Homebrew stops shipping Intel bottles 353 days before its 2027 cutoff

`brew vulns` starts from what is on disk. It reads package metadata, including software bills of materials where those exist, to identify the version actually installed, then queries OSV.dev and Homebrew's own advisory database ^[3][2]. Findings can be filtered by severity, and split into the ones with an available fix and the ones without ^[2].

Homebrew's advisory database holds OSV-format records for formula versions and revisions where the project applied its own security patches ^[4]. Those are the packages whose upstream version number does not describe the code on disk. A scanner matching version strings against upstream advisories would report them as vulnerable after Homebrew had already fixed them.

The sandbox changes are narrower than the scanner. 7.0.0 fixes a moderate-severity escape in which a malicious cask could use LaunchServices to execute code outside the installation sandbox, restricting application launches, Mach services and Unix socket connections during cask installation ^[5]. Sandboxed package operations also stop reading the user's home directory by default, and downloads keep moving into a separate fetch phase so installation can run without network access ^[6]. McQuaid's release notes say applications installed through Homebrew still run with the user's privileges, that vendor `.pkg` installers operate outside Homebrew's sandbox and may request `sudo`, and that trusting a third-party tap remains the consequential security decision ^[7]. Those controls build on the tap trust settings added in 6.0.0 ^[20].

Linux gets a different implementation. Landlock replaces the Bubblewrap sandbox introduced in 6.0.0, avoiding an external dependency and elevated Docker permissions ^[8]. Kernels without Landlock keep working with no sandbox, and `brew doctor` reports the missing sandbox as an advisory ^[9].

McQuaid framed the release around speed and security, according to runtimewire.com ^[16]. The speed comes from overlap: downloads, package preparation and installation can now run concurrently across `brew install`, `brew reinstall`, `brew upgrade` and multi-package `brew bundle` runs ^[10]. Homebrew did not attach a benchmark, and says the payoff varies with package mix, network speed and cache state ^[11]. For that to help a given fleet, the slow commands would have to be multi-package runs with a cold cache, where one package's download can overlap another's preparation. Upgrading a single cached formula has nothing to overlap.

BrewUI, a native macOS application, is listed among version 7's major changes ^[12].

Intel has two dates. Support ends on September 1st, 2027, new bottle builds for the architecture stop with 7.0.0, and Homebrew says only that some existing bottles may continue to work ^[13]. McQuaid says he will mark 17 years on the project this month, and he has maintained it since Max Howell created it in 2009 ^[17]. That dates the September 13th release to 2026 ^[18], and leaves 353 days between the release and the cutoff ^[19]. The set of packages an Intel machine can install from a bottle stops advancing at the start of that window, not the end. Tier 3 also means the project does not support the configuration, with limited community help through Homebrew Discussions ^[14]. Homebrew directs anyone keeping Intel hardware to MacPorts, which continues to provide Intel support ^[15].