Homebrew has released version 6.0.0 with a new security boundary for third-party software repositories, or taps. The package manager will now require users to explicitly trust an outside tap before Homebrew evaluates or executes its code, addressing the fact that tap content can include unrestricted Ruby. Official Homebrew taps remain trusted by default.
The change makes trust a deliberate decision rather than an implicit consequence of referring to a tap-qualified formula or cask. It cannot establish that an outside repository is safe, but it gives users a clearer point at which to verify ownership and provenance. The project presents the mechanism as protection against both malicious taps and legitimate repositories that have been compromised.
Version 6 also switches Homebrew’s internal JSON API on by default. The system collects the project’s metadata into one download, reducing network requests and making updates faster. Developers had recently been able to opt into the smaller API, and the `HOMEBREW_USE_INTERNAL_API` setting available since version 5.0.0 is now deprecated because the behavior no longer needs to be requested.
Linux installations gain a Bubblewrap-based sandbox. Homebrew already isolated build, test and post-install stages on macOS; the new work moves relevant logic into shared code and brings similar controls to Linux. The release says sandboxing is enabled by default for developers. It also covers cask executable hooks, hardens install phases, permits logs in the build sandbox and includes Bubblewrap on hosted Ubuntu systems. Syntax-only jobs can skip setup.
Performance work extends beyond the metadata change. Homebrew says `brew leaves` is about 30% faster, bottle-tab retrieval during upgrades is parallelized, and startup loads less Ruby code. The release also contains improvements to `brew bundle`, revised defaults informed by a user survey, and initial compatibility with macOS 27, named Golden Gate. Initial support indicates that further changes may still be needed as the operating system develops.
The project announced three security advisories alongside the release, although the supplied evidence does not describe their contents. Users should consult the individual advisories before drawing conclusions about affected versions or required remediation.
Homebrew 6.0.0 is therefore both a security and infrastructure release. The most visible behavioral change will occur when a command reaches outside the project’s official repositories: users must now make the trust relationship explicit. The internal API and performance changes aim to reduce routine update overhead, while the Linux sandbox narrows the gap between Homebrew’s protections on its two supported operating-system families. Administrators should still review trust decisions and test changed defaults before deploying the major version across managed development fleets.
