Homebrew 6.0 makes third-party taps prove they're trustworthy before their code runs
The headline feature of Homebrew 6.0 is Tap Trust: code from third-party taps no longer runs until you explicitly trust it. The thread approved — then spent its energy on the thing the release didn't fix: you still can't tell Homebrew to wait a few days before upgrading.
Mike McQuaid's 6.0 also makes the faster internal JSON API the default, sandboxes builds on Linux, and turns on confirm-before-install. Intel Macs drop to Tier 3 in September, a year before Apple cuts them.
Two users with maxed-out credibility told opposite stories: one fled to Mise and MacPorts over forced upgrades; the other just came back from Nix because Homebrew's Mac support and UX won.
What actually shipped in 6.0
Project lead Mike McQuaid framed the release around four moves: "a new tap trust security mechanism, the new faster, smaller, default internal Homebrew JSON API, sandboxing on Linux, better defaults informed by our user survey." In plain terms: third-party taps now require explicit trust before their code executes, metadata arrives as one smaller download, Linux gets Bubblewrap sandboxing to match macOS, and "ask mode" — a dependency summary and a confirmation prompt before install and upgrade — is on by default. There's also ~30% faster brew leaves and parallel bottle fetching.
One deprecation drew blood: Intel x86_64 macOS moves to Tier 3 in September 2026 (no CI, no new bottles), with full removal a year later.
The feature people actually wanted wasn't in the box
Tap Trust guards against malicious code. It does nothing about the thread's older grievance: Homebrew decides when you upgrade. A user requesting a cooldown drew the trust boundary precisely:
"The only people I want to trust to quickly ship new code to my machine are Apple and my browser… For everything else… I prefer to err on the side of waiting a few days."
That itch has already cost Homebrew users. A commenter with maximal HN tenure had left entirely:
"I stopped using Homebrew after I got screwed too many times on mandatory upgrades that I couldn't pin. I use a combination of Mise and MacPorts now so I don't get any more surprise breakage and forced obsolescence."
Another convert had moved a whole dev environment to Mise, praising "zero version lag" and per-folder versions — the exact pinning Homebrew resists.
The counter-current: a return from Nix
The migration runs both ways, which kept the thread honest. A user who'd just switched back from Nix laid out why Homebrew won the rematch:
"Brew seems to have better support for the packages it has, compared to Nix… Better Mac support… Better UX. Obviously I miss the reproducibility of Nix environments… but on the balance, Brew has won me back."
The one unambiguous win everybody felt was speed. "That's the most pleasant brew upgrade session I've had in years," wrote a former big-tech engineer.
The Intel cliff
The deprecation timeline is where loyalty met logistics. A commenter who runs Macs as servers flagged the odd math:
"Every Mac enthusiast I know who uses a Mac as a server uses their old machines, which are pretty much all Intel. We'll lose support from you guys a year before Apple!"
The softest moment came from history. A former maintainer who helped run the project around 2014–2016 showed up to mark McQuaid's tenure: "it's been like what, 16+ years you've been maintaining Homebrew and you're still here, still shipping new features." Sixteen years in, the headline feature is about not trusting code by default — and the loudest request is still for permission to go slower.
Get breakdowns like this every day
The top Hacker News stories, unpacked — by email, Telegram, or RSS.
AI wrote 8x more code and shipped only 30% more releases. Coding was never the bottleneck
Two Princeton researchers tear into the "AI replaced our engineers" story and find mostly corporate spin: of three famous AI-blamed layoffs, the real cause was money. The deeper point is an eight-to-one ratio — far more code written, barely more software shipped.