Millions of Macs carry a package manager that was installed once and has rarely been audited since. Its newest release hands that job back to the machine.
Homebrew 7.0.0 arrived on September 13 with a scanner folded into the command line. Running brew vulns checks installed formulae against OSV.dev and Homebrew’s own advisory records without pulling in an extra tap or Ruby gem, and it narrows by severity, walks dependencies, or reads a Brewfile covering a whole project tree.
A version number that hides a silent repair
Generic scanners misread this project’s numbering. A formula can sit below its newest upstream release and still be safe, because Homebrew backports fixes without adopting the newer version. Its records therefore describe the revisions it actually distributes, and it publishes them through a formula API and a reusable OSV-format index, so other tools can separate an outstanding hole from a repair already delivered.
The release also seals a flaw the project rated moderate. During installation a malicious cask could escape the sandbox by way of LaunchServices, whose allow-by-default profile left Mach lookups reachable. Directories the profile expressly shielded, among them SSH keys, cloud credentials and Docker configuration, stayed readable regardless. Application launching, Mach services and Unix socket connections are all restricted now, home-directory reads inside the sandbox are refused by default, build tools get private temporary space, and downloads moved into a fetch phase so installation runs with networking disabled and caches locked read-only. Nobody should read any of that as a licence to install from an untrusted tap: cask applications inherit the user’s own privileges, and vendor installers still execute outside the sandbox altogether.
