How brew is put together
Homebrew is the package manager for macOS/Linux, implemented almost entirely in Ruby under Library/Homebrew with a thin Bash launcher (brew.sh/bin/brew). It is a CLI application rather than a web service: commands parse formulae/casks (from taps or the formulae.brew.sh JSON API), resolve dependencies, download sources or prebuilt bottles via curl-backed download strategies, and install/link 'kegs' into the HOMEBREW_PREFIX. Package metadata is cached as frozen JSON parsed from the API (with JWS signature verification for .jws.json endpoints) and in on-disk cache stores; settings persist in the repository's .git/config. A standalone Ruby MCP server exposes brew commands over JSON-RPC 2.0 on stdio.
Languages
Frameworks
Datastores
Infrastructure
Major components
Formula/Cask core
Defines the Formula DSL class and cask equivalents that describe packages, their resources, options, and build lifecycle.
API layer (Library/Homebrew/api*)
Fetches, verifies (JWS), caches, and merges JSON metadata from the Homebrew API domain with fallback to default domains.
Download system
download_strategy.rb, downloadable.rb and download_queue.rb implement curl-based source/bottle downloads with retries, mirrors, and a concurrent queue.
Install/link machinery
formula_installer.rb, keg.rb, keg_relocate.rb, tab.rb handle pouring/building packages, relocating binaries, and recording installation metadata.
Tap management
tap.rb manages local clones of third-party/formula repositories including remotes, pinning, and auditing.
Env/config & diagnostics
env_config.rb declares all HOMEBREW_* environment variables; system_config.rb and diagnostic.rb ('brew doctor') report host/toolchain state.
MCP server
mcp_server.rb is a standalone stdio JSON-RPC 2.0 server mapping MCP tool calls to brew subcommands (search, info, install, update, etc.).
Developer tooling
RuboCop custom cops (rubocops.rb), formula_auditor.rb, livecheck.rb, style.rb, and manpages/completions generation support contribution workflows.
A lighter week wrapping up cask polish, security documentation, and several reliability fixes.
5 weeksWeek of 2026-08-24
Week of 2026-08-24latest
A lighter week wrapping up cask polish, security documentation, and several reliability fixes.
Week of 2026-08-17
A very busy week centered on security advisories, network access controls, and a big Sorbet type-checking push.
Week of 2026-08-10
The week's focus was vulnerability tooling, cask linting rules, and sandbox terminal-handling fixes.
Week of 2026-08-03
Performance, packaging standards, and sandboxed cask installs dominated this week.
Week of 2026-07-27
A minimal week with a single infrastructure change.
Over the past month, Homebrew's brew repository saw a steady stream of security and reliability work: vulnerability scanning gained new tooling and data sources, cask (macOS app) installs were made safer by running privileged steps in the parent process with better sandboxing, and bottle downloads now carry relocation metadata for more efficient pours. Performance fixes landed in cleanup, curl, and disk-usage checks, while a large ongoing effort tightened type checking (Sorbet) and code style rules across the codebase. The final week was a quieter wrap-up focused on cask URL formatting rules and documentation of the Gatekeeper security model.
Week by week
2026-08-24A lighter week wrapping up cask polish, security documentation, and several reliability fixes.latest6 changes
Refactor
Cask URL formatting enforced
A style rule now requires keyword parameters in cask download URLs to sit on their own indented lines, keeping package definitions tidy.
Docs
Gatekeeper security model explained
New documentation explains how Homebrew's macOS Gatekeeper checks protect users when installing cask apps.
Fix
Curl version caching fixed
Fixed a memoization bug so the tool correctly remembers the installed curl version instead of re-checking it.
Fix
Bundle fails cleanly without Flatpak
If Flatpak isn't installed, 'brew bundle' now reports an error for Flatpak entries instead of failing mysteriously.
Refactor
Privileged cask steps run in parent process
Cask installation steps that need administrator rights are now brokered through the parent process, simplifying how elevated actions happen.
Chore
Analytics moved to brew.sh proxy
Usage analytics traffic was migrated to go through Homebrew's own proxy server.
2026-08-17A very busy week centered on security advisories, network access controls, and a big Sorbet type-checking push.6 changes
Feature
Network access allow-list made exclusive
Builds can now be restricted to only explicitly allowed network destinations, tightening supply-chain safety.
Fix
Security advisory matching improved
Vulnerability matching now resolves historical packages by identity and closes reviewed advisory ranges at the right boundary.
Feature
Bottle relocation metadata recorded
Bottles now store metadata about how they were relocated, enabling smarter pours later.
Feature
Cargo release cooldown prepared
A waiting period before accepting brand-new Cargo package releases is being introduced to guard against freshly published malicious crates.
Chore
Sorbet type coverage expanded
A batch of changes improved type annotations, updated signature files, and made tests easier for the type checker to understand.
Feature
Combined cask and formula downloads
'brew install' can now fetch cask downloads together with formula bottles in one pass, speeding up upgrades.
2026-08-10The week's focus was vulnerability tooling, cask linting rules, and sandbox terminal-handling fixes.6 changes
Feature
Vulnerability command expanded
The vulns command gained options to filter fix types, list skipped items, and support OSS-Fuzz commit ranges.
Feature
Advisory index from formulae.brew.sh
Security advisories are now read from a generated index on Homebrew's website instead of being fetched ad hoc.
Fix
Sandbox keeps terminal output readable
Sandboxed builds no longer mangle terminal output during long-running tasks, fixing garbled progress displays.
Fix
Help parser handles '--' arguments
Passing '--' on the command line no longer crashes the help system.
Chore
Cask stanza ordering rules added
New style checks enforce consistent ordering of sha256 and conditional stanzas inside cask definitions.
Refactor
Curl skips unused bodies
When only response headers are needed, curl requests now avoid downloading the body, saving bandwidth.
2026-08-03Performance, packaging standards, and sandboxed cask installs dominated this week.6 changes
Refactor
Cleanup made dramatically faster
Removed accidentally quadratic behavior in 'brew cleanup', plus cached formula cache paths, so cleanups finish much quicker.
Feature
Swift build helper added
Formulas can now use std_swift_args to get standard Swift compiler flags automatically.
Fix
Sandboxed casks can use sudo
Cask install steps running in a sandbox may now request administrator rights when needed, including implicit sudo handling.
Fix
Services work over SSH
Fixed the service status check so managed services report 'running?' correctly in SSH sessions.
Chore
Structured install steps enforced
Post-install coexistence behavior is rejected unless install steps follow the structured authoring format, keeping bottled inputs standard.
Chore
RuboCop upgraded to 1.89.0
The code-style linter was bumped to the latest version with project indexing enabled and new offenses fixed.
2026-07-27A minimal week with a single infrastructure change.1 change
Chore
Large runner Docker image published
Built and published a Docker image for GitHub's larger CI runners to support heavier automated testing workloads.
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 0 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required