Homebrew 7.0.0: Intel Macs Demoted, brew vulns Now Live

Homebrew 7.0.0 shipped this morning and if you’re on an Intel Mac or macOS Sonoma, your package manager just downgraded its commitment to you. Both land in Tier 3 — Homebrew’s term for platforms it no longer actively supports. Prebuilt bottles stop. Compile-from-source begins. September 2027 is when Intel support ends entirely. The release also adds long-overdue built-in vulnerability scanning and breaks two CI/CD patterns teams are likely using right now.

Intel Macs and macOS Sonoma Are Now Tier 3

Tier 3 sounds bureaucratic until you hit a “no bottle available” error during a routine brew upgrade. Here’s what it actually means: Homebrew has stopped building prebuilt binary packages (bottles) for Intel x86_64 Macs and macOS Sonoma 14. When a bottle isn’t available, Homebrew falls back to compiling from source — which can take minutes instead of seconds for large packages like LLVM, FFmpeg, or OpenSSL.

The official Support Tiers documentation puts it plainly: “Migration to a Tier 1 or 2 configuration or to a non-Homebrew tool is strongly recommended.” For Intel Mac users, Homebrew explicitly names MacPorts as the recommended migration path. This isn’t a soft nudge — it’s the project telling you it’s time to move.

The Sonoma 14 demotion is what catches many developers off guard. You don’t need to be on Intel hardware to be affected. If you’ve been holding off on upgrading from Sonoma, you’re now in Tier 3 territory too. macOS Sequoia 15 is the new floor for full Homebrew support.

None of this is sudden. The Intel demotion was announced in August 2025, reiterated in the 5.0.0 release notes in November 2025, and is now being enforced. The frustration showing up in community threads isn’t about the decision — it’s that the practical impact wasn’t obvious until packages started failing. Now they will.

Two CI/CD Changes That Break Today

If your pipelines reference either of these, they’re broken as of this release:

1. Homebrew/actions@master is gone. The master branch has been removed from the Homebrew/actions repository. Any GitHub Actions workflow using @master needs to be updated to a CalVer tag or a pinned SHA:

# Before (broken):
- uses: Homebrew/actions/setup-homebrew@master

# After (CalVer tag):
- uses: Homebrew/actions/setup-homebrew@2026.09.13.1

# After (SHA pin — most reproducible):
- uses: Homebrew/actions/setup-homebrew@<full-sha>

2. The Ubuntu 22.04 Docker image is removed. Teams running Homebrew in Docker CI with the Ubuntu 22.04 image must migrate to the new container:

# Before (broken):
FROM homebrew/brew:ubuntu-22.04

# After:
FROM ghcr.io/homebrew/brew:latest

There’s no grace period. Both changes are live with 7.0.0.

brew vulns: Built-In CVE Scanning, Finally

Homebrew was the last major package manager without native vulnerability scanning. npm got npm audit in 2018. Cargo got cargo audit in 2019. pip got pip-audit in 2022. As of today, Homebrew has brew vulns — built in, no tap installation required.

The command scans your installed packages against the Homebrew Advisory Database, which uses the OSV format (the same standard behind GitHub Security Advisories, Go’s vulnerability database, and OSS-Fuzz). Run it now:

# Scan everything installed
brew vulns

# Check a specific formula and all its dependencies
brew vulns openssl --deps

# High severity only
brew vulns --severity=high

# JSON output for CI integration
brew vulns --json

# Check everything in your Brewfile
brew vulns --brewfile

One useful behavior: if a formula’s patch explicitly resolves a CVE, brew vulns suppresses that advisory by default. Pass --no-ignore-patches if you want the full unfiltered list. The advisory database is CC0-licensed and downloadable, which makes it practical to integrate into security pipelines beyond just the CLI.

Faster Installs: Concurrent Downloads Land in 7.0

7.0.0 finally overlaps downloads, package preparation, and installation in parallel. The practical win is most visible when installing a Brewfile with many packages or running brew upgrade across a large set. Previously, Homebrew worked sequentially — download, then install, then download the next package. Now it prepares multiple packages simultaneously. For developers restoring a fresh Mac from a Brewfile, this is a real time improvement.

What to Do Right Now

1. Run brew update && brew upgrade — Get any remaining bottles while they’re still being served for your platform.
2. Check your macOS version — If you’re on Sonoma 14, plan your Sequoia upgrade. If you’re on Intel, start evaluating MacPorts or a hardware upgrade timeline.
3. Update CI/CD pipelines — Replace @master references in Homebrew/actions with CalVer tags. Migrate Ubuntu 22.04 Docker references to ghcr.io/homebrew/brew.
4. Run brew vulns — Find out if any of your installed packages have known CVEs. This takes 30 seconds and you should have been doing it years ago.
5. If you maintain formulas or taps — Run brew style --fix to start migrating deprecated post_install and *flight blocks. Deadline is December 11, 2027.

The full 7.0.0 release notes are at brew.sh. Intel Mac users: September 2027 is the hard end date. That’s a year away. Start planning now, not then.