Homebrew: Sandbox Lockdown and Legacy Loads
Sandbox isolation dominated activity with five changes balancing download security and reliability, while history and autobump fixes restored compatibility with older formulas and version-specific casks. A cask permission fix also closed a symlink safety risk.
Duration: PT2M19S
Episode overview
This episode is a short developer briefing from Homebrew.
It explains recent repository work in plain language.
- Show: Homebrew
- Published: 2026-09-30T13:19:43Z
- Audio duration: PT2M19S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Good morning, it's September 30th, 2026 — this is your Homebrew briefing.
The headline this cycle is sandbox lockdown: tightening build isolation without breaking legitimate downloads.
First, Git downloads in the sandbox. PR 24121 allows sandboxed Git to follow symlinked credential files for users with dotfiles in protected home directories, but restricts read access to just those files so parent folders stay denied. That fixed issue 24119. PR 24132 follows up with a private working directory, so…
Second, compatibility with the past. PR 24131 makes advisory history walks load every old formula revision across all four simulated platforms, teaching retired version checks and undated deprecation calls to answer from the simulated target instead of the host machine. That matters for vulnerability backfills that…
Finally, small hardening. PR 24134 stops permission fixes during cask cleanup from following symlinks, closing a risk where a recursive ownership change could affect a link target. PR 24118 also steadies flaky cleanup and bottle tests to cut network timeouts. Separate proposals on contribution counting, log sharing,…
What's next: watch whether the token-for-downloads proposal…
Nearby episodes from Homebrew
- Stopping Wrong Deletes, Fetches and Hangs
- Stalled Audits and Bump Accuracy Fixes
- Weekly Recap - Sandboxing, Privilege-Free Installs and Hang Fixes
- Bottle Control and Input Guardrails
- Version Trust Fixes and Everyday Reliability
- Dispatch and Download Reliability Fixes
- Sudo-Free Installs and Quieter Warnings
- Managed Deployment and Sandbox Reliability