- `outdated_casks` treated a missing `version` as non-latest but then
reported that the latest version was already installed.
- Handle the missing version explicitly and reuse the narrowed value so
non-quiet output identifies the unavailable current platform.
- Strengthen the regression coverage for the warning path.
- Platform-specific casks can have no `version` when evaluated on an
unsupported operating system.
- Let upgrade detection skip `latest?` in that case so installation
reaches normal platform validation instead of raising `NoMethodError`.
- Cover a macOS-only cask evaluated on Linux.
Fixes#23498
- Keep `sha256` responsible only for selecting a checksum.
- Use OS and architecture `depends_on` declarations as the source of
truth for supported platforms.
- Reject missing platform checksums before any download and make
`--require-sha` reject both `nil` and `:no_check`.
Fixes#23494
Structured cask install steps run in a sandbox that denies network
access. This breaks casks whose upstream setup commands must retrieve
installation-time dependencies, including `gcloud-cli` virtualenv
creation.
- Add a serialised `network_access:` option to `run` steps.
- Omit the option from API data when it retains the default denial.
- Enable network access only when an explicit run requests it.
- Preserve network denial for existing steps and generated completions.
- Document the opt-in and cover both sandbox policies in tests.
This avoids disabling network restrictions for all cask operations while
giving affected casks an explicit, auditable escape hatch.
See #23495.
`brew upgrade` discovers outdated reverse dependants before it upgrades
the formulae selected for primary upgrade. This candidate list is also
needed for the confirmation prompt.
After the primary upgrades finish, Homebrew prepares installers for the
candidate dependants. An installer is filtered when installed runtime
dependencies already satisfy target bottle metadata. A candidate may
also already have been upgraded as a dependency of another primary
formula.
The execution heading and final summary used the earlier candidate list.
They therefore claimed a filtered dependant was upgraded although its
installed version remained unchanged. Candidates removed because
`FormulaInstaller.installed` contained them were also treated as
unsuccessful even when dependency installation had upgraded them.
- Build dependant installers before printing the execution-time list.
- Preserve installed candidates unless the primary list represents them.
- Merge those candidates with dependants upgraded by their installers.
- State the exact bottle-metadata condition when filtering a candidate.
- Cover filtered, dependency-installed and primary candidates in tests.
Fixes#23483
Replace string-interpolated pkg:brew purls with Homebrew::Vulns::Purl so
formula names are percent-encoded per purl-spec (python@3.12 becomes
python%403.12, matching what vulns/osv_export already emits). Also fixes
pkg:brew//name output when the tap is nil and drops the @ segment when
there is no version.
-----
<!-- Only tick a checkbox once you've done it; honesty keeps reviews smooth. -->
<!-- Tick with [x] before creating, or click the boxes afterwards. -->
<!-- Don't delete these checkboxes or this pull request is closed automatically. -->
- [x] Have you followed our [Contributing](https://github.com/Homebrew/brew/blob/HEAD/CONTRIBUTING.md) guidelines?
- [x] Have you checked for other open [Pull Requests](https://github.com/Homebrew/brew/pulls) for the same change?
- [x] Have you explained what your changes do? Performance claims (e.g. "this is faster") must include [Hyperfine](https://github.com/sharkdp/hyperfine) benchmarks.
- [x] Have you explained why you'd like these changes included, not just what they do?
- [ ] For bug fixes, have you given step-by-step `brew` commands to reproduce the bug?
- [ ] Have you written new tests (excluding integration tests)? [Here's an example](https://github.com/Homebrew/brew/blob/HEAD/Library/Homebrew/test/PATH_spec.rb).
- [x] Have you successfully run `brew lgtm` (style, typechecking and tests) locally?
-----
- [ ] AI was used to generate or assist with generating this PR.
<!-- If ticked, explain below how AI was used and how you verified the changes. Non-maintainers may only have one AI-assisted PR open at a time. See https://docs.brew.sh/Responsible-AI-Usage for guidance. -->
-----
License tag for OCI image limit 256 chars by documentation but it is actually failed with 256 chars. I have tested my own private repo for this and 255 is fine to use.
`mesa` is failed because of this,
- https://github.com/Homebrew/homebrew-core/pull/294670
When connected via SSH, `launchctl list <label>` only searches the
system domain, so it won't find services loaded in the `gui/<uid>`
domain. This caused `Utils::Service.running?` to incorrectly return
false for running services, which in turn made `brew upgrade` print
"brew services start" instead of the correct "brew services restart".
Consolidate the "is this service running?" logic into a single source
of truth: `Homebrew::Services::System.launchctl_service_running?`.
This iterates `candidate_domain_targets` to try domain-qualified
`launchctl print <domain>/<label>` before falling back to a bare
`launchctl list <label>`. Both `Utils::Service.running?` and
`FormulaWrapper#loaded?` now use this method.
Refactor `FormulaWrapper#status_output_success_type` to also iterate
`candidate_domain_targets` instead of only trying the single
`domain_target`, which over SSH returns `user/<euid>` and misses
services loaded in the `gui/<uid>` domain.
- reject mixing formula install hooks in every tap
- autocorrect legacy step methods and keywords
- retain stable serialised API values for compatibility
- document canonical Formula and Cask step authoring
- remove the resolved Cask sandbox deprecation reminder
- Discover CPython wheels already packaged in each keg.
- Expand PyPy bootstrap archives packaged in `libexec`.
- Resolve dependency paths without loading formula source.
- Validate helper executables before attempting to run them.
- Enforce source independence with RuboCop and API-loaded tests.
- Keep the internal JSON API unchanged and minimal.
- Ignore intentional bootstrap constant reassignments, RBI declarations
and OS-specific method overrides.
- Allow valid names unavailable to the project-only index.
- Retain absolute core constants where inherited lookup can make the
indexed autocorrection unsafe.
