Homebrew 7.0.0 arrived on 13 September. The part worth having is a vulnerability check built into the tool you already use to install everything else.
brew vulns
7.0.0 ships brew vulns, which checks installed formulae against Homebrew’s own advisory database through OSV.dev. It needs no extra tap or gem. It takes --severity=high, --deps and --brewfile, and can separate findings by whether a fix exists yet. The database itself records vulnerabilities against the formula versions Homebrew actually ships, including backported fixes, and the records are published in OSV format under CC0, so other tools can read them.
The same release names first fixed versions for eight advisories. The High one, fixed back in 6.0.12, let unsigned cask-removal metadata run commands with sudo. A Moderate fixed in 7.0.0 let a malicious cask escape the install sandbox through LaunchServices. The rest are Low, covering redirects in livecheck and in downloads, Subversion external URLs, patch targets escaping the staged source tree, and Git redirects bypassing tap restrictions.
Sandboxing and speed
Formula and cask operations run sandboxed now, and dependency downloads move into a separate fetch phase: network access while downloading, no network and read-only caches while installing. Sandboxed reads of your home directory are blocked by default, and setuid wrappers are rejected outright. On Linux, Bubblewrap is replaced by Landlock, which needs no dependencies; a kernel without Landlock keeps working unsandboxed and brew doctor reports it as an advisory. Installs, reinstalls and upgrades overlap downloads with package preparation, which is where the speed comes from.
What it costs
macOS 10.15 support is gone. Intel Macs are Tier 3: existing bottles stay, newer formulae may need a source build, and Homebrew stops running on Intel in September 2027, with MacPorts suggested instead. Sonoma 14 also stops receiving new bottles. There is an official GUI, BrewUI, if you are on macOS Tahoe 26 or later.
My read
Run brew update for brew vulns, not for the sandbox. It answers a question release notes never answer: which of the packages on this machine have a known vulnerability and a fix waiting. The Intel decision is not much of a decision, since Apple and GitHub walked away from the platform first.
Source: Homebrew 7.0.0