Homebrew installs the stuff you need that Apple (or your Linux system) didn't. Homebrew installs packages to their own directory and then symlinks their files into /usr/local.

Homebrew won't install files outside its prefix and you can place a Homebrew installation wherever you like. Trivially create your own Homebrew packages. It's all Git and Ruby underneath, so hack away with the knowledge that you can easily revert your modifications and merge upstream updates.

Homebrew formulas are simple Ruby scripts.

What's New

Today, I'm proud to announce Homebrew 7.0.0. The most significant changes since 6.0.0 are faster installations and upgrades, stronger sandboxing, a native macOS app, built-in vulnerability checks and an advisory database, the end of macOS 10.15 support and Intel Macs moving to Tier 3.

Performance

  • Greater concurrency across downloads, preparation and installation maximises performance while coordinating failures and summaries.
  • brew install, brew reinstall and brew upgrade overlap package preparation and downloads, including brew bundle batches, reducing waits between packages and allowing a Brewfile to benefit from the same shared installation work as a command naming several packages.
  • brew config gathers independent system details concurrently, so compiler, operating-system and repository checks overlap instead of making diagnostic reports wait for every subprocess in turn.
  • brew tap-info --installed --json=v1 collects tap metadata concurrently, shortening inventory requests when several repositories need Git or network checks while preserving the output order expected by scripts.
  • brew cleanup avoids repeated cache scans, speeding up cleanup for installations with many packages.
  • brew fetch reads download information directly from API metadata for bottles and casks, starting downloads without loading complete package definitions merely to discover URLs and checksums.
  • brew update prepares Ruby caches so subsequent commands start faster.
  • Homebrew reuses parsed API data on warm runs while verifying signatures on every load, reducing preparation time for repeated package commands without dropping authenticity checks.
  • Homebrew launches fewer subprocesses during startup, reducing command overhead, and reads terminal dimensions directly, avoiding hangs with uutils stty.

Security

Homebrew 7.0.0 includes various security fixes and new installation protections. Security advisories. The first fixed releases are listed below.

  • GHSA-rg9r-ppxp-87hm, High, fixed in 6.0.12: unsigned cask-removal metadata could execute commands with sudo; all vulnerable recovery code and API accessors have been deleted.
  • GHSA-5263-whxq-77hp, Moderate, fixed in 7.0.0: a malicious cask could execute code outside the macOS install sandbox through LaunchServices; Homebrew restricts application launching, Mach services and Unix socket connections.
  • GHSA-hqpg-hjr9-c7j8, Moderate, fixed in 6.0.12: the macOS installer ignores prefix-owned Git configuration that could execute programs as root.
  • GHSA-x82f-cj53-gqfr, Low, fixed in 6.0.7: brew livecheck restricts redirects to prevent server-side request forgery.
  • GHSA-3m5g-jfx7-3p65, Low, fixed in 6.0.7: download redirects cannot forward secret headers to other hosts.
  • GHSA-r9gp-p4vv-f93x, Low, fixed in 6.0.6: Git redirects cannot bypass tap restrictions.
  • GHSA-9g4r-vmj2-j2gj, Low, fixed in 6.0.7: Subversion external URLs cannot become command options.
  • GHSA-r7qx-325v-4ccx, Low, fixed in 6.0.6: patch targets cannot escape the staged source tree.