Show HN: Homebrew 6.0.0

#1

Post by mikemcquaid » Thu, Jun 11, 2026, 1:24 PM UTC

Today, I’m proud to announce Homebrew 6.0.0. The most significant changes since 5.1.0 are a new tap trust security mechanism, the new faster, smaller, default internal Homebrew JSON API, sandboxing on Linux, better defaults informed by our user survey, many brew bundle improvements, improved performance and initial support for macOS 27 (Golden Gate).

Happy to discuss any questions here!

Show HN: Homebrew 6.0.0
brew.sh

Re: Show HN: Homebrew 6.0.0

#2

Post by [deleted] » Thu, Jun 11, 2026, 1:24 PM UTC

[deleted]

Re: Show HN: Homebrew 6.0.0

#3

Post by 7839284023 » Thu, Jun 11, 2026, 4:15 PM UTC

Awesome! Thank you for the update.

I noticed that homebrew updated _all_ my casks when running 'brew upgrade' (even those with "auto_updates: true" in their Cask JSON API).

Is this intended, new default behavior? This did not use to happen...

Re: Show HN: Homebrew 6.0.0

#4

Post by ansonhoyt » Thu, Jun 11, 2026, 5:13 PM UTC

Is there a way to `brew trust` inside my Brewfile? That'd be nice for the handful of formulas I install from github repos via `brew bundle --global`.

Re: Show HN: Homebrew 6.0.0

#5

Post by perryprog » Thu, Jun 11, 2026, 5:22 PM UTC

7839284023 wrote: post #3

Awesome! Thank you for the update. I noticed that homebrew updated _all_ my casks when running 'brew upgrade' (even those with "auto_updates: true" in their Cask JSON API). Is this intended, new default behavior? This did not use to happen...

You need to set HOMEBREW_NO_UPGRADE_AUTO_UPDATES_CASKS to 1, as alluded to by a hint when it (first?) occurs. This means if you have hints off (via HOMEBREW_NO_ENV_HINTS) then I suspect you can start getting this behavior without warning which is a bummer.

Re: Show HN: Homebrew 6.0.0

#6

Post by joshuat » Thu, Jun 11, 2026, 5:24 PM UTC

Is the eventual goal to move most formula/cask behavior into declarative install steps and treat Ruby as an escape hatch?

Re: Show HN: Homebrew 6.0.0

#7

Post by broxit » Thu, Jun 11, 2026, 5:30 PM UTC

Thanks for the update. Is there any chance we can get some kind of cooldown mechanism in Homebrew?

The only people I want to trust to quickly ship new code to my machine are Apple and my browser (which handles more untrusted input than anything else).

For everything else (vscode and its extensions, npm, homebrew, and all the apps that self-update), I prefer to err on the side of waiting a few days.

Some exceptional 0days might warrant a cooldown bypass, but even in its current form users are vulnerable to 0days until they run brew upgrade.

Re: Show HN: Homebrew 6.0.0

#8

Post by reactordev » Thu, Jun 11, 2026, 5:31 PM UTC

Hell yeah, tap trust!!!

Re: Show HN: Homebrew 6.0.0

#9

Post by dpassen1 » Thu, Jun 11, 2026, 5:33 PM UTC

ansonhoyt wrote: post #4

Is there a way to `brew trust` inside my Brewfile? That'd be nice for the handful of formulas I install from github repos via `brew bundle --global`.

`brew tap/recipe, trusted: true`

Re: Show HN: Homebrew 6.0.0

#10

Post by runjake » Thu, Jun 11, 2026, 5:33 PM UTC

broxit wrote: post #7

Thanks for the update. Is there any chance we can get some kind of cooldown mechanism in Homebrew? The only people I want to trust to quickly ship new code to my machine are Apple and my browser (which handles more untrusted input than anything else). For everything else (vscode and its extensions, npm, homebrew, and all the apps that self-update), I prefer to err on the side of waiting a few days. Some exceptional 0…

+1

For those who don't know what broxit is talking about, they're referring to something like --minimum-release-age/minimumReleaseAge in many pieces of software and package managers to reduce vulnerability to supply chain attacks. Often times, such attacks are detected within a few days of compromise.

Here's Bun's, as an example: https://bun.com/docs/pm/cli/install#minimum-release-age