Homebrew: Trust, Security, and the Advisory History Cleanup
A cluster of fixes closed gaps in how Homebrew verifies tap trust and formula history, while a security fix in curl's redirect handling addressed a real secret-leak vector. Meanwhile the team kept pushing broad maintainability work: stricter type checking and a new ban on shell command literals.
Duration: PT2M29S
Episode overview
This episode is a short developer briefing from Homebrew.
It explains recent repository work in plain language.
- Show: Homebrew
- Published: 2026-09-07T13:12:24Z
- Audio duration: PT2M29S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Good day, and welcome to Homebrew, your developer briefing for September 7th, 2026.
Today's biggest signal is trust — both the security kind and the historical-data kind — getting hardened across several corners of the codebase.
Start with security. PR 23863 closes a real gap in curl's deferred secrets handling: a malicious server could redirect using its own Location header, preserving a masked variable's placeholder, and get the real secret sent back on the next request. The existing max-redirs guard from a prior fix didn't catch this…
Trust also got attention in two smaller fixes from dduugg. PR 23865 fixes a case-sensitivity bug where trusting a tap with uppercase letters in its remote wouldn't match later checks. PR 23864 closes a hole where any command with a tap's name anywhere in its arguments — not just tap or untap — could grant blanket…
The second theme is historical data integrity. A run of PRs from p-linnane — 23845, 23857, 23858, and 23859 — chase down why `brew advisory-match` and related history walks were producing wrong or misleading results: unreadable old revisions, shallow clones misread as full history, and legacy bottle formats that…
Rounding out the day: broad…