Frames tap trust as the headline feature because Homebrew shipped a decade-old supply-chain hole where `brew install user/repo/formula` silently executed arbitrary Ruby with user privileges. Argues the security model was weaker than `curl | bash` because the unsafe act was invisible, and that recent RubyGems and npm incidents make the gating obviously necessary.
Lists tap trust first among the 6.0 highlights, signaling the maintainers view it as the most significant change. The official announcement positions it as a new security mechanism rather than a routine feature, implicitly acknowledging the prior model was unsafe.
Argues the new default internal JSON API is the second-biggest change but the most viscerally noticeable, since cold `brew update` drops from a coffee-break operation to sub-second on a fast connection. Frames this as the payoff of a two-year migration off Git-backed metadata, with a substantially smaller on-disk footprint.
Presents 6.0 as a bundle of improvements — tap trust, JSON API default, Linux sandboxing, survey-informed defaults, brew bundle improvements, general performance work, and macOS 27 support — rather than a single-theme release. The framing treats Linux sandboxing and bundle improvements as co-equal wins alongside the security and speed headlines.
Mike McQuaid shipped Homebrew 6.0.0 on June 11, the first major version bump since 5.1.0 last fall. The headline features, in the maintainers' own ordering: a tap trust security mechanism, a new default internal JSON API, sandboxing on Linux, defaults rewritten from user-survey data, `brew bundle` improvements, general performance work, and initial support for macOS 27 ("Golden Gate").
Tap trust is the one that matters most. Until 6.0, running `brew install user/repo/formula` would silently clone an arbitrary third-party tap and execute its Ruby formula code with your user's privileges — a supply-chain hole that's existed since taps were introduced more than a decade ago. Now, the first time you reference an untrusted tap, Homebrew refuses and prompts you to explicitly authorize it. Core taps (`homebrew/core`, `homebrew/cask`) are trusted by default. Everything else is opt-in, per-tap, persisted in your local config.
The new internal JSON API is the second-biggest change but the one most users will *feel*. Homebrew has been migrating off Git-backed metadata for two years; 6.0 makes the JSON path the default and trims the on-disk footprint substantially. On a cold `brew update`, the difference is roughly an order of magnitude on a fast connection — what used to be a coffee-break operation is now sub-second.
The security framing here is overdue. Homebrew has spent a decade being the most-used package manager on developer laptops while shipping a trust model weaker than `curl | bash` — at least `curl | bash` makes the unsafe act visible. A tap install looked like a routine command and quietly added a code-execution surface. The 2021 RubyGems and 2024 npm supply-chain incidents made it clear how this story ends if you don't gate it. McQuaid and the maintainers have been talking about tap trust since at least the 4.0 cycle; getting it shipped in 6.0 is a real milestone, even if the obvious question is why it took this long.
The Linux sandboxing change is quieter but structurally important. macOS builds have used sandbox-exec to constrain formula build steps for years. Linux builds, until now, ran with whatever permissions the invoking user had — fine for a personal laptop, awful for CI runners that install dependencies on every job. The new implementation uses Linux namespaces to restrict filesystem and network access during the build phase. If you're running Homebrew inside GitHub Actions, GitLab runners, or any shared CI host, this closes a real lateral-movement vector.
The JSON API switch is the kind of infrastructure work that nobody asks for but everyone benefits from. Homebrew's old model — clone the entire `homebrew/core` Git repo, walk its directory tree to resolve formulae — was an artifact of the early 2010s when Git was the cool new distribution mechanism for text data. A 100MB+ tap on every developer machine made sense in 2013 and made no sense by 2020. The JSON API serves the same metadata from a CDN, gzipped, in a fraction of the bytes. Combined with the trimmed default tap install, this is the first Homebrew release in years where a fresh `brew install` on a new machine doesn't feel like provisioning a server.
The `brew bundle` improvements deserve a paragraph on their own because Brewfiles are how serious teams manage dev-environment reproducibility. 6.0 adds better support for conditional entries (mac-only vs. linux-only formulae in the same Brewfile), cleaner output when bundling against a partially-installed system, and — finally — a `brew bundle check --verbose` that tells you *which* line of the Brewfile triggered a delta. Anyone who's tried to onboard a new hire onto a 200-line Brewfile knows why this matters.
If you depend on third-party taps in CI, 6.0 will break your build on first run. The tap-trust prompt is interactive by default. You'll need to either pre-authorize taps via `brew tap --force` in your CI provisioning, or set the new `HOMEBREW_AUTO_TRUST_TAPS` env var for the taps you've vetted. The maintainers have published an explicit migration note for this; read it before you upgrade your CI image.
The performance work is real enough that you should consider rebaselining your CI dependency-install steps after upgrading — first-run `brew install` numbers from 5.x are no longer representative. If you're paying for CI minutes by the second, this is found money. For Docker images that bake in Homebrew (a common pattern for cross-platform Linux/macOS dev environments), expect noticeably smaller layers because the default tap clone is gone.
The Linux sandboxing change has a sharp edge worth flagging: formulae that legitimately need network access during build (anything that fetches Go modules, npm packages, or Cargo crates at compile time) need to be marked accordingly. If you maintain a private tap with custom formulae, audit them for implicit network use before you upgrade — silent build failures with cryptic sandbox errors are the failure mode you'll hit. Most well-written formulae already declare their fetch phase separately and won't be affected.
The more interesting question is what Homebrew becomes once the JSON API matures. The current implementation still relies on a centralized CDN-served metadata feed; the natural next step is signed metadata, reproducible formula builds, and eventually some form of supply-chain attestation — the same direction Sigstore pushed npm and PyPI. Tap trust is the prerequisite for any of that to mean anything. 6.0 isn't the destination; it's the first release where Homebrew has the security primitives to start catching up to the package managers it has, for a decade, been informally competing with.
Today, I’m proud to announce Homebrew 6.0.0. The most significant changes since 5.1.0 are a new tap trust security mechanism, the new faster, smaller, default internal Homebrew JSON API, sandboxing on
→ read on Hacker NewsTop 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.