Homebrew 6.0.0 is a broad release centered on a clearer security boundary: code from a third-party tap should not be evaluated merely because that repository is installed. In the announcement dated 11 June 2026, author Mike McQuaid presents tap trust as the release’s most significant change. The visible date on the primary page matches the supplied publication date, so no date correction is needed.
The underlying risk is specific. Homebrew taps can contain formulae, casks, and external commands, and loading them may execute Ruby code while Homebrew resolves dependencies, discovers packages, or runs commands. The project says Homebrew 6.0.0 requires non-official taps and relevant individual items to be explicitly trusted before that code is evaluated. Official Homebrew taps and built-in commands remain trusted by default.
The Tap Trust documentation supplied with the packet explains how the mechanism is intended to work. A user can trust a particular formula, cask, or command, or trust an entire tap; the latter accepts all current and future code from that repository. Commands that need untrusted content fail until the appropriate trust is granted, and `brew doctor` warns about non-official taps that have not been trusted. This is a containment and consent mechanism, not a guarantee that trusted code is harmless.
The announcement says the release also stops automatically tapping untrusted repositories, applies trust checks when evaluating formulae and casks, and pins trust, allow, and forbid lists to remote repositories. The documentation describes the same default model, but both documents come from Homebrew’s own project materials. They corroborate the project’s description of the feature without providing an external security audit or demonstrating that no implementation bypass remains.
Homebrew also changes its metadata path. The project reports that its internal JSON API is now the default, combining metadata into one download so that updates require fewer network requests. The API had been available behind `HOMEBREW_USE_INTERNAL_API` since Homebrew 5.0.0, and that environment variable is now deprecated. The supplied source gives no benchmark methodology or measured savings, so the performance improvement should be understood as a project claim rather than a universal result.
Linux package operations receive another important change. Homebrew says the Bubblewrap sandbox is enabled by default for developers on Linux, covering build, test, and post-install phases in a way that aligns more closely with existing macOS behavior. The announcement also describes shared sandbox code, hardened install phases, cask executable hooks, and related CI changes. The materials do not establish that every Linux package path is isolated or that sandboxing removes all supply-chain risk.
The release changes routine user interactions as well. Following a Homebrew user survey, the project says “ask” mode is now the default for developers: `brew install` and `brew upgrade` present dependency information and request confirmation before making changes. The announcement describes grouped upgrade prompts, one-key confirmations, and clearer summaries. Users who automate package changes may therefore need to adjust workflows that previously proceeded without an interactive confirmation.
Other reported additions include parallel formula installation in `brew bundle`, broader cleanup and extension support, AppImage support for Linux casks, new service-path handling, and a `brew exec` command for formula environments. Homebrew also reports startup optimizations, faster `brew leaves`, parallel bottle-tab fetching during upgrades, and initial support for macOS 27, code-named Golden Gate. These are release-note claims; the packet contains no independent compatibility testing or performance results.
The most concrete compatibility warning concerns Linux. Homebrew says its Ubuntu 24.04 CI migration raised the baseline system `glibc` requirement to version 2.39. Systems with older libraries, including Ubuntu 22.04 with `glibc` 2.35, are described as Tier 2: they receive no new bottles and produce a `brew doctor` warning. The announcement recommends the Homebrew Docker image or a Tier 1 configuration such as Ubuntu 24.04, so affected users should verify their distribution and library versions before upgrading.
The project also outlines a future macOS transition. Because macOS 27 is described as dropping Intel support, Homebrew plans to move Intel x86_64 macOS to Tier 3 in September 2026, with no CI support or new bottles, and to remove related code in September 2027. These are stated plans rather than evidence that every Intel machine or third-party package will follow the same practical timeline.
Finally, the release notes identify three security advisories involving download redirects, Git hooks in the macOS installer package, and a user-controlled plist that could affect package ownership. Homebrew says the issues were fixed, and also reports additional protections around sensitive environment variables and checksum requirements. The supplied documents do not include exploit demonstrations, independent code review, or downstream impact measurements. The defensible conclusion is narrower: Homebrew reports that 6.0.0 addresses specific vulnerabilities and adds new defenses, while the available evidence does not establish the complete security posture of every tap, package, or installation environment.