Homebrew 7.0.0 gets built-in GUI, better security controls

What broke in Homebrew 7.0.0 gets built-in GUI

BleepingComputer reports: Homebrew 7.0.0 gets built-in GUI, better security controls. Homebrew package manager version 7.0.0 has been released with a built-in vulnerability scanner, stronger security controls, and the full release of its native BrewUI graphical interface. [...]

The open-source package manager is primarily used on macOS, allowing users to install software in a similar way to Linux package managers by automatically downloading packages and resolving and installing their dependencies. The popularity of the project is obvious from its 49k stars and 11k forks on GitHub and from threat actors frequently targeting it to push info-stealer malware, including through clone sites and ClickFix lures.

Who is exposed by Homebrew 7.0.0 gets built-in GUI

In the latest version, the BrewUI official native graphical interface available on macOS 26 “Tahoe” and later makes it easy to browse and search for packages, as well as inspect and manage their dependencies. The new BrewUI interfaceSource: Homebrew Users can now use the vulnerability scanner through a new command (brew vulns).

What to do now about Homebrew 7.0.0 gets built-in GUI

Also included is a Homebrew-specific advisory database that tracks vulnerabilities affecting the formula versions and revisions distributed by Homebrew. See the full write-up from BleepingComputer via the source link for quotes and complete context.

Homebrew manages “casks,” which are used to install graphical applications, fonts, plugins, and other macOS software, and formulae, which are Ruby-based package definitions that can instruct Homebrew to download files, run build commands, or install dependencies. Homebrew 7.0.0 adds a scanning command that can check installed formulae, a specific one, or formulae and their dependencies declared in a Brewfile.

How the Homebrew 7.0.0 gets built-in GUI issue works

For each formula, Homebrew determines the upstream software repository and its version/tag, while for installed packages, it uses information from the available SBOM or derives the source from the formula definition. The command sends the upstream repository and version/tag to OSV.dev in a batch query, retrieves the vulnerability records, verifies potential matches, applies optional severity filters, and finally checks whether Homebrew has already applied a security patch to this formula.

What is still unknown about Homebrew 7.0.0 gets built-in GUI

Separately, Homebrew’s new advisory database publishes OSV-format records documenting vulnerabilities affecting Homebrew formula versions and revisions, including fixes that have been backported without changing the upstream software version. See the full write-up from BleepingComputer via the source link for quotes and complete context.