Jekyll2026-03-13T08:22:04+00:00https://brew.sh/atom.xmlHomebrewThe Missing Package Manager for macOS (or Linux).5.1.02026-03-10T00:00:00+00:002026-03-10T00:00:00+00:00https://brew.sh/2026/03/10/homebrew-5.1.0Homebrew 5.1.0 has been released. Homebrew’s most significant changes since 5.0.0 are expanded brew bundle support, brew version-install, new -full formula handling and installer updates.

Major changes and deprecations since 5.0.0:

Upcoming changes:

Homebrew’s other changes since 5.0.0 worth highlighting are the following:

Finally:

Homebrew thanks all our hard-working maintainers, contributors, sponsors and supporters for getting us this far.

]]>MikeMcQuaid5.0.02025-11-12T00:00:00+00:002025-11-12T00:00:00+00:00https://brew.sh/2025/11/12/homebrew-5.0.0Today, I’d like to announce Homebrew 5.0.0. The most significant changes since 4.6.0 are download concurrency by default, official support for Linux ARM64/AArch64, timescales for deprecating macOS Intel and removing macOS Gatekeeper bypass behaviours.

Major changes and deprecations since 4.6.0:

Other changes since 4.6.0 I’d like to highlight are the following:

Finally:

Thanks to all our hard-working maintainers, contributors, sponsors and supporters for getting us this far.

]]>MikeMcQuaid4.6.02025-08-05T00:00:00+00:002025-08-05T00:00:00+00:00https://brew.sh/2025/08/05/homebrew-4.6.0Today, I’d like to announce Homebrew 4.6.0. The most significant changes since 4.5.0 are opt-in concurrent downloads with HOMEBREW_DOWNLOAD_CONCURRENCY, preliminary macOS 26 (Tahoe) support and a built-in brew mcp-server.

Major changes and deprecations since 4.5.0:

Other changes since 4.5.0 I’d like to highlight are the following:

Finally:

Thanks to all our hard-working maintainers, contributors, sponsors and supporters for getting us this far.

]]>MikeMcQuaid4.5.02025-04-29T00:00:00+00:002025-04-29T00:00:00+00:00https://brew.sh/2025/04/29/homebrew-4.5.0Today, I’d like to announce Homebrew 4.5.0. The most significant changes since 4.4.0 are major improvements to brew bundle/services, preliminary Linux support for casks, official Support Tiers, Tier 2 ARM64 Linux support, Ruby 3.4 and several deprecations.

Major changes and deprecations since 4.4.0:

brew bundle and brew services

Linux casks

Support Tiers

ARM64 Linux

Ruby

Deprecations

Other changes since 4.4.0 I’d like to highlight are the following:

Finally:

Thanks to all our hard-working maintainers, contributors, sponsors and supporters for getting us this far.

]]>MikeMcQuaidHomebrew’s new git signing key2025-02-03T00:00:00+00:002025-02-03T00:00:00+00:00https://brew.sh/2025/02/03/Homebrew-git-signingOver the next few days, Homebrew’s repositories will begin to transition from PGP-based signing to SSH-based signing for @BrewTestBot commits.

As part of this change, we will be rotating our @BrewTestBot’s key. This rotation should not affect most users, but you may notice it if you currently manually verify git commits from Homebrew/brew, Homebrew/homebrew-core, or similar.

Once all repositories have been transitioned, we will revoke the old PGP key to prevent unintended future use:

  • Main key: 3C76C3F1E573FA9E
  • Signing subkey: 82D7D104050B0F0F

The new SSH signing key has the following public half:

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE0QzQJ6gl6Yxru0QrSaDRNatiHajcKxDu9lxQrFl8Nw

Users can also discover this signing key programmatically through GitHub’s REST API:

$ gh api /users/BrewTestBot/ssh_signing_keys
[
  {
    "id": 475371,
    "key": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE0QzQJ6gl6Yxru0QrSaDRNatiHajcKxDu9lxQrFl8Nw",
    "title": "BREWTESTBOT_SSH_SIGNING_KEY",
    "created_at": "2025-02-03T17:50:27.377+01:00"
  }
]
]]>woodruffwHomebrew and Workbrew2024-11-19T00:00:00+00:002024-11-19T00:00:00+00:00https://brew.sh/2024/11/19/homebrew-and-workbrewHomebrew is pleased to congratulate Workbrew on their 1.0 launch today. Workbrew is a company founded by several Homebrew members and the Project Leader, @MikeMcQuaid, to use Homebrew as the foundation of a secure software delivery platform. Workbrew’s product is out of beta and ready to solve your workplace’s problems with securing Homebrew at scale, so go check it out!

We understand that the community will, rightly, have questions. You’ll find some answers below. This relationship is mutually beneficial: Workbrew employees work on Homebrew during working hours, and Workbrew sponsors Homebrew on GitHub Sponsors. Workbrew’s founders care deeply about the success and independence of Homebrew.

Homebrew itself is and will always remain open source and free (as in speech and beer 🍺).

Homebrew and Workbrew FAQs

Homebrew is an open source project and part of the non-profit Open Source Collective run by unpaid volunteers (bar a small $300/month stipend for opted-in active maintainers).

Workbrew is a product (with paid tiers) and company run by founders and employees.

At the time of writing, some of Homebrew and Workbrew’s leadership overlap (@MikeMcQuaid, @mozzadrella) and Workbrew employs some Homebrew maintainers (@Bo98, @carlocab).

Is Workbrew in control of Homebrew?

No. Homebrew has an independent governance structure that can only be changed through a supermajority of votes cast. Homebrew’s Project Leadership Committee (PLC) restricts any employer (including Workbrew) from holding more than 2 seats on the PLC.

Additionally, on the code side, Homebrew is BSD-2 licensed with no CLA and >10,000 contributors.

In practice, this means that neither Homebrew or Workbrew could relicense Homebrew without >10,000 people agreeing to it (or their code being rewritten) which is essentially impossible.

Is Workbrew going to make us pay for Homebrew?

No. Only Homebrew could decide to do this and we have no plans to do so. Workbrew includes Homebrew and charges money for certain Workbrew plans - as permitted by Homebrew’s license - but cannot ever make Homebrew not open source.

Did Homebrew know this was coming?

Yes. Workbrew kept Homebrew’s leadership, maintainers and membership in the loop from early in the company’s conception. We’re very grateful for this transparency.

]]>issyl04.4.02024-10-01T00:00:00+00:002024-10-01T00:00:00+00:00https://brew.sh/2024/10/01/homebrew-4.4.0Today, I’d like to announce Homebrew 4.4.0. The most significant changes since 4.3.0 are official macOS Sequoia (15) support, INSTALL_RECEIPT.json files for casks, macOS Monterey (12) deprecation and various other deprecations.

Major changes and deprecations since 4.3.0:

Other changes since 4.3.0 I’d like to highlight are the following:

Finally:

Thanks to all our hard-working maintainers, contributors, sponsors and supporters for getting us this far.

]]>MikeMcQuaid2023 Security Audit2024-07-30T00:00:00+00:002024-07-30T00:00:00+00:00https://brew.sh/2024/07/30/homebrew-security-auditHomebrew had a security audit performed in 2023. This audit was funded by the Open Technology Fund and conducted by Trail of Bits. Trail of Bits’ report contained 25 items, of which 16 were fixed, 3 are in progress, and 6 are acknowledged by Homebrew’s maintainers. Below is the scope of testing, findings by severity, and mitigation and acknowledgements.

You can read Trail of Bits’ blog post on the audit here and find the full public report here.

Homebrew’s maintainers and Project Leadership Commitee would like to thank Open Technology Fund and Trail of Bits for sponsoring and running this engagement. Our partnership directly improves the security of Homebrew and open source software in general.

Scope: Homebrew/brew, Homebrew/actions, Homebrew/formulae.brew.sh, Homebrew/homebrew-test-bot.

Findings by severity:

  • High: 0
  • Medium: 14
  • Low: 2
  • Informational: 7
  • Undetermined: 2

Mitigation & acknowledgement:

  1. Path traversal during file caching
  2. Sandbox escape via string injection
  3. Allow default rule in sandbox configuration is overly permissive
  4. Special characters are allowed in package names and versions
    • Status: Acknowledged
  5. Use of weak cryptographic digest in Formulary namespaces
  6. Extraction is not sandboxed
    • Status: Acknowledged
  7. Use of ldd on untrusted inputs
  8. Formulas allow for external resources to be downloaded during the install step
  9. Use of Marshal
  10. Lack of sandboxing on Linux
    • Status: Acknowledged
  11. Sandbox escape through domain socket pivot on macOS
  12. Formula privilege escalation through sudo
  13. Formula loading through SFTP, SCP, and other protocols
  14. Sandbox allows changing permissions for important directories
  15. Homebrew supports only end-of-life versions of Ruby
  16. Path traversal during bottling
  17. FileUtils.rm_rf does not check if files are deleted
  18. Use of pull_request_target in GitHub Actions workflows
    • Status: Fixed: 1, 2.
  19. Use of unpinned third-party workflow
    • Status: Fixed across the codebase via multiple PR’s.
  20. Unpinned dependencies in formulae.brew.sh
  21. Use of RSA for JSON API signing
    • Status: Acknowledged. Ed25519 was not an option when this was introduced. The next key reroll will use Ed25519.
  22. Bottles beginning “-“ can lead to unintended options getting passed to rm
  23. Code injection through inputs in multiple actions
    • Status: Fixed across the codebase via multiple PR’s.
  24. Use of PGP for commit signing
    • Status: Acknowledged. Plans to remove the bot account using PGP have been established.
  25. Unnecessary domain separation between signing key and key ID
    • Status: Acknowledged. Will be resolved with the next key reroll.
]]>p-linnaneHomebrew’s Summer 2024 Hackathon2024-07-26T00:00:00+00:002024-07-26T00:00:00+00:00https://brew.sh/2024/07/26/homebrew-summer-2024-hackathonThe Homebrew Summer 2024 Hackathon brought together maintainers from across the globe to focus on enhancing security and performance aspects of Homebrew. Held July 16 to July 20 and hosted at IndyHall in Philadelphia, the event aimed to address issues identified in last year’s security audit from Trail of Bits, and to optimize the software’s performance. This post will share outcomes from the event, evaluate the effectiveness of the gathering, and serve as a blueprint for other open source projects who are considering in-person events as a way to make focused progress.

Background

Since 2019, Homebrew’s maintainers meet annually for the “Annual General Meeting” in Brussels, Belgium. At AGM’s inception, Brussels was deemed a convenient location for the predominantly European team to coincide with the free FOSDEM conference. Since then, the global distribution of the core team has expanded.

At the same time, maintenance issues related to performance (the not-so-glamorous tasks of running a mature project that the whole world relies upon) and the remaining pieces of the Trail of Bits Security Audit needed to be completed.

The Project Leadership Team decided to undertake an experiment: our first North American in-person event, thematically focused and with an application process.

Hackathon Application

Of the 16 applications, 12 participants were accepted.

Event design + impact

On the first day of the three-day event, Project Leader Mike McQuaid gave a presentation about how to triage and measure the highest-impact performance-related issues:

Mike McQuaid presentation

From there, participants tackled high-priority issues, raising pull requests in the dedicated Slack channel to ensure speedy reviews.

Participants worked synchronously and co-located over three days, with standup around 9:30am and departing at 5:00pm. Dinners were optional but provided opportunities for additional discussion:

Group dinner

Impact

Participants made significant progress in the following areas:

  • Security Issues: Several contributors focused on fixing security vulnerabilities highlighted in the Trail of Bits Homebrew audits, such as sandboxing improvements, GitHub Actions security, and privilege escalation prevention.
  • Performance Enhancements: Efforts were made to speed up operations like concurrent downloads and repository handling, resulting in significant gains.

Outcomes

In addition to the direct impact participants had by shipping code, there’s some evidence that this in-person gathering may have increased the capacity of maintainers in areas of security and performance, which will ultimately benefit the project in the future:

1 = least likely, 5 = most likely

Performance Survey Results

Security Survey Results

While the event seemed successful to us as organizers, we also wanted to hear from the participants themselves as part of our evaluation.

Event evaluation

Overall, the hackathon received positive feedback:

  • Organizational Success: Participants praised the event’s organization, particularly highlighting Vanessa’s efforts and the conducive environment at IndyHall.
  • Productive Collaboration: The in-person collaboration facilitated rapid progress and effective problem-solving, which participants found highly beneficial. Direct interaction enabled efficient idea exchange and immediate problem resolution. Participants appreciated the social interactions and the chance to work closely with peers they usually communicate with asynchronously.

Participants themselves assessed the event as successful:

1 = least successful, 5 = most successful

Event Success Results

One of the unexpected effects of the rapid progress was a flurry of notifications for the maintainers who were not attending the event:

Notification Spam

Apologies, Eric.

First-person accounts

In their own words, participants identified key benefits:

What in particular made the Hackathon successful or not successful?

  • A fun experience overall, I got to work on aspects of Homebrew that I had never dealt with before and met some wonderful people!
  • The efficient exchange of ideas made it very successful in my opinion. We have probably never had a time when we were able to fix this many issues and make this many improvements to Homebrew within such a short period.
  • There were a lot – we fixed many problems, had various foods, and had a great time together. If I had to choose one, it would still be about the in-person nature of the event. It not only made it much easier to share ideas, but also strengthened the bond between our maintainers.
  • The list of issues from the audit helped to outline the work to be done.
  • The organization - Vanessa did an awesome job - thank you! The security stuff was awesome to get some issues burned down. Philly’s a great city. IndyHall is a great venue. And it was really nice to just be!
  • Two fixed themes for the hackathon kept people focused, IMO
  • The availability of a list of issues to select from and work together with people
  • I feel like a lot was done, but with such vague goals it’s hard to tell if all were met.
  • Full focus, no distractions.
  • I feel that a lot was accomplished in a short amount of time. It was clear everyone came ready to work and the attitude of all maintainers was so upbeat.
  • All being in the same room together was great for productivity because we could easily bounce ideas and discuss with each other without dealing with timezone differences. When I was working on problems that I didn’t understand super well, I could just ask other people for help and get it immediately.

Areas for Improvement

As an experiment, we were keen to hear how we might improve the structure to be more effective. Attendees had feedback in the following areas:

  • Task Clarity: More structured task lists, especially for performance-related issues, would provide clearer direction.
  • Schedule Optimization: Participants suggested better time management, including more structured breaks and optional cultural activities.
  • Constructive Feedback: Some participants desired a mid-day stand-up for better synchronization and clarity.

Overall, the event not only addressed critical technical challenges but also strengthened the bonds within the Homebrew community, setting a positive precedent for future collaborative efforts.

]]>mozzadrella4.3.02024-05-14T00:00:00+00:002024-05-14T00:00:00+00:00https://brew.sh/2024/05/14/homebrew-4.3.0Today, I’d like to announce Homebrew 4.3.0. The most significant changes since 4.2.0 are SBOM support, initial bottle attestation verification, new command analytics and uninstall autoremove by default.

Major changes and deprecations since 4.2.0:

Other changes since 4.2.0 I’d like to highlight are the following:

Finally:

Thanks to all our hard-working maintainers, contributors, sponsors and supporters for getting us this far.

]]>MikeMcQuaid4.2.02023-12-18T00:00:00+00:002023-12-18T00:00:00+00:00https://brew.sh/2023/12/18/homebrew-4.2.0Today, I’d like to announce Homebrew 4.2.0. The most significant changes since 4.1.0 are some major performance upgrades (e.g. using Ruby 3.1, upgrading fewer dependencies), .env file configuration and macOS Sonoma support.

Major changes and deprecations since 4.1.0:

Other changes since 4.1.0 I’d like to highlight are the following:

Finally:

Thanks to all our hard-working maintainers, contributors, sponsors and supporters for getting us this far.

]]>MikeMcQuaid4.1.02023-07-20T00:00:00+00:002023-07-20T00:00:00+00:00https://brew.sh/2023/07/20/homebrew-4.1.0Today, I’d like to announce Homebrew 4.1.0. The most significant changes since 4.0.0 are significant improvements to the security/reliability/performance/usability of Homebrew 4.0.0’s new JSON API, the completion of the migration of analytics from Google Analytics in the US to InfluxDB in the EU and groundwork for later macOS Sonoma (14) support.

Major changes and deprecations since 4.0.0:

Other changes since 4.0.0 I’d like to highlight are the following:

Finally:

Thanks to all our hard-working maintainers, contributors, sponsors and supporters for getting us this far.

]]>MikeMcQuaid4.0.02023-02-16T00:00:00+00:002023-02-16T00:00:00+00:00https://brew.sh/2023/02/16/homebrew-4.0.0Today, I’d like to announce Homebrew 4.0.0. The most significant change since 3.6.0 enables significantly faster Homebrew-maintained tap updates by migrating from Git-cloned taps to JSON downloads.

Major changes and deprecations since 3.6.0:

Other changes since 3.6.0 I’d like to highlight are the following:

Finally:

FOSDEM 2023

Thanks to all our hard-working maintainers, contributors, sponsors and supporters for getting us this far.

]]>MikeMcQuaidMaintainer Projects2022-09-15T00:00:00+00:002022-09-15T00:00:00+00:00https://brew.sh/2022/09/15/homebrew-maintainer-projects-updateHomebrew’s Project Leadership Committee has green-lit two paid projects by our maintainers this year and since both have hit some milestones recently we’d love to give you, our sponsors and users, an update on their progress.

API Project

Since version 3.6.0 of Homebrew, we are now choosing to advertise the HOMEBREW_INSTALL_FROM_API environment variable to the general public. A lot of work was done by @Rylan12 to make the experience more stable and the API install method is bound to bring a big performance improvement to those who are willing to give it a try.

The goal of the HOMEBREW_INSTALL_FROM_API environment variable is to allow Homebrew users to install formulae and casks without needing to have Homebrew/homebrew-core and/or Homebrew/homebrew-cask tapped. This is intended to make brew update much faster and required less often and also to save space on the user’s machine.

Now that the variable is public, we’re going into a period of bug hunting. When its users stop finding problems and edge-cases for the API to handle, we will be making this the default for all users so everyone can enjoy a fast Homebrew experience.

Ephemeral CI Runners

Since July 18th the Intel-based CI runners are now ephemeral and the foundation has been laid for applying the same features to Apple Silicon based runners. While Homebrew users might not notice more than sleeping a little easier thanks to bottling runs being more reliable, I can tell you that the maintainers are very happy with this improvement and the accompanying dashboard.

Currently our runners persist indefinitely, which has some distinct downsides:

  • Security is worse since a compromised runner will keep working indefinitely
  • Keeping them maintained is harder
  • We cannot dynamically scale up/down usage per-OS

The goal was to replace all our persistent runners with ephemeral variants, starting with the Apple Silicon runners. Unfortunately we ran into some bugs in the Orka platform which MacStadium provides for us, so that initial goal had to be shifted to Intel runners first.

Work is ongoing to enable the Apple Silicon based runners as ephemeral runners to close this project from the macOS side. Once that is done the stretch goal for this project is to make our self-hosted Linux runners ephemeral too. Most of our Linux CI already uses ephemeral GitHub-hosted runners.

Finally:

Thanks to all our hard-working maintainers, contributors, sponsors and supporters for getting us this far.

]]>SMillerDev3.6.02022-09-07T00:00:00+00:002022-09-07T00:00:00+00:00https://brew.sh/2022/09/07/homebrew-3.6.0Today I’d like to announce Homebrew 3.6.0. The most significant changes since 3.5.0 are preliminary macOS Ventura support, the need for --eval-all/HOMEBREW_EVAL_ALL and a migration to Ubuntu 22.04 as our CI platform.

Major changes and deprecations since 3.5.0:

Other changes since 3.5.0 I’d like to highlight are the following:

Finally:

Thanks to all our hard-working maintainers, contributors, sponsors and supporters for getting us this far.

]]>MikeMcQuaid3.5.02022-06-06T00:00:00+00:002022-06-06T00:00:00+00:00https://brew.sh/2022/06/06/homebrew-3.5.0Today I’d like to announce Homebrew 3.5.0. The most significant changes since 3.4.0 are improved brew update behaviour and Homebrew (on macOS) requiring at least OS X El Capitan (10.11).

Major changes and deprecations since 3.4.0:

Other changes since 3.4.0 I’d like to highlight are the following:

Finally:

Thanks to all our hard-working maintainers, contributors, sponsors and supporters for getting us this far.

]]>MikeMcQuaidSecurity Audit2022-05-17T00:00:00+00:002022-05-17T00:00:00+00:00https://brew.sh/2022/05/17/homebrew-security-auditHomebrew has had a paid security audit and addressed all flagged issues. This blog post has been a long time coming; apologies for the delay.

Here’s an overview of the timescale:

]]>MikeMcQuaid3.4.02022-02-28T00:00:00+00:002022-02-28T00:00:00+00:00https://brew.sh/2022/02/28/homebrew-3.4.0Today I’d like to announce Homebrew 3.4.0. The most significant changes since 3.3.0 are HOMEBREW_NO_ENV_HINTS to hide configuration suggestions, brew services supported on systemd on Linux, brew install --overwrite and Homebrew beginning the process to leave the SFC.

Major changes and deprecations since 3.3.0:

Other changes since 3.3.0 I’d like to highlight are the following:

Finally:

Thanks to all our hard-working maintainers, contributors, sponsors and supporters for getting us this far.

]]>MikeMcQuaid3.3.02021-10-25T00:00:00+00:002021-10-25T00:00:00+00:00https://brew.sh/2021/10/25/homebrew-3.3.0Today I’d like to announce Homebrew 3.3.0. The most significant changes since 3.2.0 are the migration from Homebrew/linuxbrew-core to Homebrew/homebrew-core for all Homebrew on Linux users, the official support of macOS Monterey (and, as usual, dropping the support for Mojave due to us only supporting 3 macOS versions) and the addition of an opt-in HOMEBREW_INSTALL_FROM_API flag to avoid needing to have Homebrew/homebrew-core or Homebrew/homebrew-cask repositories tapped/cloned locally.

Major changes and deprecations since 3.2.0:

Other changes since 3.2.0 I’d like to highlight are the following:

Finally:

Thanks to all our hard-working maintainers, contributors, sponsors and supporters for getting us this far.

]]>MikeMcQuaid3.2.02021-06-21T00:00:00+00:002021-06-21T00:00:00+00:00https://brew.sh/2021/06/21/homebrew-3.2.0Today I’d like to announce Homebrew 3.2.0. The most significant changes since 3.1.0 are brew install now upgrades outdated formulae by default and basic macOS 12 (Monterey) support.

Major changes and deprecations since 3.1.0:

Other changes since 3.1.0 I’d like to highlight are the following:

Finally:

Thanks to all our hard-working maintainers, contributors, sponsors and supporters for getting us this far.

]]>MikeMcQuaidSecurity Incident Disclosure2021-04-21T00:00:00+00:002021-04-21T00:00:00+00:00https://brew.sh/2021/04/21/security-incident-disclosureOn 18th April 2021, a security researcher identified a vulnerability in our review-cask-pr GitHub Action used on the homebrew-cask and all homebrew-cask-* taps (non-default repositories) in the Homebrew organization and reported it on our HackerOne.

Whenever an affected cask tap received a pull request to change only the version of a cask, the review-cask-pr GitHub Action would automatically review and approve the pull request. The approval would then trigger the automerge GitHub Action which would merge the approved pull request. A proof-of-concept (PoC) pull request demonstrating the vulnerability was submitted with our permission. We subsequently reverted the PoC pull request, disabled and removed the automerge GitHub Action and disabled and removed the review-cask-pr GitHub Action from all vulnerable repositories.

What was impacted

The discovered vulnerability would allow an attacker to inject arbitrary code into a cask and have it be merged automatically. This is due to a flaw in the git_diff dependency of the review-cask-pr GitHub Action, which is used to parse a pull request’s diff for inspection. Due to this flaw, the parser can be spoofed into completely ignoring the offending lines, resulting in successfully approving a malicious pull request.

A single cask was compromised with a harmless change for the duration of the demonstration pull request until its reversal. No action is required by users due to this incident.

What we’re doing about it

  • The vulnerable review-cask-pr GitHub Action has been disabled and removed from all repositories.
  • The automerge GitHub Action has been disabled and removed from all repositories (in favour of the GitHub built-in functionality that did not exist when this action was created).
  • We have removed the ability for our bots to commit to homebrew/cask* repositories.
  • All homebrew/cask* pull requests will require a manual review and approval by a maintainer.
  • We are improving documentation to help onboard new homebrew/cask maintainers and training existing homebrew/core maintainers to help with homebrew/cask.

We did, do and will continue to take the security of the project and our users very seriously. We try our best to behave as a for-profit company would do in terms of timely response to security issues.

In order to ensure and improve Homebrew’s security, please consider contributing your code and code reviews to our GitHub projects.

Thanks for using Homebrew!

]]>reitermarkus3.1.02021-04-12T00:00:00+00:002021-04-12T00:00:00+00:00https://brew.sh/2021/04/12/homebrew-3.1.0Today I’d like to announce Homebrew 3.1.0. The most significant change since 3.0.0 is the migration of our bottles (binary packages) to GitHub Packages.

Major changes and deprecations since 3.0.0:

Other changes since 3.0.0 I’d like to highlight are the following:

Finally:

Thanks to all our hard-working maintainers, contributors, sponsors and supporters for getting us this far. Particular thanks on Homebrew 3.1.0 go to GitHub for providing GitHub Packages and helping in our migration. Enjoy using Homebrew!

]]>MikeMcQuaid3.0.02021-02-05T00:00:00+00:002021-02-05T00:00:00+00:00https://brew.sh/2021/02/05/homebrew-3.0.0Today I’d like to announce Homebrew 3.0.0. The most significant changes since 2.7.0 are official Apple Silicon support and a new bottle format in formulae.

Major changes and deprecations since 2.7.0:

Other changes since 2.7.0 I’d like to highlight are the following:

Finally:

Thanks to all our hard-working maintainers, contributors, sponsors and supporters for getting us this far. Particular thanks on Homebrew 3.0.0 go to MacStadium and Apple for providing us with a lot of Apple Silicon hardware and Cassidy from Apple for helping us in many ways with this migration. Enjoy using Homebrew!

]]>MikeMcQuaid2.7.02020-12-21T00:00:00+00:002020-12-21T00:00:00+00:00https://brew.sh/2020/12/21/homebrew-2.7.0Today I’d like to announce Homebrew 2.7.0. The most significant changes since 2.6.0 are API deprecations.

Changes and deprecations since 2.6.0:

Finally:

Thanks to all our hard-working maintainers, contributors, sponsors and supporters for getting us this far. Enjoy using Homebrew!

]]>MikeMcQuaid2.6.02020-12-01T00:00:00+00:002020-12-01T00:00:00+00:00https://brew.sh/2020/12/01/homebrew-2.6.0Today I’d like to announce Homebrew 2.6.0. The most significant changes since 2.5.0 are macOS Big Sur support on Intel, brew commands replacing all brew cask commands, the beginnings of macOS M1/Apple Silicon/ARM support and API deprecations.

Major changes and deprecations since 2.5.0:

Other changes since 2.5.0 I’d like to highlight are the following:

Finally:

Thanks to all our hard-working maintainers, contributors, sponsors and supporters for getting us this far. Enjoy using Homebrew!

]]>MikeMcQuaidHomebrew tap with bottles uploaded to GitHub Releases2020-11-18T00:00:00+00:002020-11-18T00:00:00+00:00https://brew.sh/2020/11/18/homebrew-tap-with-bottles-uploaded-to-github-releasesSince the Homebrew 2.5.2 release, you can upload bottles (binary packages) to GitHub Releases, in addition to the previous standard - Bintray. Support was added to Homebrew/brew in this PR on 2020-09-15, and a companion PR to Homebrew/homebrew-test-bot added support for setting the base download URL of bottles to point to a specific release on GitHub.

Creating the tap

First, go to GitHub and create an empty repository named with the homebrew- prefix, for example: USER/homebrew-tap.

github-repository

Then locally run:

brew tap-new USER/REPOSITORY

changing USER/REPOSITORY to the full name of the repository that you just created on GitHub. You can omit the homebrew- prefix and specify the --branch flag if your default branch should be named differently than main.

brew-tap-new

Navigate to the newly created tap on disk by executing:

cd $(brew --repository USER/REPOSITORY)

cd-brew-repository

Now you can list all files in this tap to see what is created by default.

Add the repository that you created on GitHub as the origin remote and push newly created files:

git remote add origin https://github.com/USER/REPOSITORY
git push --set-upstream origin main

git-push

I won’t go into too many details on how the workflows look, as they are subject to change at any time. For now, there are 2 workflow files created by default.

  • One is run on each pull_request event, so every push to a PR’s branch triggers the workflow, which tests changes made to formulae, builds bottles for those formulae and uploads them to GitHub Actions as artifacts.
  • The second workflow, run when a pull request is labelled, is responsible for bottle uploading and publishing.

Creating the first formula in the tap

It’s time we add a new formula to our tap; shall we?

All formulae should go in the Formula directory. Let’s suppose we want to create a formula for this little Go program named gothanks. Run locally:

brew create --tap=USER/REPOSITORY --go https://github.com/psampaz/gothanks/archive/v0.3.0.tar.gz

brew-create

brew-edit

This command will create a new standard formula for Go projects in your tap and open the file in your editor of choice. After you close the editor, you can still edit the formula with:

brew edit USER/REPOSITORY/FORMULA

Our gothanks formula, after some editing could look like this:

class Gothanks < Formula
  desc "Automatically star your go.mod Github dependencies"
  homepage "https://github.com/psampaz/gothanks"
  url "https://github.com/psampaz/gothanks/archive/v0.3.0.tar.gz"
  sha256 "ce5440334b3eac2e058724faa4c6e4478ca1d81ea087e55ccca33f1996752aad"
  license "MIT"

  depends_on "go" => :build

  def install
    system "go", "build", *std_go_args
  end

  test do
    ENV.delete "GITHUB_TOKEN"
    assert_match "no Github token found", shell_output(bin/"gothanks", 255)
  end
end

Now we can create a new branch, add the formula, commit it and push:

git checkout -b gothanks
git add Formula/gothanks.rb
git commit --message "gothanks 0.3.0 (new formula)"
git push --set-upstream origin gothanks

git-branch

But to trigger the workflows, we need to create a pull request from our recently-pushed branch. I’m using the hub utility for this operation, but you can use the newer GitHub CLI tool gh or just click your way through in GitHub’s UI.

github-pr

Uploading built bottles

Wait until the pull request’s checks become green. Then label your pull request with the pr-pull label (this is the default label that will trigger the uploading workflow; you can easily change this in workflow file). A new brew pr-pull workflow will be fired up and after a couple of minutes you should observe the PR closed, bottles uploaded and commits pushed to the main branch of your repository.

github-pr-closed github-release github-commits

Summary

With current tooling it’s now easier than ever to create your own Homebrew tap with bottles. Gone are the days when you had to create a Bintray account and fiddle around with custom CI configs. Now you can run a bunch of commands and get a tap up and running in minutes, with only a GitHub account!

]]>dawidd62.5.02020-09-08T00:00:00+00:002020-09-08T00:00:00+00:00https://brew.sh/2020/09/08/homebrew-2.5.0Today I’d like to announce Homebrew 2.5.0. The most significant changes since 2.4.0 are better brew cask integration, license support and API deprecations.

Major changes and deprecations since 2.4.0:

Other changes since 2.4.0 I’d like to highlight are the following:

Finally:

Thanks to all our hard-working maintainers, contributors, sponsors and supporters for getting us this far. Enjoy using Homebrew!

]]>MikeMcQuaid2.4.02020-06-11T00:00:00+00:002020-06-11T00:00:00+00:00https://brew.sh/2020/06/11/homebrew-2.4.0Today I’d like to announce Homebrew 2.4.0. The most significant changes since 2.3.0 are dropping macOS Mavericks support, the deprecation of devel versions and brew audit speedups.

Major changes and deprecations since 2.3.0:

Other changes since 2.3.0 I’d like to highlight are the following:

Finally:

Thanks to all our hard-working maintainers, contributors, sponsors and supporters for getting us this far. Enjoy using Homebrew!

]]>MikeMcQuaid2.3.02020-05-29T00:00:00+00:002020-05-29T00:00:00+00:00https://brew.sh/2020/05/29/homebrew-2.3.0Today I’d like to announce Homebrew 2.3.0. The most significant changes since 2.2.0 are GitHub Actions CI usage, fetching resources before installation, Docker image improvements and the deprecation of brew install from URLs.

Major changes and deprecations since 2.2.0:

Other changes since 2.2.0 I’d like to highlight are the following:

Finally:

Thanks to all our hard-working maintainers, contributors, sponsors and supporters for getting us this far. Enjoy using Homebrew!

]]>MikeMcQuaid2.2.02019-11-27T00:00:00+00:002019-11-27T00:00:00+00:00https://brew.sh/2019/11/27/homebrew-2.2.0Today I’d like to announce Homebrew 2.2.0. The most significant changes since 2.1.0 are macOS Catalina support, performance increases and better Homebrew on Linux ecosystem integration.

Major changes and deprecations since 2.1.0:

Other changes since 2.1.0 I’d like to highlight are the following:

Finally:

Thanks to all our hard-working maintainers, contributors, sponsors and supporters for getting us this far. Enjoy using Homebrew!

]]>MikeMcQuaidHomebrew Maintainer Meeting2019-06-14T00:00:00+00:002019-06-14T00:00:00+00:00https://brew.sh/2019/06/14/homebrew-maintainer-meetingIn February 2019 we had our first Homebrew maintainer in-person meeting at and around the FOSDEM 2019 conference in Brussels. Maintainers travelled from as far as India and Canada in order to get face-time with each other and have high-bandwidth conversations.

Maintainers arrived on Friday and met informally to socialise and get to know each other. On Saturday we released Homebrew 2.0.0 and on Saturday and Sunday attended the various talks at the conference (including a Homebrew 2.0.0 talk).

After getting to know each other better over the weekend we met in a hotel meeting room on Monday for the main purpose of the maintainer meeting: discussion of the future direction of the Homebrew project. 14 Homebrew maintainers were present in the meeting room and 3 others called in remotely.

meeting

Perhaps due to Mike McQuaid arranging to resign as Lead Maintainer on the same day the majority of the discussion was about Homebrew’s project governance. We agreed on having an elected Project Leader position, Project Leadership Committee and Technical Steering Committee. Representatives were elected to each of these positions.

meeting

If you’re interested in more details on our agreed governance structures you can read Governance documents (https://docs.brew.sh/Homebrew-Governance) and read the representatives for all positions in the Homebrew README’s “Who We Are” section.

lunch

Homebrew spent $11,965.85 in total on this meeting on the 14 individuals who attended. Included in this are some group meals, meeting room hire, travel (i.e. flights or trains) and hotel rooms in line with the Software Freedom Conservancy Travel and Reimbursable Expense Policy.

We felt this was a disproportionally valuable use of project funds. Most of us met each other for the first time, had some difficult conversations in-person and built bonds that make us all more committed to the project.

Thanks so much to everyone who has ever donated to Homebrew for enabling this meeting. If you would like to support similar events in future and can afford it, please donate through Patreon. If you’d rather not use Patreon (our preferred donation method), check out the other ways to donate in our README.

]]>MikeMcQuaid2.1.02019-04-04T00:00:00+00:002019-04-04T00:00:00+00:00https://brew.sh/2019/04/04/homebrew-2.1.0Today I’d like to announce Homebrew 2.1.0. The most significant changes since 2.0.0 are casks on https://formulae.brew.sh, search on Homebrew sites and better Docker support.

Major changes and deprecations since 2.0.0:

Other changes since 2.0.0 I’d like to highlight are the following:

Finally:

Thanks to all our hard-working maintainers, contributors, sponsors and supporters for getting us this far. Enjoy using Homebrew!

]]>MikeMcQuaid2.0.02019-02-02T00:00:00+00:002019-02-02T00:00:00+00:00https://brew.sh/2019/02/02/homebrew-2.0.0Today I’d like to announce Homebrew 2.0.0. The most significant changes since 1.9.0 are official support for Linux and Windows 10 (with Windows Subsystem for Linux), brew cleanup running automatically, no more options in Homebrew/homebrew-core, and removal of support for OS X Mountain Lion (10.8) and older.

Major changes and deprecations since 1.9.0:

  • Homebrew officially supports Linux and Windows 10 with Windows Subsystem for Linux (WSL). Homebrew on Linux was previously called “Linuxbrew”. You can install it in your home directory, so it does not require sudo, and use it to install software that your host distribution’s package manager does not provide. Homebrew on Linux uses its own repository for formulae: Homebrew/linuxbrew-core.
  • brew cleanup is run periodically (every 30 days) and triggers for individual formula cleanup on reinstall, install or upgrade. You can opt-out of this behaviour by setting the HOMEBREW_NO_INSTALL_CLEANUP variable. This addresses a long-standing complaint where users were surprised by how much disk space Homebrew used if they did not run brew cleanup.
  • Homebrew does not run on OS X Mountain Lion (10.8) and below. For 10.4 - 10.6 support, see Tigerbrew. This has allowed us to remove large amounts of legacy code.
  • Homebrew does not migrate old, pre-1.0.0 installations from the Homebrew/legacy-homebrew (formerly Homebrew/homebrew repository. This has allowed us to delete legacy code that dealt with migrations from old versions.
  • Homebrew does not have any formulae with options in Homebrew/homebrew-core. Options will still be supported and encouraged by third-party taps. This change allows us to better focus on delivering binary packages rather than options. Formulae with options had to be built from source, could not be tested on our CI system and provided a disproportionate support burden on our volunteer maintainers.

Other changes since 1.9.0 I’d like to highlight are the following:

Also, if you’ve not tuned in since 1.0.0, here are the major changes since then:

Finally:

Thanks to all our hard-working maintainers, contributors, sponsors and supporters for getting us this far. Enjoy using Homebrew!

]]>MikeMcQuaid1.9.02019-01-09T00:00:00+00:002019-01-09T00:00:00+00:00https://brew.sh/2019/01/09/homebrew-1.9.0Today I’d like to announce Homebrew 1.9.0. The most significant changes since 1.8.0 are Linux support, (optional) automatic brew cleanup and providing bottles (binary packages) to more Homebrew users.

Major changes and deprecations since 1.8.0:

Future major changes and deprecations coming in 2.0.0:

  • Homebrew 2.0.0 will officially support Linux and Windows 10 (with the Windows Subsystem for Linux).
  • brew cleanup will be run periodically and for trigger individual formula cleanup on reinstall, install or upgrade. You can enable this behaviour now on 1.9.0 by setting the HOMEBREW_INSTALL_CLEANUP variable.
  • Homebrew 2.0.0 will not run on macOS 10.8 and below. For 10.4 - 10.6 support see Tigerbrew.
  • Homebrew 2.0.0 will not be able to create universal binaries (even in taps).
  • Homebrew 2.0.0 will no longer migrate old installations from the legacy Homebrew/homebrew repository.
  • Homebrew 2.0.0 will not have any formulae with options in Homebrew/homebrew-core. Options will still be supported and encouraged by third-party taps.

Other changes since 1.8.0 I’d like to highlight are the following:

Finally:

Thanks to all our hard-working maintainers, contributors, sponsors and supporters for getting us this far. Enjoy using Homebrew!

]]>MikeMcQuaid1.8.02018-10-23T00:00:00+00:002018-10-23T00:00:00+00:00https://brew.sh/2018/10/23/homebrew-1.8.0Today I’d like to announce Homebrew 1.8.0. The most significant changes since 1.7.0 are official Mojave support, linkage auto-repair on brew upgrade, brew info displaying analytics data and quarantining Cask’s downloads.

Major changes and deprecations since 1.7.0:

Other changes since 1.7.0 I’d like to highlight are the following:

Finally:

Thanks to all our hard-working maintainers, contributors, sponsors and supporters for getting us this far. Enjoy using Homebrew!

]]>MikeMcQuaidSecurity Incident Disclosure2018-08-05T00:00:00+00:002018-08-05T00:00:00+00:00https://brew.sh/2018/08/05/security-incident-disclosureOn 31st July 2018 a security researcher identified a GitHub personal access token with recently elevated scopes was leaked from Homebrew’s Jenkins that gave them access to git push on Homebrew/brew and Homebrew/homebrew-core. They reported this to our Hacker One. Within a few hours the credentials had been revoked, replaced and sanitised within Jenkins so they would not be revealed in future. Homebrew/brew and Homebrew/homebrew-core were updated so non-administrators on those repositories cannot push directly to master. Most repositories in the Homebrew organisation (notably not Homebrew/homebrew-core due to their current workflow and maintainer requests) were also updated to require CI checks from a pull request to pass before changes can be pushed to master.

What was impacted

GitHub Support was contacted and they verified the relevant token had not been used to perform any pushes to Homebrew/brew or Homebrew/homebrew-core during the period of elevated scopes. To be explicit: no packages were compromised and no action is required by users due to this incident.

What we’re doing about it

  • We have for several years enabled 2FA and third party application restrictions for the entire Homebrew GitHub organisation. This was also recommended by the security researcher.
  • We enabled branch protection and required reviews on additional repositories as mentioned above.
  • We requested all Homebrew maintainers review and prune their personal access tokens and disable SMS fallback for 2FA.
  • The security researcher also recommended we consider using GPG signing for Homebrew/homebrew-core. The Homebrew project leadership committee took a vote on this and it was rejected non-unanimously due to workflow concerns.

We did, do and will continue to take the security of the project and our users very seriously. We try our best to behave as a for-profit company would do in terms of timely response to security issues but this is heavily limited by our lack of resources. For example, in this the Homebrew maintainer who resolved the above issues was on paternity leave from work and the primary carer for their child and had to reach a quick resolution while their child had a nap.

We need more help to improve Homebrew’s security. Please consider contributing your code and code reviews to our GitHub projects, get in touch to volunteer to be on-call for security and/or system administration emergencies or donate through Patreon.

Thanks for using Homebrew!

]]>MikeMcQuaid1.7.02018-07-15T00:00:00+00:002018-07-15T00:00:00+00:00https://brew.sh/2018/07/15/homebrew-1.7.0Today I’d like to announce Homebrew 1.7.0. The most significant changes since 1.7.0 are fixes for macOS 10.14 Mojave’s developer beta, Homebrew Formulae’s JSON analytics and formulae APIs and various formula API deprecations.

Major changes and deprecations since 1.6.0:

Other changes since 1.6.0 I’d like to highlight are the following:

Finally:

Thanks to all our hard-working maintainers, contributors, sponsors and supporters for getting us this far. Enjoy using Homebrew!

]]>MikeMcQuaid1.6.02018-04-09T00:00:00+00:002018-04-09T00:00:00+00:00https://brew.sh/2018/04/09/homebrew-1.6.0Today I’d like to announce Homebrew 1.6.0. The most significant changes since 1.5.0 are brew install python installing Python 3, the deprecation of Homebrew/homebrew-php and various formula API deprecations.

Major changes and deprecations since 1.5.0:

Other changes since 1.5.0 I’d like to highlight are the following:

Finally:

Thanks to all our hard-working maintainers, contributors, sponsors and supporters for getting us this far. Enjoy using Homebrew!

]]>MikeMcQuaid1.5.02018-01-19T00:00:00+00:002018-01-19T00:00:00+00:00https://brew.sh/2018/01/19/homebrew-1.5.0Today I’d like to announce Homebrew 1.5.0. The most significant changes since 1.4.0 are deprecations of formula APIs and some Homebrew organisation formula taps.

Future dates for your calendar:

  • On 1st March 2018 the python formula will be upgraded to Python 3.x and a python@2 formula will be added for installing Python 2.7 (although this will be keg-only so neither python nor python2 will be added to the PATH by default without a manual brew link --force). We will maintain python2, python3 and python@3 aliases. Any formulae that use depends_on "python" outside Homebrew/core will need to be updated at this point if they wish to keep using Python 2. Note: macOS has provided Python 2.7 since OS X Lion (10.7) so you can update formulae that need Python 2 today by removing depends_on "python" so they use the system python instead.
  • By 31st March 2018 we will deprecate and archive the Homebrew/homebrew-php tap. Unfortunately we have been unable to maintain an acceptable, consistent user or contributor experience and CI workload through non-core formula taps in the Homebrew organisation so we are continuing to migrate widely used formulae into Homebrew/core and encourage more niche formulae and options to be supported outside the Homebrew organisation.

Major changes and deprecations since 1.4.0:

Other changes since 1.4.0 I’d like to highlight are the following:

Finally:

Thanks to all our hard-working maintainers, contributors, sponsors and supporters for getting us this far. Enjoy using Homebrew!

]]>MikeMcQuaid1.4.02017-12-11T00:00:00+00:002017-12-11T00:00:00+00:00https://brew.sh/2017/12/11/homebrew-1.4.0Today I’d like to announce Homebrew 1.4.0. The most significant change since 1.3.0 is that Homebrew filters environment variables.

Major changes and deprecations since 1.3.0:

  • Homebrew filters all user environment variables. This reduces errors in installing formulae from source and in Homebrew commands.
  • Homebrew’s “bottle hooks” have been removed. These were added originally to remove Boxen’s monkey-patching of Homebrew’s internal, private APIs but are no longer necessary for or used by Boxen.
  • The Homebrew/science tap is migrating notable formulae to Homebrew/core and will be archived in January 2018. The Homebrew/apache tap has been deprecated and archived. In 2018 we will also deprecate and archive the Homebrew/php tap. Over the last few minor versions of Homebrew we’ve migrated, deprecated and archived most of the formula taps in the Homebrew organisation to improve the reliability, consistency and discoverability of formulae under the Homebrew organisation.
  • macOS version analytics are available on the brew.sh homepage.

Other changes since 1.3.0 I’d like to highlight are the following:

Finally:

Thanks to all our hard-working maintainers, contributors, sponsors and supporters for getting us this far. Enjoy using Homebrew!

]]>MikeMcQuaid1.3.02017-07-31T00:00:00+00:002017-07-31T00:00:00+00:00https://brew.sh/2017/07/31/homebrew-1.3.0Today I’d like to announce Homebrew 1.3.0. The most significant change since 1.2.0 is that brew install python no longer installs a python binary without manual PATH additions and instead installs a python2 binary. This avoids overriding the system python binary by default when installing Python as a dependency. It also paves the way to eventually have python be Python 3.x.

Major changes and deprecations since 1.2.0:

While all the functionality for these deprecations will be supported for the foreseeable future in Homebrew/brew for 3rd-party usage, Homebrew/homebrew-core has removed the use of these APIs from formulae to improve the user experience.

Other changes since 1.2.0 I’d like to highlight are the following:

Finally:

Thanks to all our hard-working maintainers, contributors, sponsors and supporters for getting us this far. Enjoy using Homebrew!

]]>MikeMcQuaid1.2.02017-05-01T00:00:00+00:002017-05-01T00:00:00+00:00https://brew.sh/2017/05/01/homebrew-1.2.0Today I’d like to announce Homebrew 1.2.0. The most significant change since 1.1.0 is that most Homebrew taps (package repositories) in the Homebrew GitHub organisation have been deprecated and the currently buildable software moved into Homebrew/homebrew-core. This will improve the quality and availability of all their software.

Additionally, as Homebrew/homebrew-versions has been moved into Homebrew/homebrew-core Homebrew provides better, official support for different versions. You can read more about this in the dedicated versions document. Please note our goal isn’t to support all versions of all software but to provide some versions and tooling such that you can easily maintain more in your own tap (package repository).

Since 1.1.0 the following deprecations have been made:

While all the functionality for these deprecations will be supported for the foreseeable future in Homebrew/brew for 3rd-party usage, Homebrew/homebrew-core will be removing the use of these APIs from formulae to improve the user experience.

Since 1.1.0 some new commands are available:

Some of the other changes since 1.1.0 I’d like to highlight are the following:

And finally:

Thanks to all our hard-working maintainers, contributors, sponsors and supporters for getting us this far. Enjoy using Homebrew!

]]>MikeMcQuaid1.1.02016-11-07T00:00:00+00:002016-11-07T00:00:00+00:00https://brew.sh/2016/11/07/homebrew-1.1.0Today I’d like to announce Homebrew 1.1.0. We’ve had a great response to Homebrew 1.0.0 and been iterating on our work there. That 1.1.0 follows 1.0.9 is a happy coincidence due to breaking changes; in the future we may have a e.g. 1.1.10.

1.1.0 contains some breaking changes:

Some of the changes since 1.0.0 I’d like to highlight are the following:

Enjoy using Homebrew!

]]>MikeMcQuaid1.0.02016-09-21T00:00:00+00:002016-09-21T00:00:00+00:00https://brew.sh/2016/09/21/homebrew-1.0.0Today I’m proud to announce Homebrew 1.0.0. In the seven years since Homebrew was created by @mxcl our community has grown to almost 6000 unique contributors, a wide-reaching third-party “tap” ecosystem and thousands of packages.

We’ve been working hard over the last year to make some major changes to Homebrew that we’ve been wanting for a long time. There have been some hiccups along the way but we now have a more stable base for using and developing Homebrew in the future.

These include:

And finally:

Thanks to all our users, contributors and maintainers past and present for getting us to this milestone. Enjoy using Homebrew!

]]>MikeMcQuaid