Homebrew 6.0 Introduces a Tap Trust Security Model
Third-party taps now require explicit approval before their code runs, part of a release that also adds Linux sandboxing and early macOS 27 support.
Homebrew, the package manager most Mac developers use to install command-line tools, released version 6.0.0 on June 11, 2026 — its first major version bump since 5.0. The release's core change is a new "tap trust" security model: third-party taps, along with any tap-qualified formulae and casks, now require explicit approval before Homebrew will evaluate or run their code. Homebrew's own official taps remain trusted by default, so the change mainly affects users who add outside repositories, which can otherwise contain arbitrary Ruby code that runs with the same privileges as Homebrew itself.
The release also switches the faster, smaller internal JSON API from an opt-in environment variable to the default behavior for everyone, consolidating package metadata into a single download rather than many smaller requests, which speeds up routine operations like `brew update`.
On Linux, Homebrew extends the sandboxing approach it has used on macOS for some time, using Bubblewrap to isolate the build, test, and installation phases of a formula from the rest of the system — closing a gap where Homebrew on Linux had less isolation than the same tool running on a Mac.
The release also adds initial support for macOS 27 ("Golden Gate"), while signaling a longer-term platform shift: support for Intel-based Macs is moving to Tier 3 starting in September 2026, meaning no new pre-compiled Intel binaries will be published from that point, with full removal of Intel support planned for September 2027.
The risk tap trust addresses is a real one: because a Homebrew tap can contain arbitrary Ruby code that runs with the same privileges as Homebrew itself, a malicious or compromised third-party tap has historically been able to run code on a user's machine the moment its formula was installed, with no separate warning step. Requiring explicit trust closes that gap for any tap outside Homebrew's own official set.
Homebrew publishes full release notes for every version on its own blog, brew.sh, alongside the raw changelog on its GitHub repository.
Source: Homebrew — 6.0.0 Release Notes