dk Dark Knight 2026-09-14 5 min read

Homebrew 7.0.0 Tested on Linux: What's Actually New

Homebrew 7.0.0 landed yesterday with a big-tent changelog: faster installs, stronger sandboxing, built-in vulnerability checks, a native macOS app. 619 points on Hacker News within a day. Marketing timelines flatten everything into "new in 7.0.0" — so I did what the changelog won't: I installed 7.0.0 and 6.0.22 side by side on a Linux box, diffed the code, and checked git history for when each headline feature actually shipped. The scoreboard is not what the announcement implies.

The setup: two versions, one prefix, Tier 3 Linux

Homebrew officially supports Linux only under its default prefix, and 7.0.0 adds experimental support for "any prefix under 64 bytes" as Tier 3. I tested exactly that — tarballs of both tags, non-default prefix, no root, no installer script:

$ curl -sL https://github.com/Homebrew/brew/archive/refs/tags/7.0.0.tar.gz | tar xz
$ export HOMEBREW_PREFIX=/tmp/hbtest/prefix HOMEBREW_REPOSITORY=/tmp/hbtest/brew7
$ brew7/bin/brew --version
Homebrew 7.0.0
$ brew7/bin/brew install jq   # cold: API download + 2 bottles
real  4m3.7s

It works. Tier-3 non-default prefix on Linux is real, not aspirational: jq 1.8.2 and its oniguruma dependency poured from bottles and ran. The 4-minute cold run is dominated by the one-time formula API download on a 2-core/1GB VM — not a fair reflection of steady-state performance, and I'll say so up front for everything below.

The security headline: real, running, and backported

The two marquee security features work on my box right now. The Linux sandbox reports Landlock ABI: 4 in brew config — Homebrew swapped Bubblewrap for the kernel-native Landlock LSM, no external binary required. And the new brew vulns command scanned my installed packages against OSV.dev in 1.4 seconds, with severity filters, fix-type filters, and Brewfile support:

$ brew vulns
Checking 2 packages for vulnerabilities...
No vulnerabilities found.
real  0m1.376s

Now the receipts. The announcement presents both as 7.0.0 features. Git archaeology says otherwise:

Neither feature is "new in 7.0.0". Both landed in July, got battle-tested, and were backported into 6.0.x point releases before the major version shipped. The 7.0.0 release notes are honest about the GHSA timeline (most fixes went out in 6.0.6–6.0.12), but the HN framing — and every summary article riding it — treats a feature freeze line as a feature birthday.

The performance claims: my benchmark was a shrug

I benchmarked what this VM could isolate. Warm startup, 5 runs each of brew list --versions:

Homebrew 7.0.0:  515 506 515 548 532 ms
Homebrew 6.0.22: 549 507 520 530 507 ms   (after one cold 1204ms run)

Statistically identical. The cold multi-package install test (figlet, sl, htop in one command — the claim is that 7.0.0 overlaps downloads and preparation) was dominated by network variance on this box: 82s for 7.0.0 versus 62s for 6.0.22, which tells you the benchmark's noise floor, not Homebrew's. Two honest conclusions: on a 2-core Linux VM with warm caches, I could not measure a difference between the versions; and the release notes' biggest perf wins target macOS and CI patterns I can't reproduce here. If you're on an Apple Silicon Mac with 31 outdated packages, the reported real-world wins may be yours. My data neither confirms nor denies — it just refuses to extrapolate.

Verdict: 7.0.0 is a support-matrix release wearing a feature costume

Strip the backports and what's actually new in 7.0.0 is: macOS 10.15 support dead, Intel Macs demoted to Tier 3 with a 2027-09-01 expiry, the macOS app, signed structured setup data, and the fetch-phase migration for dependency isolation. Those are real decisions — the Intel cutoff is genuinely painful for 2019 iMac owners, and the HN thread is a eulogy. The volunteer-run project's math (Apple dropped Intel from macOS 27, GitHub retires Intel runners autumn 2027) is sound even where it's unwelcome.

The bottom line: if you run 6.0.x on Linux or a recent Mac, you already have Landlock and brew vulns — upgrade for the sandbox hardening and prefix flexibility, not for speed you may not measure. And when a major-version changelog says "the most significant changes since 6.0.0", read the commit dates, not the section headers. The most interesting new capability in Homebrew 7.0.0 shipped three weeks before Homebrew 7.0.0.

Related