Homebrew 6.0 is the most important release in the package manager's history because it makes one fundamental change: a third-party tap can no longer run its Ruby code on your machine until you explicitly trust it. Announced 11 June 2026 by maintainer MikeMcQuaid, Homebrew 6.0 introduced "tap trust" — a security gate that kills the default of executing arbitrary code from any GitHub repository you add to your tap list [1]. For anyone installing developer tooling on a Mac — whether you are a solo builder setting up local AI on your computer or a team managing CI pipelines — this single change shifts Homebrew from an open convenience to a checkpoint where code has to earn its place on the machine.
- Biggest change: Third-party taps require explicit trust (
brew trust) before their Ruby code runs — official taps remain trusted by default. - New prompts: "Ask mode" is now the default for developers —
brew installandbrew upgradeshow a dependency summary and ask for confirmation [1]. - New commands:
brew exec(run once, like npx),brew vulns(scan installed packages for CVEs),brew trust/brew untrust(manage tap trust). - Security patches: Three advisories patched — including root code execution via Git hooks in the macOS .pkg installer [1].
- CI breaking change:
brew doctornow warns about untrusted taps — pipelines that auto-runbrew doctoras a first step may fail [2][3]. - Intel deprecation: macOS Intel x86_64 moves to Tier 3 in September 2026 (no new bottles), unsupported entirely by September 2027 [1].
- Rust rewrite shelved: The brew-rs experiment concluded; performance focus is back on Ruby [1].
What Is Homebrew 6.0's Tap Trust and Why Does It Matter?
Tap trust is Homebrew 6.0's headline security feature: when you add a third-party tap (someone else's package repository), Homebrew refuses to evaluate or run any Ruby code from that tap until you explicitly approve it with brew trust [1][2]. Official Homebrew taps — the core formulae, casks, and built-in commands — remain trusted by default, so day-to-day brew install from the main repositories is unchanged.
Before 6.0, adding any tap meant Homebrew would load and execute its Ruby code as part of normal operations — resolving dependencies, discovering packages, or running commands [2]. That code ran with your user's privileges and without any sandboxing. In an era where package managers are the top target for supply-chain attacks — npm, PyPI, and RubyGems have all seen high-profile compromises — silently running code from any GitHub repository was a risky default. Tap trust narrows that surface: if a tap's repository gets compromised, the attacker's code does not run just because the tap is present on your machine [2]. The same supply-chain logic that makes autonomous AI agents attacking systems a real threat in 2026 applies here — the weakest link is often the code you let in without checking it.
Key distinction: you can trust an entire tap (all current and future formulae, casks, and commands from it) or only a specific formula, cask, or command [2]. Homebrew's documentation recommends trusting only the specific items you need, especially for one-off installs or software from vendors you do not fully control [2].
How Do You Use brew trust to Trust a Third-Party Tap?
Trust works at two granularities: the whole tap, or individual items within it [2]. Here is how each works in practice.
Trusting a whole tap
# Add the tap
brew tap user/repository
# Trust the entire tap (all formulae, casks, and commands)
brew trust user/repository
# Now install normally
brew install formula
Whole-tap trust is appropriate for taps you administer or use frequently. It allows Homebrew to load every current and future formula, cask, and external command from that tap [2].
Trusting only a specific formula or cask
# Add the tap
brew tap user/repository
# Trust only the specific formula
brew trust --formula user/repository/formula
# Now install by short name
brew install formula
For casks, use brew trust --cask user/repository/cask. For external commands, use brew trust --command user/repository/command [2].
Installing a fully qualified formula (trust-as-you-go)
# This trusts only that single item, does NOT trust the whole tap
brew install user/repository/formula
Installing a fully qualified name (i.e., user/repository/formula) trusts only that item, not the rest of the tap [2]. This is the safest approach for one-off installs.
Managing trust
# List all trusted entries
brew trust
# List all untrusted taps, formulae, casks, and commands
brew untrust
# Stop trusting a tap or item
brew untrust user/repository
brew untrust --formula user/repository/formula
What Other Security Changes Are in Homebrew 6.0?
Beyond tap trust, Homebrew 6.0 shipped three security advisory patches and a bundle of hardening changes [1]. The three advisories are:
| Advisory ID | Issue | Fix |
|---|---|---|
| GHSA-7699-qf8c-q47m | POST download strategy bypassed HTTPS-to-HTTP redirect protection by discarding the resolved URL [1] | Enforced secure redirects |
| GHSA-6689-q779-c33m | Root code execution possible via Git hooks in the macOS .pkg postinstall [1] | Cleaned Homebrew git state and replaced the installer git directory |
| GHSA-59v8-x8q4-px5c | macOS installer package trusted a user-controlled /var/tmp plist and could assign Homebrew ownership to a local attacker [1] |
Rewrote .pkg package-user plist handling |
Additional hardening in 6.0 [1]:
- Sensitive environment variables are now filtered during Ruby evaluations;
HOMEBREW_*secrets are deferred to download time. - Forbidden checks for casks and formulae now run before download.
- You can require checksums for casks with
HOMEBREW_CASK_OPTS_REQUIRE_SHA. - Download cooldowns for Bundler, RubyGems, npm, and pip to avoid upstream supply-side risks.
How Does Ask Mode Work in Homebrew 6.0?
Ask mode, informed by Homebrew's user survey, is now the default for developers [1]. When you run brew install or brew upgrade, Homebrew first lays out a summary of everything it is about to install — including all dependencies — and waits for your confirmation before proceeding [1].
Key details [1]:
- You can confirm with a single keypress — no need to type "y" and hit Enter.
- If there is nothing to upgrade, the prompt is skipped entirely.
- A final summary is printed after all upgrades complete.
HOMEBREW_NO_INSTALL_FROM_APIand related opt-out variables are deprecated; ask mode is baked into the default.
For anyone familiar with apt on Ubuntu or pacman on Arch Linux, this mirrors the confirm-before-install pattern that those systems have had for years. Homebrew was previously the outlier — it would silently install whatever dependencies a formula required.
What Are the New brew exec and brew vulns Commands?
brew exec — run once, like npx
brew exec is a new command that runs a Homebrew-provided executable in a formula's environment without permanently installing it [1]. It works like npx for npm packages: you get the tool's runtime, dependencies, and PATH set up automatically, used once, then discarded.
This is useful when you need a tool for a single task — a linter, a code formatter, or a one-off CLI utility — and do not want it lingering on your system afterward. It is the same disposable-tool philosophy that makes npx popular for running Claude Code or similar developer tools ad hoc.
brew vulns — scan installed packages for CVEs
brew vulns is a new Homebrew tap and subcommand that checks your installed packages against known security advisories [1]. It scans the packages you already have on your machine and flags any that appear in published CVE databases.
How Is brew update Faster in Homebrew 6.0?
The internal JSON API is now the default, replacing the old approach of cloning Git repositories and making multiple network calls to fetch package metadata [1]. The result: all Homebrew's metadata — every formula, cask, and dependency mapping — comes down in a single JSON download instead of a dozen small network trips [1].
This was opt-in since 5.0.0 via HOMEBREW_USE_INTERNAL_API; that environment variable is now deprecated as the behavior is baked in [1]. Combined with parallelised bottle tab fetching and startup performance tweaks including ~30% faster brew leaves, brew update is noticeably quicker [1].
Homebrew 6.0 Breaking Changes: What Breaks and How to Fix It
CI pipelines that auto-run brew doctor
The most widely reported breakage: brew doctor now warns about untrusted taps, and if your CI pipeline runs brew doctor as a first step — which a vast number of GitHub Actions do [3] — the new warning causes a non-zero exit code and the build fails [3].
Fix: Trust the specific taps you need in your CI config before running brew doctor:
brew tap user/repository
brew trust user/repository
brew doctor
Alternatively, for legacy taps you cannot modify, you can temporarily disable the requirement:
export HOMEBREW_NO_REQUIRE_TAP_TRUST=1
Homebrew notes this opt-out is temporary and will be removed in a later release [2]. For production CI, the correct fix is to trust the taps you use, not to disable the guard.
Scripts that assume brew install never asks
If you have scripts, dotfile setups, or automation that runs brew install without a --yes or non-interactive flag, the new ask-mode prompt can cause the script to hang indefinitely waiting for input [1].
Fix: For scripts that need silent installs, pipe yes into the command, or set the appropriate non-interactive environment variable. Check the Homebrew docs for the current flags, as ask mode is a new default that may affect automation in unexpected environments.
Intel Mac Support Timeline: When Does Homebrew Drop Intel?
Homebrew 6.0 spells out the retirement schedule for Intel Mac support [1]:
| Date | What happens |
|---|---|
| September 2026 | macOS Intel x86_64 moves to Tier 3 — no CI support, no new bottles (binary packages) built [1] |
| September 2027 | macOS Intel x86_64 is unsupported entirely; all related code is deleted [1] |
Apple Silicon users are unaffected. Homebrew 6.0 also adds CPU recognition for the new M5 and M5 Pro/Max chips [1].
This timeline exists because macOS 27 (Golden Gate) — which Homebrew 6.0 begins preparing for with initial support [1] — drops Intel availability. Homebrew cannot maintain bottles for a platform Apple itself no longer ships.
Is Homebrew Being Rewritten in Rust?
No. The brew-rs experiment, which explored moving parts of Homebrew's Ruby frontend to Rust, has concluded [1]. Benchmarks showed the Rust frontend was only ahead on narrow, already-cached bottle fetches — not on representative full installs involving pouring bottles, linking, writing metadata, and running health checks [1]. Performance focus has moved back to the Ruby codebase, specifically to starting useful network and disk I/O sooner [1].
Should You Upgrade to Homebrew 6.0?
For almost everyone, yes. You are getting three security patches, tap trust, faster updates, and new commands — and brew update will upgrade you to 6.0 regardless [1].
The one group that should prepare first: anyone running CI that touches third-party taps or automation that expects silent installs. Trust your taps, fix your scripts, then upgrade. If you are on an Intel Mac, plan for the September 2026 Tier 3 transition [1].
Quick upgrade checklist
- Check your taps: Run
brew tapto list every third-party tap you use. - Trust critical taps in CI: For CI pipelines, add
brew trust user/repositoryfor each tap beforebrew doctor. - Fix silent scripts: Identify any scripts that call
brew installnon-interactively and add the appropriate non-interactive flags. - Upgrade: Run
brew update && brew upgrade. - Verify: Run
brew doctor— it should pass clean once your taps are trusted.
What This Means for You
If you are a developer or small business running macOS workstations, Homebrew 6.0 makes your default install posture safer without changing your day-to-day workflow for official packages. Whether your Mac runs Hermes Agent or ChatGPT desktop agents, the security threat surface — arbitrary Ruby execution from repos you found in a README — is now gated behind an explicit decision. The breakage is limited to automation that made assumptions Homebrew no longer guarantees.
If you manage CI pipelines, the tap trust change is your action item: audit your taps, trust the ones you use in config, and avoid the HOMEBREW_NO_REQUIRE_TAP_TRUST=1 escape hatch except as a temporary measure while you migrate [2].
If you are on an Intel Mac, September 2026 is your notice: plan to move to Apple Silicon or pin to existing bottles before Tier 3 hits [1].
FAQ
Q: Does Homebrew 6.0's tap trust affect official Homebrew taps? A: No. Official Homebrew taps (homebrew/core, homebrew/cask) and built-in commands are always trusted by default. Tap trust only applies to non-official (third-party) taps you add yourself [1][2].
Q: Can I disable tap trust if it breaks my workflow?
A: Yes, temporarily. Setting HOMEBREW_NO_REQUIRE_TAP_TRUST=1 disables the trust requirement, but Homebrew explicitly warns this is not recommended and will be removed in a later release. The proper fix is to brew trust the taps you actually use [2].
Q: Why did my CI pipeline break after upgrading to Homebrew 6.0?
A: brew doctor now warns about untrusted third-party taps, and if your CI treats brew doctor warnings as errors, the build fails. Fix it by running brew trust user/repository for each tap your pipeline uses before invoking brew doctor [2][3].
Q: What is the difference between brew exec and brew install?
A: brew exec runs a formula's executable once in its environment without permanently installing it (like npx for npm). brew install permanently installs a package and its dependencies to your system [1].
Q: How do I check my installed Homebrew packages for known vulnerabilities?
A: Run brew vulns, a new subcommand in Homebrew 6.0 that scans installed packages against known security advisories [1].
Q: Will Homebrew 6.0 work on my Intel Mac? A: Yes, for now. Intel macOS (x86_64) moves to Tier 3 in September 2026 (no new bottles, no CI) and becomes unsupported entirely in September 2027. Apple Silicon including M5 chips is fully supported [1].
Discussion
0 comments