Plumbing Homebrew into the vulnerability ecosystem
15 hours ago
- brew-vulns gem initially added CVE scanning to Homebrew by querying osv.dev, later replaced by built-in brew vulns command in Homebrew 6.0.11.
- Homebrew added patches and CVE resolutions to formula JSON, registered Homebrew in package URL and OSV specifications.
- An advisory database was created with OSV-schema records for patched CVEs, with daily regeneration and git history tracking.
- The scanner was ported into Homebrew/brew, reimplementing gem dependencies like SemVer comparison and CVSS scoring.
- Coverage reaches 73% of homebrew-core via repo URLs, with plans to expand via registry URLs, Repology mappings, and CPAN.
- Future work includes integrating scan results into formula API, install warnings, and CI checks.