Homebrew 7.0's announcement had reached 471 points and 176 comments on Hacker News when MrKeyoor's brief captured it. The more useful number for developers with Intel Macs is September 1, 2027. Homebrew has stopped producing new Intel bottles with this release and plans to stop running on the architecture on that date. A package manager upgrade has become a hardware and build-planning deadline.
The project released Homebrew 7.0.0 on September 13 with faster installation work, tighter sandboxes, a native macOS interface, and a vulnerability command. Those additions apply broadly, while several support cuts depend on the machine or CI image beneath brew. An automatic update will bring most users onto the new major version, so teams do not get a separate migration event unless they create one.
Intel Homebrew now means source builds
Intel Macs are now Tier 3. Homebrew says existing bottles remain available, but updated formulae may need to compile from source because routine Intel bottle production has ended. The software is expected to keep running until September 1, 2027, without project support during that interval; Homebrew's release notes point Intel users toward MacPorts if they need continuing binary package coverage.
That distinction matters in a developer fleet. A saved Intel bottle can keep an older install quick today, while the next formula revision may introduce a compiler run, extra build dependencies, or a failure that Apple Silicon users never see. The support table explicitly says "no new bottles", so testing only whether brew update succeeds misses the likely break point. Teams need to test their actual Brewfiles and upgrade paths on every Intel image they intend to retain.
The operating-system floor moved too. macOS Catalina 10.15 and earlier no longer run this Homebrew release. Sonoma 14 is Tier 3 and no longer receives new bottles, while the .pkg installer is Apple Silicon only and requires macOS Sequoia 15 or later. Apple Silicon machines on Big Sur 11 have until September 1, 2027, according to Homebrew's platform migration schedule. The CPU architecture alone no longer tells an administrator whether a machine follows the supported binary path.
The new vulnerability command has a coverage limit
Installed formulae and Brewfiles can now be checked with brew vulns. The command can filter for high severity, separate findings with and without an available fix, and report packages skipped because they came from untrusted taps. The release documentation says it queries OSV.dev and uses Homebrew package data to account for fixes carried as patches.
The companion advisory database deserves a careful reading before anyone treats that command as a complete software inventory scanner. Its own README calls it an early demo and says it currently covers CVEs that a homebrew-core formula's patch metadata declares or implies as resolved. The Homebrew ecosystem records were also not yet ingested by OSV.dev at publication time. A clean result therefore answers a bounded question about the database's current coverage. It does not prove that every installed package is free of known vulnerabilities.
The 7.0 release post also discloses eight Homebrew advisories, though only one was first fixed in 7.0.0. That moderate-severity issue allowed a malicious cask to escape the macOS install sandbox through LaunchServices. A high-severity issue involving unsigned cask-removal metadata was already fixed in 6.0.12. Homebrew's advisory list gives the first fixed version for each issue, a distinction for machines that may be on a late 6.x build rather than 7.0.
Sandboxing gets stricter, with a Linux exception
On macOS, package builds can no longer read the user's home directory by default. Homebrew is also moving dependency downloads into a networked fetch phase, followed by an install phase with networking disabled and caches mounted read-only. Signed, structured setup data reduces the amount of package Ruby evaluated during installation. Homebrew still warns that vendor .pkg installers run outside this sandbox and may request sudo; tap trust remains the main defense against malicious software.
Linux Homebrew replaces Bubblewrap with Landlock, removing a setup dependency and the need for elevated Docker permissions. The fallback is worth noticing: a kernel without Landlock continues to run Homebrew with no Linux sandbox, and brew doctor reports that state as an advisory. Homebrew's Linux notes say ABI 2, available on Linux 6.1, cannot enforce the network restrictions used by newer Landlock versions. Identical Brewfiles can therefore execute under different containment rules on different runners.
Faster installs come from overlapping work
The speed changes are mostly about concurrency and less repeated setup. brew install, reinstall, upgrade, and batched brew bundle runs can overlap downloads with package preparation. Homebrew also avoids repeated cache scans during cleanup, loads bottle and cask download details directly from API metadata, and reuses parsed API data on warm runs while checking signatures each time. The performance section lists the changed paths but gives no universal speed percentage, which is sensible for workloads that vary by package set, cache state, disk, and network.
The Hacker News response supplies an anecdotal signal, not a benchmark. One commenter said an update involving 31 outdated packages felt markedly faster; project lead Mike McQuaid replied that substantial work had gone into performance. The discussion also contains reports about platform-tier behavior, including a launch-day classification bug that McQuaid later said was fixed in 7.0.1. Community reports can help identify what to test, while the release notes remain the source for supported behavior.
Tap authors have a Ruby migration ahead
Formula post_install blocks and cask preflight, postflight, and uninstall flight blocks are deprecated. Official taps already reject the old hooks; third-party taps receive warnings until December 11, 2027. Their replacements are declared *_steps, which Homebrew can validate, sandbox, and deliver as signed data. The 7.0 migration guide maps mkdir to mkdir_p and mv to move, among other operation names.
For many definitions, brew style --fix can handle the common hook conversion. A tap with custom Ruby should be reviewed by a person because the new step vocabulary is deliberately narrower than arbitrary code. The maintainer notes also add default bottle attestations to newly generated tap workflows and allow Homebrew to verify supported third-party bottle attestations. The migration lets Homebrew inspect package setup before execution.
Check machines and automation separately
A short inventory can expose the immediate differences before a large Brewfile is touched. Homebrew 7's brew config reports platform details, brew doctor --json makes diagnostics easier to collect in automation, and brew install --dry-run previews formula and cask work together. A useful first pass is:
uname -m
sw_vers -productVersion
brew update
brew config
brew doctor --json
brew vulns --severity=high
CI has separate removals. The ghcr.io/homebrew/ubuntu22.04 image is gone in favor of ghcr.io/homebrew/brew, and Homebrew/actions/*@master references no longer work. Homebrew recommends a CalVer action release or a full commit SHA instead of a moving branch. These are listed in the release's CI migration table, so a laptop-only smoke test will not catch them.
The next evidence to watch is concrete: whether frequently updated formulae remain practical to build on Intel, and how quickly the Homebrew advisory database expands beyond patch-declared CVEs. The project has given Intel users a final runtime date, while the advisory repository still documents its missing OSV.dev integration. Those two moving parts will determine whether Homebrew 7 feels like a faster routine upgrade or the point when some machines and security workflows need replacements.