Homebrew 7.0.0 demotes Intel Macs and ships a built-in vulnerability scanner
The September 13 release raises the macOS floor to 11, moves Intel x86_64 to community support with no new bottles, removes the actions@master branch and the Ubuntu 22.04 image, and adds a CC0 advisory database behind a new brew vulns command. Most of it breaks something in CI.
Intel Macs to Tier 3, macOS 11 minimum, actions@master gone, and a new brew vulns scanner. Check your CI this week.
Homebrew, the package manager most Mac developers install first and most GitHub Actions macOS runners already have, shipped version 7.0.0 on September 13. Mike McQuaid, the project's lead maintainer, announced it on brew.sh. The release notes run to platform removals, a new sandbox, a new vulnerability scanner, and a deadline in 2027, and the project's own reason for the biggest change is one sentence: Apple and GitHub's retreat from Intel support "exceeds what Homebrew's volunteers can replace."
What breaks
- macOS 10.15 is out. The minimum is now macOS 11 Big Sur.
- Intel x86_64 Macs move to Tier 3: no new bottles, community support only, and Homebrew runs on Intel until September 1, 2027.
- The .pkg installer is Apple Silicon only and needs macOS Sequoia 15 or later.
- The Homebrew/actions repository no longer has a master branch. Workflows that reference @master have to pin a CalVer tag or a commit SHA.
- The Ubuntu 22.04 container image is gone.
- Third-party post_install and cask flight hooks are deprecated, with removal on December 11, 2027, in favor of declared steps the sandbox can validate.
What is new
brew vulns checks installed formulae against a new advisory database in OSV format, licensed CC0, and Help Net Security reports the filters: --severity=high, --deps, --fix-available. The database tracks which formula versions carry a backported fix, so the scanner stops flagging a patched build as vulnerable. On Linux, Landlock replaces Bubblewrap for sandboxing; it is kernel-level, needs no extra package, and asks for no escalated permissions. Formula and cask operations now run sandboxed, with home directory reads off by default and networking disabled during installation. Build attestations are verified for bottles from supported third-party taps.
brew vulns --severity=highThe rest is speed and surface. Downloads and installs run concurrently, brew config gathers system details in parallel, and startup launches fewer subprocesses. brew install gains --dry-run. brew services can take environment overrides from config files. And there is a native macOS app, BrewUI, in its own repository. Help Net Security counts eight security advisories published alongside the release: one High, a sudo execution path through unsigned cask metadata whose fix shipped in 6.0.12, plus two Moderate and five Low. A 7.0.1 point release followed later the same day.
Why a build studio cares
Two of the six breaking changes hit us directly, and they will hit anyone with a macOS CI job. Any workflow that references Homebrew/actions@master stops on its next run, and the fix is a one-line pin, so do it before the run fails rather than after. The Intel demotion is slower and more expensive: an Intel Mac mini in a build closet gets no new bottles from today and no Homebrew at all from September 2027, which is the real end-of-life date for that hardware regardless of what Apple says.
The scanner is the part we will fold into audits. brew vulns against a developer machine or a runner is a cheap first pass on the dependency question a Surface Audit asks, and the CC0 database means we can pull the advisory list into a report without a licensing conversation.
Next step: read the release post and the 7.0.0 migration guide, then check every macOS workflow for @master and every Intel runner for a retirement date. If your CI is a pile of Homebrew formulae nobody has audited, write to us at hello@gattyworks.com.