Homebrew 7.0.0 Drops Catalina, Demotes Intel Macs

Homebrew shipped version 7.0.0 on Sept. 13, according to the release post on the project's blog, ending support for macOS 10.15 Catalina and moving Intel-based Macs to what the project calls Tier 3, its lowest support level.

Tier 3 means no more prebuilt binary packages, known as bottles, for Intel machines going forward. Anyone still running Homebrew on Intel silicon keeps working software, but new formula versions without a bottle will compile from source locally, a process that can take minutes instead of seconds for large packages. The post is direct about the timeline: "Homebrew still runs on Intel until September 2027, without project support or routine bottle builds."

What else 7.0.0 changes

The release also drops the Ubuntu 22.04 Docker image in favor of ghcr.io/homebrew/brew, and it retires the Homebrew/actions@master branch that some third-party workflows still point at; those need to pin a CalVer release or a full commit SHA instead. On Linux, Homebrew swaps its Bubblewrap sandbox for the kernel's own Landlock feature, which the project says needs no extra dependencies and works without the extra Docker permissions Bubblewrap sometimes required.

	Homebrew before 7.0.0	Homebrew 7.0.0
Linux sandbox	Bubblewrap	Landlock (kernel-native)
Oldest supported macOS	10.15 Catalina	11 Big Sur
Intel Mac bottles	Built routinely	Tier 3, community only
Built-in vulnerability check	None	brew vulns

How the new vulnerability scanner actually works

The headline security feature is brew vulns, a command that checks installed formulae against a new advisory database built on OSV.dev, the open-source vulnerability format. The blog post says 7.0.0 also fixes eight security advisories of its own, ranging from low to high severity, and adds sandbox restrictions on application launching, Mach services and Unix socket connections that were not enforced before.

The scanner's coverage numbers come from the person who built it. Homebrew maintainer Andrew Nesbitt, writing on his own site in July about the infrastructure that ships in 7.0.0, said brew vulns "queries OSV's GIT ecosystem by repo URL, which covers about 73% of homebrew-core (6,210 of 8,492 formulae)," with matching against PyPI, npm and Maven registries plus Repology lookups for distro packages pushing total coverage to roughly 96 percent.

What the scanner still misses

Nesbitt's post is also the source for the gap. The remaining formulae, he wrote, "have no derivable GitHub, GitLab or Codeberg URL and are skipped" entirely. And the advisories that do exist are narrower than they sound: Homebrew's own advisory database, a separate CC0-licensed repository, held 33 records covering six formulae as of Nesbitt's writing, generated only from CVEs that "the formula's patch block declares through the resolves annotation or auto-infers from patch filenames and URLs." A CVE that a maintainer never annotated in Homebrew's own patch metadata will not show up in brew vulns, however serious it is upstream.

That is a narrower promise than Datasette's maintainers made after their own AI-assisted security audit turned up bugs their test suite had missed: Homebrew's tool depends on volunteers tagging fixes correctly, not on a model reading the code. The project's post is blunt about who is doing that tagging: "Homebrew is a non-profit project run entirely by volunteers, not employees."

Homebrew's advisory format is deliberately reusable rather than proprietary. Nesbitt described the JSON files as one per advisory, regenerated daily by a GitHub Actions workflow rather than hand-maintained, which is the same kind of infrastructure work that keeps open-source maintainers occupied when a project's security posture starts drawing outside scrutiny. Neither post gives a date for when advisory coverage might extend past six formulae.