Homebrew 7 Adds BrewUI and Security Checks

Homebrew 7 was released on September 13 with a native macOS app, built-in vulnerability checks, stronger sandboxing and faster package operations. The release broadens Homebrew beyond its command-line roots while making software provenance and platform-support boundaries more visible to developers and IT teams.

Key takeaways

BrewUI is Homebrew’s official native graphical interface for macOS Tahoe 26 or later.
The new brew vulns command checks installed formulae against Homebrew’s advisory data and OSV.
Homebrew 7 drops macOS Catalina and moves Intel Macs to Tier 3, with new bottles no longer routinely provided.

What Homebrew 7 changes

Homebrew’s release notes say installs, reinstalls and upgrades can overlap package preparation and downloads, reducing idle time in multi-package operations. The project also reuses verified API data on warm runs and launches fewer subprocesses, changes designed to improve routine speed without bypassing signature checks.

The visible addition is BrewUI. Homebrew describes it as a fully released native macOS interface that lets users browse, search and inspect installed packages while showing the underlying commands. It remains optional and requires macOS Tahoe 26 or later, so Homebrew 7 does not replace the command line.

Security improves, but trust still begins with the tap

Homebrew 7 introduces an advisory database and the brew vulns command, which can report known issues in installed formulae and distinguish fixes that are available. The project publishes reusable OSV-format records under CC0, allowing security teams to connect Homebrew-specific package state with broader vulnerability workflows.

Sandboxing is also tighter. Homebrew says package builds are blocked from reading the user’s home directory by default, and migrated installs separate a network-enabled fetch stage from a restricted installation stage. On Linux, Landlock replaces Bubblewrap where the kernel supports it. Homebrew explicitly warns that sandboxing cannot make arbitrary third-party software trustworthy.

Accessible independent reports from IT之家 and AAPL Ch. separately confirmed the native BrewUI app, vulnerability checks, faster operations and support changes described in Homebrew’s primary release.

Area	Homebrew 7 change
Interface	Optional BrewUI native macOS app
Vulnerability review	Built-in `brew vulns` command
macOS Catalina	No longer supported
Intel Mac	Tier 3; no routine new bottles

The operational consequence for developer fleets

Teams should treat Homebrew 7 as both an upgrade and an inventory event. Intel Macs, Catalina systems, older CI images and workflows pinned to removed action branches may need explicit migration plans. Running the new diagnostics before a broad rollout can expose unsupported machines and vulnerable packages without assuming every warning has the same urgency.

The change also affects CI maintainers. Homebrew retired its Ubuntu 22.04 image and removed the master branch for Homebrew actions, recommending versioned releases or full commit hashes. Those migrations reduce ambiguity, but they can break unattended workflows if teams treat a major package-manager upgrade as a desktop-only change.

BrewUI may lower the barrier for less terminal-focused users, but administrators still need auditable configuration and tap policy. The most useful model is a transparent front end over governed sources, not a substitute for review. That aligns with the patch discipline behind the GitLab exploited-flaw response and the careful rollout needed for Windows update regressions.