Show HN: Homebrew 6.0.0 • Hacker News Board

Re: Show HN: Homebrew 6.0.0

#41

Post by PufPufPuf » Thu, Jun 11, 2026, 6:06 PM UTC

vitorsr wrote: post #22

Thanks for all the hard work. We are not many [1], but Homebrew has been a great way to quickly bootstrap an environment in immutable Linux distributions. Note that certain operating systems such as Universal Blue's Bazzite (1.28%), Bluefin (0.49%) and Aurora (0.28%) default to bundling Homebrew [2]. [1] https://formulae.brew.sh/analytics/os-version/365d/ [2] https://github.com/ublue-os/brew

The concept of a "userspace package manager" is something I would expect Linux to have figured out twenty years ago. It's ridiculous that the usual situation for non-root users is "you can't install XY but feel free to build from source". Homebrew, Mise and Nix are filling that hole now. (Flatpak is more oriented towards GUI apps, and Snap... exists.)

Re: Show HN: Homebrew 6.0.0

#42

Post by PufPufPuf » Thu, Jun 11, 2026, 6:08 PM UTC

pknerd wrote: post #34

Thanks for producing such an amazing piece of software. Most of my Mac installations are based on Homebrew, but I have to rely on version management tools like Pyenv or nvm for Python and Node. Wish there was some standard 'Homebrew' way to install multiple versions of node, php and Python

Have a look at https://mise.jdx.dev/, it's exactly what you're looking for!

Re: Show HN: Homebrew 6.0.0

#43

Post by threecheese » Thu, Jun 11, 2026, 6:09 PM UTC

I assume this trust issue is related to the not-infrequent MacOS notifications asking for permission to run Ruby in the background or when the machine starts. It says nothing about Homebrew though.

Re: Show HN: Homebrew 6.0.0

#44

Post by dionian » Thu, Jun 11, 2026, 6:09 PM UTC

homebrew is so nice, thank you for all your effort

Re: Show HN: Homebrew 6.0.0

#45

Post by threecheese » Thu, Jun 11, 2026, 6:10 PM UTC

PufPufPuf wrote: post #15

I have switched my full OS-level dev env to https://mise.jdx.dev/ from Homebrew+pipx+npm, initially as an experiment but found out that it actually works amazingly well. Many things get installed directly from GitHub releases or a corresponding package manager (uv, pnpm, go get ...), zero glue code to "repackage", zero version lag. You can install any arbitrary version of a package, even multiple ones at once, and dy…

Do you have an example? Sounds interesting.

Re: Show HN: Homebrew 6.0.0

#46

Post by PufPufPuf » Thu, Jun 11, 2026, 6:10 PM UTC

0xbadcafebee wrote: post #13

Personally I stopped using Homebrew after I got screwed too many times on mandatory upgrades that I couldn't pin. I use a combination of Mise and MacPorts now so I don't get any more surprise breakage and forced obsolescence. Plus Mise allows me to upgrade to any new version, whereas with Homebrew you have to wait for whenever the tap feels like upgrading (llama.cpp tap skips every 10 releases)

I'm in the "switched most to Mise" stage, might look into MacPorts for the remaining stuff, thanks for the tip!

Re: Show HN: Homebrew 6.0.0

#47

Post by c-hendricks » Thu, Jun 11, 2026, 6:12 PM UTC

let_rec wrote: post #37

Does Homebrew have good support for exact (and older) versions of packages now?

I don't think that's a part of its goals at all.

Re: Show HN: Homebrew 6.0.0

#48

Post by PufPufPuf » Thu, Jun 11, 2026, 6:12 PM UTC

bigyabai wrote: post #23

0xbadcafebee wrote: post #13

Personally I stopped using Homebrew after I got screwed too many times on mandatory upgrades that I couldn't pin. I use a combination of Mise and MacPorts now so I don't get any more surprise breakage and forced obsolescence. Plus Mise allows me to upgrade to any new version, whereas with Homebrew you have to wait for whenever the tap feels like upgrading (llama.cpp tap skips every 10 releases)

Nix is also worth checking out, even if the Darwin packaging is a bit flaky. I really appreciate having cross-platform devshells when I have to alternate between Mac and Linux on a regular basis.

Mise is also cross-platform, we actually use it at work for projects we develop locally on macOS, then build in CI on Linux -- it even supports multiplatform lockfiles. I had a few tries with Nix but it's a lot to wrap your head around, Mise is simple to "just try".

Re: Show HN: Homebrew 6.0.0

#49

Post by PufPufPuf » Thu, Jun 11, 2026, 6:13 PM UTC

let_rec wrote: post #37

Does Homebrew have good support for exact (and older) versions of packages now?

Nope, still rolling. Have a look at https://mise.jdx.dev/ if you need exact versions

Re: Show HN: Homebrew 6.0.0

#50

Post by mikemcquaid » Thu, Jun 11, 2026, 6:14 PM UTC

broxit wrote: post #40

mikemcquaid wrote: post #16

Earlier quoted context omitted.

https://docs.brew.sh/Supply-Chain-Security details how we’re handling cooldowns and why we have a very different risk profile to e.g. NPM. Also, where we package things from NPM/PyPi/RubyGems that have been subject to these attacks: we already apply cooldowns for you both when packaging and when creating PRs to update to new versions.

Glad to see that Homebrew is taking security seriously. Still, I want to minimize the number of parties who can quickly get new code onto my machine. Your doc says "Human review of each release." What does that actually entail? uv had a release at 10:21am yesterday with 7,060 additions and 2,409 deletions. The new release was available in homebrew at 11:46am. What human review happened there? I don't know of any othe…

Our automation or a human submitted a PR, it was built and tested in our sandboxed ephemeral CI environments, a human Homebrew maintainer reviewed the CI results and PR diff and approved it for merge which happened automatically if so.

If the ask is "who reviewed the diff": yes, a human didn't do that. That's not actually happening for all packages in any meaningful large ecosystem. I'm still unconvinced a cooldown solves that until e.g. we have an open source security scanner that runs on all Homebrew packages and requires a cooldown. Even in that case, my suggestion would be that we just run it in our own CI and block package release.