Homebrew 6.0.0 drops its old JSON feed in favor of a smaller, faster internal API that bundles all metadata into one download. The update switches on this API by default, removes the HOMEBREW_USE_INTERNAL_API flag and cuts network chatter during brew update. You’ll also see around 30% faster brew leaves and parallel bottle-tab fetching, plus tweaks that trim Ruby library load times at startup. Security gets tighter with a new “tap trust” system. Any third-party tap or tap-qualified formula must now be explicitly marked trusted before its Ruby code runs. Official Homebrew taps stay trusted out of the box, but random Git remotes won’t run until you approve them. Commands like brew tap-info and brew trust gain JSON flags and trust-list management. On Linux, Bubblewrap sandboxing matches macOS: build, test and postinstall hooks run inside a sandbox by default for both platforms. Brew bundle now installs multiple formulas in parallel, supports npm, krew and winget extensions, and cleans up more safely across npm, cargo and go. On Windows, it taps into winget. The installer adds confirmation prompts to brew install and brew upgrade based on the user survey—ask mode is now the default for developers. Homebrew also lays groundwork for macOS 27 (Golden Gate), which drops Intel support in September 2026, and warns about deprecated Gatekeeper-failing casks slated for disablement next year. Three security advisories arrived alongside the release: fixes for POST-download redirect bypasses, a Git-hook code execution flaw in the macOS .pkg installer and a /var/tmp plist trust issue that could hand ownership to attackers. Homebrew now filters sensitive environment variables during Ruby runs, forces checksum checks on casks (HOMEBREW_CASK_OPTS_REQUIRE_SHA) and publishes a shared security policy. Deprecations include older Linux glibc targets, default-off environment flags and leftover master branches in taps.