The release of version 7.0.0 of the Homebrew package manager includes an integrated vulnerability scanner, improved security measures, and the complete launch of its native BrewUI graphical interface.
This open-source package manager is mainly utilized on macOS, enabling users to install software similarly to Linux package managers by automatically fetching packages and resolving their dependencies.
The project’s popularity is evident from its 49,000 stars and 11,000 forks on GitHub, as well as the frequent targeting by threat actors aiming to distribute info-stealer malware through clone sites and ClickFix lures.
In this latest version, the BrewUI native graphical interface, available on macOS 26 “Tahoe” and later, simplifies the process of browsing and searching for packages, along with inspecting and managing their dependencies.
Users can now access the vulnerability scanner via a new command (brew vulns). Additionally, a Homebrew-specific advisory database has been introduced to track vulnerabilities that impact the formula versions and revisions provided by Homebrew.
Homebrew manages “casks” for installing graphical applications, fonts, plugins, and other macOS software, as well as formulae, which are Ruby-based package definitions that instruct Homebrew to download files, execute build commands, or install dependencies.
The 7.0.0 version of Homebrew introduces a scanning command that can verify installed formulae, a specific one, or formulae and their dependencies listed in a Brewfile.
For each formula, Homebrew identifies the upstream software repository and its version/tag, while for installed packages, it utilizes information from the available SBOM or derives the source from the formula definition.
This command sends the upstream repository and version/tag to OSV.dev in a batch query, retrieves vulnerability records, verifies potential matches, applies optional severity filters, and checks if Homebrew has already implemented a security patch for this formula.
In addition, Homebrew’s new advisory database publishes OSV-format records that document vulnerabilities affecting Homebrew formula versions and revisions, including fixes that have been backported without altering the upstream software version.
“Homebrew publishes advisory findings in the formula API and a downloadable advisory index, assisting other tools in distinguishing unresolved vulnerabilities from fixes that have already been released,” the project team states.
“The OSV-format records in the database are freely reusable under CC0, providing security teams with a common source of Homebrew-specific vulnerability information.”
Users will also experience improved sandboxing in Homebrew 7.0.0, as access to users’ home directories is restricted by default, and network-enabled dependency downloads are segregated from offline installations.
Furthermore, Homebrew highlights that installations and upgrades are quicker in this new release, thanks to the new capability to download, prepare, and install packages simultaneously.
Build your security blueprint for AI-powered attacks. Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit discussing the implications of AI-speed attacks, what defenders should cease doing, and how to validate, decide, fix, and re-validate at machine speed. Save your seat.
Source: Original article
