homebrew/homebrew-cask
🍻 Default casks (upstream binary packages) for the package manager for everywhere
How homebrew-cask is put together
homebrew-cask is the official Homebrew 'tap' repository containing thousands of macOS/Linux application casks written in Ruby using the Homebrew Cask DSL. It is not an application with servers or databases; it is a declarative package-definition registry consumed by the `brew` CLI (from the separate Homebrew/brew repo), which parses each cask's stanzas (version, url, sha256, app, uninstall, zap, livecheck) to download, verify, install, and uninstall prebuilt software. Supporting tooling lives in `cmd/*.rb` as developer-helper subcommands built on Homebrew's AbstractCommand framework. Data flow is simple: brew fetches the tap, evaluates a cask file, downloads the artifact from the vendor URL, verifies its SHA-256 against the pinned value in the cask, then performs filesystem moves/cleanup per the stanza instructions.
Languages
Frameworks
Infrastructure
Major components
Casks/ definition tree
Thousands of per-app Ruby cask files organized into single-letter subdirectories, each declaring version, download URL, sha256, install/uninstall/zap stanzas, livecheck strategy, and caveats.
cmd/ developer helper commands
Hidden brew subcommands (find-appcast, list-ids-in-app, list-running-app-ids, etc.) that introspect app bundles, pkgs, and running processes to help cask authors derive bundle IDs, login items, and appcast URLs.
audit_exceptions/ policy data
JSON allowlists/skiplists (github_prerelease_allowlist, gitlab_prerelease_allowlist, secure_connection_audit_skiplist, signing_audit_skiplist, simple_user_agent_for_homepage) that relax specific brew audit checks for vetted casks.
Tap metadata manifests
cask_renames.json and tap_migrations.json map renamed or migrated casks so brew can redirect users to current names/taps.
livecheck configuration
Embedded `livecheck` blocks inside casks plus strategies like :sparkle and :electron_builder define how upstream versions are discovered automatically.
Project documentation and contribution workflow
README.md, USAGE.md, CONTRIBUTING.md, AGENTS.md, CLAUDE.md, and doc/ guides define how users report bugs and how contributors author and submit new casks.
A high-volume maintenance week with hundreds of automated app version bumps keeping the Homebrew Cask catalog current.
This week on homebrew-cask was dominated by routine maintenance: roughly 400 commits, almost all of them automated or community-submitted version bumps that keep Mac apps installable via Homebrew at their latest releases. Notable updates included new versions of MongoDB Compass (in all its editions), Firefox Nightly, Microsoft Edge Canary, Postman, and Cyberduck. No structural changes or bug fixes stood out; the week was purely about freshness of the app catalog.
Chore
MongoDB Compass updated to 1.49.15 across editions
The main MongoDB Compass app plus its isolated and read-only variants were all bumped to version 1.49.15.
Chore
Browser nightlies and betas refreshed
Firefox Nightly moved to 156.0a1, Microsoft Edge Canary to build 154.0.4238.0, Opera Air to 134.0.5954.84, and Motrix Beta to 2.0.0-beta.25.
Chore
Popular productivity and developer tools bumped
Postman reached 12.25.3, Mendeley Reference Manager 2.149.0, GrandTotal 9.5.0.38, and TablePro 0.68.0.
Chore
Media and download utilities updated
Downie was bumped to 4.12.14, Ghost Downloader to 4.3.5, Melodics to 5.0.1111, and Speechify Voice AI to 3.14.0.
Chore
Networking and file-transfer tools refreshed
Cyberduck was updated to 9.5.4, NordLayer to 3.12.1, ShareFile to 26.08.06, and DBX to 0.5.94.
Chore
Miscellaneous app bumps
Other updated apps this week include mkvtoolnix (via a community PR), SoundSource test build 6.1.2, ScreenKite 1.17.1, Mirai 0.4.4, Mend 26.8.1, Reader 0.1.3111, and MPluginManager 02.29.
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 0 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
cmd/list-login-items-for-app.rb, ListLoginItemsForAppCmd#run, invoked as `brew list-login-items-for-app <path.app>`
An attacker who can influence the name of an app bundle gains arbitrary code execution on the machine of the developer who inspects it with this helper.
Fix: Do not build AppleScript by string concatenation. Escape the basename for AppleScript string literals (backslash escape quotes and backslashes) or pass the value safely, for example by writing the AppleScript to read the name from an environment variable or a here document with proper quoting, or validate the basename against a strict allowlist pattern such as /^[A-Za-z0-9 ._+-]+$/. Note Open3.capture3 without shell:true already prevents shell metacharacter injection, so only the AppleScript layer needs fixing.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required