Homebrew 6.0.0 adds a tap trust security model that forces explicit trust for third-party taps, switches to a faster, smaller internal JSON API by default, and enables sandboxing on Linux. It also refines install and upgrade prompts based on user feedback, speeds up bundle installs, boosts overall performance, and introduces initial support for macOS 27.

• Homebrew 6.0.0 requires explicit trust before running any third-party tap or tap-qualified formula's Ruby code, with Bubblewrap sandboxing now enabled by default on Linux to match macOS.
• The new internal JSON API is now default, cutting network calls during brew update and making brew leaves ~30% faster.
• Three security advisories are patched: a POST-download redirect bypass, a Git-hook code execution flaw in the macOS .pkg installer, and a /var/tmp plist trust issue.
• Install/upgrade commands now prompt for confirmation by default (ask mode) based on user survey feedback, and brew bundle installs formulas in parallel with npm/krew/winget support.