandboxes formula and cask operations, reducing arbitrary Ruby execution and repeated package loading. Homebrew begins migrating dependency downloads into a fetch phase: migrated formulae download with network access and writable caches, then install disables networking and makes those caches read-only; migration remains ongoing. Homebrew blocks sandboxed reads of the home directory by default, keeping unrelated personal files outside package builds while allowing required Homebrew paths. Homebrew 以签名数据的形式提供结构化设置，并对 Formula 和 Cask 操作进行沙盒化，减少了任意 Ruby 代码的执行和重复的软件包加载。Homebrew 开始将依赖项下载迁移到“获取（fetch）”阶段：已迁移的 Formula 在下载时拥有网络访问权限和可写缓存，随后安装阶段会禁用网络并将这些缓存设为只读；此迁移工作仍在进行中。Homebrew 默认阻止沙盒读取主目录，将无关的个人文件排除在软件包构建之外，同时允许访问必要的 Homebrew 路径。