Homebrew 7.0.0 lands with concurrent installs, tighter sandboxing, and CVE checks

Homebrew’s first major release since 6.0.0 leans hard on performance and security. Installs, reinstalls, and upgrades now overlap downloads and package preparation, so multi-package commands and Brewfile batches share work instead of running one package at a time. Diagnostic and inventory commands like brew config and brew tap-info gather system details concurrently, brew fetch reads URLs and checksums straight from API metadata, and warm runs reuse parsed API data while still verifying signatures on every load.

On the security side, the release ships stronger sandboxing for formula and cask operations, a fetch/install split that cuts off network access and makes caches read-only during builds, and default blocking of sandboxed reads from the home directory. It also bundles an advisory database and built-in vulnerability checks, backed by a run of fixed GHSA advisories — most notably a high-severity flaw where unsigned cask-removal metadata could run commands under sudo (fixed in 6.0.12) and a cask sandbox escape via LaunchServices (fixed in 7.0.0). Homebrew is candid that sandboxing mainly limits accidental damage: tap trust remains the real defense, since apps still run with user privileges and vendor .pkg installers execute outside the sandbox.

The release also brings a native macOS app, clearer command output (dry-run previews, uninstallable-vs-uninstalled markers in brew info, JSON diagnostics for automation), and persistent per-service config overrides that survive upgrades. Platform support tightens: macOS 10.15 is dropped, and Intel x86_64 Macs move to Tier 3 in September 2026, an end-of-the-road signal that was telegraphed a year in advance.