Homebrew: Security Fixes and Full-Stack Bundle Upgrades
Homebrew closed several trust gaps around external commands and cached downloads, while extending brew bundle upgrade to Go, Cargo, Flatpak and more. The other pattern is cleanup of doctor warnings and formula guidance.
Duration: PT2M14S
Episode overview
This episode is a short developer briefing from Homebrew.
It explains recent repository work in plain language.
- Show: Homebrew
- Published: 2026-11-05T14:15:05Z
- Audio duration: PT2M14S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Good morning, it's November 5th, 2026, and this is your Homebrew briefing.
The lead story is trust. This cycle tightened several places where untrusted or unexpected code could run, while making upgrades more complete.
First, security hardening. In PR 24483, a path check was added to external command lookups after a report that brew help with dot-dot paths could resolve and run an executable outside the command directories. Related work in PR 24477 allows untapping taps with untrusted formulae without evaluating that formula code,…
Second, bundle finally covers the rest of your stack. PR 24445 adds upgrade checks for Go, Cargo, U V, Krew, Flatpak, and Winget packages, adds targeted V S Code extension upgrades, and respects no-upgrade flags while keeping package sources. If you manage polyglot environments with a Brewfile, expect fewer manual…
Third, a polish wave for maintainers. Doctor and reporting output gets clearer spacing and ordering in PRs 24485 and 24486, and open PRs 24490 and 24491 address duplicate warnings and wrong disabled dates for removed formulae like OpenSSL 1.1. Formula guidance also improves, with expanded language docs in PR 24479,…
What's next: watch bundle…
Nearby episodes from Homebrew
- Weekly Recap - Safer Uninstalls and Stricter Typing
- Correct Reinstalls and Safer Uninstalls
- Legacy Keg Safety and Lint Cleanup
- Taming Source Upgrades
- Cleaning Up Dead Formulae and Tightening Governance
- Explicit Loading Refactor and Trust Fixes
- Safer Loading and Bottle Fixes
- Weekly Recap - Hardening Install Trust and Fixing Reporting