MikeMcQuaidToday, I’d like to announce Homebrew 4.3.0. The most significant changes since 4.2.0 are SBOM support, initial bottle attestation verification, new command analytics and uninstall autoremove by default.
Major changes and deprecations since 4.2.0:
-
brew bottlewill include a basic SPDX file inside the bottle and a more comprehensive one after installation. This is to provide support for the widely used SBOM format from Homebrew. -
If
HOMEBREW_VERIFY_ATTESTATIONSis set,brew installwill verify the bottle artifact’s attestation when pouring bottles using GitHub’sghCLI. This functionality is still in beta. We expect to remove the need for theghtool and improve performance before we make this the default behaviour. This behaviour demonstrates Homebrew’s ongoing commitment to improving our security posture. Read more in the tracking issue or in the GitHub artifact attestation announcement -
HOMEBREW_AUTOREMOVEis the default behaviour meaning thatbrew cleanupandbrew uninstallautomatically runbrew autoremove. Disable this by settingHOMEBREW_NO_AUTOREMOVE. This is to improve the default behaviour ofbrew uninstallgivenbrew autoremoveis sufficiently reliable. -
Homebrew has two new types of analytics: “Brew Command Run” events and
brew test-botanalytics. The latter are not working or published yet but will be soon. These are to help us improve the documentation and prioritisation of issues in Homebrew. -
Homebrew/homebrew-cask requires code signing of all casks. Expect removal of casks that are not code signed from Homebrew/homebrew-cask in future. This is because code signing is required on Apple Silicon which is used by a growing majority of all Homebrew users.
-
Homebrew/homebrew-cask-versions migrated to Homebrew/homebrew-cask and is archived, following Homebrew/homebrew-cask-drivers. Migration for Homebrew/homebrew-cask-fonts will happen soon. This will make it easier to have a more consistent installation, discovery and maintenance experience for all official casks.
-
As-of Homebrew 4.3.1: Homebrew now provides Portable Ruby 3.3.1 and requires Ruby >=3.3.0.
Other changes since 4.2.0 I’d like to highlight are the following:
-
HOMEBREW_FORBIDDEN_CASKS,HOMEBREW_FORBIDDEN_FORMULAEandHOMEBREW_FORBIDDEN_TAPSare added to extend the functionality beyond the existingHOMEBREW_FORBIDDEN_LICENSESto prevent formulae/cask/tap installation. Relatedly,HOMEBREW_ALLOWED_TAPSwas added to restrict installation of and from specific taps. -
GitHub Actions will display native warnings/error notices for deprecations/disables and warnings/errors.
-
There are now several more reasons why casks are deprecated or disabled.
-
Homebrew’s code documentation on rubydoc.brew.sh previously did not do a good job of differentiating public/private/internal (i.e. only public for Homebrew’s use) APIs. We explicitly mark non-private APIs, non-public APIs, warn about undocumented non-private APIs and APIs are private by default.
-
Homebrew’s code documentation on rubydoc.brew.sh includes Sorbet data from
.rbifiles to provide more types. -
brew command,brew shellenvandbrew setup-rubyare significantly faster. - When the GitHub token used by Homebrew requires more scopes, Homebrew will clarify these.
brew upgrade --overwriteis a new flag similar tobrew install --overwriteandbrew link --overwriteto delete files that already exist in the prefix while linking.brew install --display-timesalso works with casks.- Tap migrations can also perform renames.
HOMEBREW_GITHUB_API_TOKENsupports more types of GitHub tokens.- The
brew desc --eval-allwarning only applies tobrew desc --search. brew tapno longer shows untapped taps with API support.brew upgradeno longer truncates some version numbers.- @BrewTestBot can no longer provide approving reviews on Homebrew/brew.
- Formulae can optionally restrict network access in build/test/postinstall sandboxes.
HOMEBREW_TEMPis used more consistently for temporary filesbrew updateoutputs a message whenever it is autoupdating to make clear what is causing the delay. Also,brew updatewill attempt to update all taps, not just those on GitHub.brew install/upgrade/outdatedwill more intelligently auto-update when specifying formulae/casks from third-party taps.brew bump-formulaandbrew bump-cask-prrefuse to bump packages that Homebrew’s automation already handles.brew install --adoptis more permissive and quicker if the bundle versions match.brew uninstallandbrew reinstallwill skip cask quit/signal directives.brew info --json=v2returns a Cask’s bundle versions inbundle_versionandbundle_short_versionkeys.brew infoandbrew tap-infoprovide more consistent output indicating if a package or tap is installed.brew *-synccommands avoid overwriting existing user installations.brew *-synccommands will use their respective:*ENV_ROOTvariables.brew configprovides information about Homebrew/homebrew-core and Homebrew/homebrew-cask taps and JSON API files.brew listprovides--installed-on-requestand--installed-as-dependencyto list formulae installed on request or as dependencies respectively.brew update-resetwill reset to thestabletag when appropriate.brew bump*commands no longer allow forcing multiple PRs.brew bump*commands limit the number of open PRs to 15.brew bumpwill indicate if formulae should sync with others.brew auditwill reject Internet Archive Wayback Machine URLs as these formulae are no longer active.brew auditwill check the license(s) of the specific release rather than the default branch.brew updatewill attempt to parse a GitHub API token from repository URL to better handle private repositories.
Finally:
- Changes to Homebrew’s Governance were merged after a vote of members before the 2024 AGM.
- The minutes of the 2024 AGM are available.
- Homebrew maintainers no longer use forks on official repositories.
- Homebrew accepts donations through GitHub Sponsors and still accepts donations through Patreon. If you can afford it, please consider donating. If you’d rather not use GitHub Sponsors or Patreon (our preferred donation methods), check out the other ways to donate in our README.
Thanks to all our hard-working maintainers, contributors, sponsors and supporters for getting us this far.
Latest Posts
-
7.0.0
13 Sep 2026
Today, I’m proud to announce Homebrew 7.0.0. The most significant changes since 6.0.0 are faster installations and upgrades, stronger sandboxing, a native macOS app, b...
-
6.0.0
11 Jun 2026
Today, I’m proud to announce Homebrew 6.0.0. The most significant changes since 5.1.0 are a new tap trust security mechanism, the new faster, smaller, default internal...
-
5.1.0
10 Mar 2026
Homebrew 5.1.0 has been released. Homebrew’s most significant changes since 5.0.0 are expanded brew bundle support, brew version-install, new -full formula handling an...
-
5.0.0
12 Nov 2025
Today, I’d like to announce Homebrew 5.0.0. The most significant changes since 4.6.0 are download concurrency by default, official support for Linux ARM64/AArch64, tim...
-
4.6.0
05 Aug 2025
Today, I’d like to announce Homebrew 4.6.0. The most significant changes since 4.5.0 are opt-in concurrent downloads with HOMEBREW_DOWNLOAD_CONCURRENCY, preliminary ma...