Update bin/brew

Support Tahoe, drop Mojave and older

.devcontainer/devcontainer.json

@@ -1,25 +1,11 @@
 // For format details, see https://aka.ms/devcontainer.json.
 {
   "name": "Homebrew/brew",
-  "image": "ghcr.io/homebrew/brew:master",
+  "image": "ghcr.io/homebrew/brew:main",
   "workspaceFolder": "/home/linuxbrew/.linuxbrew/Homebrew",
   "workspaceMount": "source=${localWorkspaceFolder},target=/home/linuxbrew/.linuxbrew/Homebrew,type=bind,consistency=cached",
   "onCreateCommand": ".devcontainer/on-create-command.sh",
   "customizations": {
-    "codespaces": {
-      "repositories": {
-        "Homebrew/homebrew-bundle": {
-          "permissions": {
-            "contents": "write"
-          }
-        },
-        "Homebrew/homebrew-services": {
-          "permissions": {
-            "contents": "write"
-          }
-        }
-      }
-    },
     "vscode": {
       // Installing all necessary extensions for vscode
       // Taken from: .vscode/extensions.json

.devcontainer/on-create-command.sh

@@ -3,6 +3,7 @@ set -e
 
 # fix permissions so Homebrew and Bundler don't complain
 sudo chmod -R g-w,o-w /home/linuxbrew
+sudo chmod +t -R /home/linuxbrew/
 
 # everything below is too slow to do unless prebuilding so skip it
 CODESPACES_ACTION_NAME="$(jq --raw-output '.ACTION_NAME' /workspaces/.codespaces/shared/environment-variables.json)"
@@ -23,9 +24,6 @@ brew cleanup
 
 # actually tap homebrew/core, no longer done by default
 brew tap --force homebrew/core
-# tap some other repos so codespaces can be used for developing multiple taps
-brew tap homebrew/bundle
-brew tap homebrew/services
 
 # install some useful development things
 sudo apt-get update

.github/ISSUE_TEMPLATE/bug.yml

@@ -1,10 +1,10 @@
 name: New issue for Reproducible Bug
 description: "If you're sure it's reproducible and not just your machine: submit an issue so we can investigate."
-labels: [bug]
+type: "Bug"
 body:
   - type: markdown
     attributes:
-      value: Please note we will close your issue without comment if you do not correctly fill out the issue checklist below and provide ALL the requested information. If you repeatedly fail to use the issue template, we will block you from ever submitting issues to Homebrew again.
+      value: Please note we may close your issue without comment if you do not fill out the issue checklist below and provide ALL the requested information (even if you consider them irrelevant). If you are unwilling to use the issue template, we may block you from ever submitting future issues to Homebrew.
   - type: textarea
     attributes:
       render: shell
@@ -16,10 +16,10 @@ body:
       label: Verification
       description: Please verify that you've followed these steps. If you cannot truthfully check these boxes, open a discussion at https://github.com/orgs/Homebrew/discussions instead.
       options:
-        - label: My "`brew doctor` output" above says `Your system is ready to brew.` and am still able to reproduce my issue.
-          required: true
         - label: I ran `brew update` twice and am still able to reproduce my issue.
           required: true
+        - label: My "`brew doctor` output" above says `Your system is ready to brew` or a definitely unrelated `Tier` message.
+          required: true
         - label: This issue's title and/or description do not reference a single formula e.g. `brew install wget`. If they do, open an issue at https://github.com/Homebrew/homebrew-core/issues/new/choose instead.
           required: true
   - type: textarea

.github/ISSUE_TEMPLATE/feature.yml

@@ -1,6 +1,6 @@
 name: New issue for Feature Suggestion
 description: Request our thoughts on your suggestion for a new feature for Homebrew.
-labels: features
+type: "Feature"
 body:
   - type: markdown
     attributes:

.github/codeql/extensions/homebrew-actions.yml

@@ -0,0 +1,7 @@
+# This file is synced from the `.github` repository, do not modify it directly.
+extensions:
+  - addsTo:
+      pack: codeql/actions-all
+      extensible: trustedActionsOwnerDataModel
+    data:
+      - ["Homebrew"]

.github/copilot-instructions.md

@@ -0,0 +1,48 @@
+# Copilot Instructions for Homebrew/brew
+
+This is a Ruby based repository with Bash scripts for faster execution.
+It is primarily responsible for providing the `brew` command for the Homebrew package manager.
+Please follow these guidelines when contributing:
+
+## Code Standards
+
+### Required Before Each Commit
+
+- Run `brew typecheck` to verify types are declared correctly using Sorbet.
+  Individual files/directories cannot be checked.
+  `brew typecheck` is fast enough to just be run globally every time.
+- Run `brew style --fix --changed` to lint code formatting using RuboCop.
+  Individual files can be checked/fixed by passing them as arguments e.g. `brew style --fix Library/Homebrew/cmd/reinstall.rb``
+- Run `brew tests --online  --changed` to ensure that RSpec unit tests are passing (although some online tests may be flaky so can be ignored if they pass on a rerun).
+  Individual test files can be passed with `--only` e.g. to test `Library/Homebrew/cmd/reinstall.rb` with `Library/Homebrew/test/cmd/reinstall_spec.rb` run `brew tests --only=cmd/reinstall`.
+- All of the above can be run with the `brew-mcp-server`
+
+### Development Flow
+
+- Write new code (using Sorbet `sig` type signatures and `typed: strict` for new files, but never for RSpec/test/`*_spec.rb` files)
+- Write new tests (avoid more than one `:integration_test` per file for speed).
+  Use only one `expect` assertion per test.
+- Keep comments minimal; prefer self-documenting code through strings, variable names, etc. over more comments.
+
+## Repository Structure
+
+- `bin/brew`: Homebrew's `brew` command main Bash entry point script
+- `completions/`: Generated shell (`bash`/`fish`/`zsh`) completion files. Don't edit directly, regenerate with `brew generate-man-completions`
+- `Library/Homebrew/`: Homebrew's core Ruby (with a little bash) logic.
+- `Library/Homebrew/bundle/`: Homebrew's `brew bundle` command.
+- `Library/Homebrew/cask/`: Homebrew's Cask classes and DSL.
+- `Library/Homebrew/extend/os/`: Homebrew's OS-specific (i.e. macOS or Linux) class extension logic.
+- `Library/Homebrew/formula.rb`: Homebrew's Formula class and DSL.
+- `docs/`: Documentation for Homebrew users, contributors and maintainers. Consult these for best practices and help.
+- `manpages/`: Generated `man` documentation files. Don't edit directly, regenerate with `brew generate-man-completions`
+- `package/`: Files to generate the macOS `.pkg` file.
+
+## Key Guidelines
+
+1. Follow Ruby and Bash best practices and idiomatic patterns.
+2. Maintain existing code structure and organisation.
+3. Write unit tests for new functionality.
+4. Document public APIs and complex logic.
+5. Suggest changes to the `docs/` folder when appropriate
+6. Follow software principles such as DRY and YAGNI.
+7. Keep diffs as minimal as possible.

.github/dependabot.yml

@@ -1,55 +1,49 @@
+# This file is synced from the `.github` repository, do not modify it directly.
+---
 version: 2
-
-updates:
-  - package-ecosystem: github-actions
-    directory: /
+multi-ecosystem-groups:
+  all:
     schedule:
       interval: weekly
-    allow:
-      - dependency-type: all
-    # The actions in triage-issues.yml are updated in the Homebrew/.github repo
-    ignore:
-      - dependency-name: actions/stale
-    groups:
-      artifacts:
-        patterns:
-          - actions/*-artifact
+      day: friday
+      time: '08:00'
+      timezone: Etc/UTC
+updates:
+- package-ecosystem: bundler
+  directories:
+  - "/Library/Homebrew"
+  multi-ecosystem-group: all
+  patterns:
+  - "*"
+  allow:
+  - dependency-type: all
+- package-ecosystem: devcontainers
+  directory: "/"
+  multi-ecosystem-group: all
+  patterns:
+  - "*"
+  allow:
+  - dependency-type: all
+- package-ecosystem: docker
+  directory: "/"
+  multi-ecosystem-group: all
+  patterns:
+  - "*"
+  allow:
+  - dependency-type: all
+- package-ecosystem: github-actions
+  directory: "/"
+  multi-ecosystem-group: all
+  patterns:
+  - "*"
+  allow:
+  - dependency-type: all
+- package-ecosystem: pip
+  directories:
+  - "/Library/Homebrew/formula-analytics/"
+  multi-ecosystem-group: all
+  patterns:
+  - "*"
+  allow:
+  - dependency-type: all
 
-  - package-ecosystem: bundler
-    directory: /Library/Homebrew
-    schedule:
-      interval: daily
-    allow:
-      - dependency-type: all
-    groups:
-      sorbet:
-        patterns:
-          - "sorbet*"
-
-  - package-ecosystem: npm
-    directory: /
-    schedule:
-      interval: daily
-    allow:
-      - dependency-type: all
-
-  - package-ecosystem: docker
-    directory: /
-    schedule:
-      interval: daily
-    allow:
-      - dependency-type: all
-
-  - package-ecosystem: devcontainers
-    directory: /
-    schedule:
-      interval: daily
-    allow:
-      - dependency-type: all
-
-  - package-ecosystem: pip
-    directory: /
-    schedule:
-      interval: daily
-    allow:
-      - dependency-type: all

.github/workflows/actionlint.yml

@@ -1,19 +1,12 @@
-name: actionlint
+# This file is synced from the `.github` repository, do not modify it directly.
+name: Actionlint
 
 on:
   push:
-    paths:
-      - '.github/workflows/*.ya?ml'
-      - '.github/actionlint.yaml'
+    branches:
+      - main
+      - master
   pull_request:
-    paths:
-      - '.github/workflows/*.ya?ml'
-      - '.github/actionlint.yaml'
-
-env:
-  HOMEBREW_DEVELOPER: 1
-  HOMEBREW_NO_AUTO_UPDATE: 1
-  HOMEBREW_NO_ENV_HINTS: 1
 
 defaults:
   run:
@@ -23,16 +16,25 @@ concurrency:
   group: "actionlint-${{ github.ref }}"
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
+env:
+  HOMEBREW_DEVELOPER: 1
+  HOMEBREW_NO_AUTO_UPDATE: 1
+  HOMEBREW_NO_ENV_HINTS: 1
+
 permissions: {}
 
 jobs:
   workflow_syntax:
     if: github.repository_owner == 'Homebrew'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    container:
+      image: ghcr.io/homebrew/ubuntu22.04:main
     steps:
       - name: Set up Homebrew
         id: setup-homebrew
-        uses: Homebrew/actions/setup-homebrew@master
+        uses: Homebrew/actions/setup-homebrew@main
         with:
           core: false
           cask: false
@@ -41,44 +43,57 @@ jobs:
       - name: Install tools
         run: brew install actionlint shellcheck zizmor
 
-      - name: Set up GITHUB_WORKSPACE
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
+
+      - run: zizmor --format sarif . > results.sarif
         env:
-          HOMEBREW_REPOSITORY: ${{ steps.setup-homebrew.outputs.repository-path }}
-        run: |
-          # Annotations work only relative to GITHUB_WORKSPACE
-          (shopt -s dotglob; rm -rf "${GITHUB_WORKSPACE:?}"/*; mv "${HOMEBREW_REPOSITORY:?}"/* "$GITHUB_WORKSPACE")
-          rmdir "$HOMEBREW_REPOSITORY"
-          ln -vs "$GITHUB_WORKSPACE" "$HOMEBREW_REPOSITORY"
-
-          echo "::add-matcher::.github/actionlint-matcher.json"
-
-      - run: |
-          # NOTE: exit code intentionally suppressed here
-          zizmor --format sarif . > results.sarif || true
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Upload SARIF file
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        # We can't use the SARIF file when triggered by `merge_group` so we don't upload it.
+        if: always() && github.event_name != 'merge_group'
         with:
           name: results.sarif
           path: results.sarif
 
+      - name: Set up actionlint
+        run: |
+          # In homebrew-core, setting `shell: /bin/bash` prevents shellcheck from running on
+          # those steps, so let's change them to `shell: bash` temporarily for better linting.
+          sed -i 's|shell: /bin/bash -x|shell: bash -x|' .github/workflows/*.y*ml
+
+          # In homebrew-core, the JSON matcher needs to be accessible to the container host.
+          cp "$(brew --repository)/.github/actionlint-matcher.json" "$HOME"
+
+          echo "::add-matcher::$HOME/actionlint-matcher.json"
+
       - run: actionlint
 
   upload_sarif:
     needs: workflow_syntax
+    # We want to always upload this even if `actionlint` failed.
+    # This is only available on public repositories.
+    if: >
+      always() &&
+      !contains(fromJSON('["cancelled", "skipped"]'), needs.workflow_syntax.result) &&
+      !github.event.repository.private &&
+      github.event_name != 'merge_group'
     runs-on: ubuntu-latest
     permissions:
       contents: read
       security-events: write
     steps:
       - name: Download SARIF file
-        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
         with:
           name: results.sarif
           path: results.sarif
 
       - name: Upload SARIF file
-        uses: github/codeql-action/upload-sarif@f6091c0113d1dcf9b98e269ee48e8a7e51b7bdd4 # v3.28.5
+        uses: github/codeql-action/upload-sarif@192325c86100d080feab897ff886c34abd4c83a3 # v3.30.3
         with:
           sarif_file: results.sarif
           category: zizmor

.github/workflows/autogenerated-files.yml

@@ -27,14 +27,14 @@ jobs:
     steps:
       - name: Set up Homebrew
         id: set-up-homebrew
-        uses: Homebrew/actions/setup-homebrew@master
+        uses: Homebrew/actions/setup-homebrew@main
         with:
           core: false
           cask: false
           test-bot: true
 
       - name: Cache Bundler RubyGems
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
         with:
           path: ${{ steps.set-up-homebrew.outputs.gems-path }}
           key: ${{ runner.os }}-rubygems-${{ steps.set-up-homebrew.outputs.gems-hash }}

.github/workflows/codeql-analysis.yml

@@ -3,10 +3,9 @@ name: "CodeQL"
 on:
   push:
     branches:
+      - main
       - master
   pull_request:
-    branches:
-      - master
 
 defaults:
   run:
@@ -23,12 +22,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@f6091c0113d1dcf9b98e269ee48e8a7e51b7bdd4 # v3.28.5
+        uses: github/codeql-action/init@192325c86100d080feab897ff886c34abd4c83a3 # v3.30.3
         with:
           languages: ruby
           config: |
@@ -36,4 +35,4 @@ jobs:
               - Library/Homebrew/vendor
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@f6091c0113d1dcf9b98e269ee48e8a7e51b7bdd4 # v3.28.5
+        uses: github/codeql-action/analyze@192325c86100d080feab897ff886c34abd4c83a3 # v3.30.3

.github/workflows/copilot-setup-steps.yml

@@ -0,0 +1,32 @@
+name: Copilot Setup Steps
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - .github/workflows/copilot-setup-steps.yml
+
+jobs:
+  # The job MUST be called `copilot-setup-steps` or it will not be picked up by Copilot.
+  copilot-setup-steps:
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
+    steps:
+      - name: Set up Homebrew
+        id: set-up-homebrew
+        uses: Homebrew/actions/setup-homebrew@main
+        with:
+          core: true
+          cask: true
+          test-bot: true
+
+      - run: brew install-bundler-gems --groups=all
+
+      # install Homebrew formulae we might need
+      - run: brew install shellcheck shfmt gh gnu-tar subversion curl
+
+      # brew tests doesn't like world writable directories
+      - run: sudo chmod -R g-w,o-w /home/linuxbrew/.linuxbrew/Homebrew

.github/workflows/docker.yml

@@ -2,6 +2,10 @@ name: Docker
 
 on:
   pull_request:
+  push:
+    branches:
+      - main
+      - master
   merge_group:
   release:
     types:
@@ -14,29 +18,29 @@ defaults:
   run:
     shell: bash -xeuo pipefail {0}
 
+env:
+  # odeprecated: remove 20.04 image in Homebrew >=4.7
+  VERSIONS: '["20.04", "22.04", "24.04"]'
+
 jobs:
-  ubuntu:
+  generate-tags:
     if: github.repository_owner == 'Homebrew'
-    name: docker (Ubuntu ${{ matrix.version }})
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        version: ["18.04", "20.04", "22.04", "24.04"]
+    outputs:
+      matrix: ${{ steps.attributes.outputs.matrix }}
+      tags: ${{ steps.attributes.outputs.tags }}
+      labels: ${{ steps.attributes.outputs.labels }}
+      push: ${{ steps.attributes.outputs.push }}
+      merge: ${{ steps.attributes.outputs.merge }}
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
 
-      - name: Fetch origin/master from Git
-        run: git fetch origin master
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3.8.0
-        with:
-          cache-binary: false
+      - name: Fetch origin/HEAD from Git
+        run: git fetch origin HEAD
 
       - name: Determine build attributes
         id: attributes
@@ -58,92 +62,263 @@ jobs:
           ${DELIMITER}
           EOS
 
-          tags=()
-          if [[ "${GITHUB_EVENT_NAME}" == "release" ]]; then
-            tags+=(
-              "ghcr.io/homebrew/ubuntu${{matrix.version}}:${brew_version}"
-              "ghcr.io/homebrew/ubuntu${{matrix.version}}:latest"
-              "homebrew/ubuntu${{matrix.version}}:${brew_version}"
-              "homebrew/ubuntu${{matrix.version}}:latest"
-            )
-            if [[ "${{ matrix.version }}" == "22.04" ]]; then
+          typeset -A tag_hash
+          typeset -A push_hash
+          matrix=()
+          merge=false
+          while IFS=$'\n' read -r version; do
+            tags=()
+            if [[ "${GITHUB_EVENT_NAME}" == "release" ]]; then
               tags+=(
-                "ghcr.io/homebrew/brew:${brew_version}"
-                "ghcr.io/homebrew/brew:latest"
-                "homebrew/brew:${brew_version}"
-                "homebrew/brew:latest"
+                "ghcr.io/homebrew/ubuntu${version}:${brew_version}"
+                "ghcr.io/homebrew/ubuntu${version}:latest"
+                "homebrew/ubuntu${version}:${brew_version}"
+                "homebrew/ubuntu${version}:latest"
+              )
+              if [[ "${version}" == "22.04" ]]; then
+                tags+=(
+                  "ghcr.io/homebrew/brew:${brew_version}"
+                  "ghcr.io/homebrew/brew:latest"
+                  "homebrew/brew:${brew_version}"
+                  "homebrew/brew:latest"
+                )
+              fi
+            elif [[ "${GITHUB_EVENT_NAME}" == "push" &&
+                    ("${GITHUB_REF}" == "refs/heads/master" || "${GITHUB_REF}" == "refs/heads/main") &&
+                    "${version}" == "22.04" ]]; then
+              tags+=(
+                "ghcr.io/homebrew/brew:main"
+                "ghcr.io/homebrew/brew:master"
+                "ghcr.io/homebrew/ubuntu${version}:main"
+                "ghcr.io/homebrew/ubuntu${version}:master"
+                "homebrew/brew:main"
+                "homebrew/brew:master"
+                "homebrew/ubuntu${version}:main"
+                "homebrew/ubuntu${version}:master"
               )
             fi
-          elif [[ "${GITHUB_EVENT_NAME}" == "merge_group" &&
-                  "${GITHUB_REF}" == "refs/heads/master" &&
-                  "${{ matrix.version }}" == "22.04" ]]; then
-            tags+=(
-              "ghcr.io/homebrew/brew:master"
-              "ghcr.io/homebrew/ubuntu${{ matrix.version }}:master"
-              "homebrew/brew:master"
-              "homebrew/ubuntu${{matrix.version}}:master"
-            )
-          fi
-          if [[ "${{ matrix.version }}" == "18.04" ]]; then
-            # odeprecated: remove this in Homebrew >=4.4
-            echo "The homebrew/ubuntu18.04 image is deprecated and will soon be retired. Use homebrew/ubuntu22.04 or homebrew/ubuntu24.04 or homebrew/ubuntu20.04 or homebrew/brew." > .docker-deprecate
-          fi
+
+            if [[ "${#tags[@]}" -ne 0 ]]; then
+              tags_as_json_array="$(
+                jq --null-input --compact-output '$ARGS.positional' --args "${tags[@]}"
+              )"
+              tag_hash["${version}"]="${tags_as_json_array}"
+              push_hash["${version}"]=true
+              merge=true
+              matrix+=("${version}")
+            else
+              push_hash["${version}"]=false
+            fi
+          done <<<"$(jq --raw-output '.[]' <<<"${VERSIONS}")"
+
+          # Transform the `matrix` variable into a JSON array.
+          echo "matrix=$(jq --null-input --compact-output '$ARGS.positional' --args "${matrix[@]}")" >>"${GITHUB_OUTPUT}"
+          echo "merge=${merge}" >>"${GITHUB_OUTPUT}"
 
           {
-            if [[ "${#tags[@]}" -ne 0 ]]; then
-              DELIMITER="END_TAGS_$(uuidgen)"
-              echo "tags<<${DELIMITER}"
-              printf "%s\n" "${tags[@]}"
-              echo "${DELIMITER}"
-              echo "push=true"
-            else
-              echo "push=false"
-            fi
+            DELIMITER="END_TAGS_$(uuidgen)"
+            has_previous=
+            echo "tags<<${DELIMITER}"
+            printf '{'
+            for version in "${!tag_hash[@]}"; do
+              [[ -n "${has_previous:-}" ]] && printf ','
+              printf '"%s": %s' "${version}" "${tag_hash[$version]}"
+              has_previous=1
+            done
+            echo '}'
+            echo "${DELIMITER}"
           } | tee -a "${GITHUB_OUTPUT}"
 
+          {
+            DELIMITER="END_PUSH_$(uuidgen)"
+            has_previous=
+            echo "push<<${DELIMITER}"
+            printf '{'
+            for version in "${!push_hash[@]}"; do
+              [[ -n "${has_previous:-}" ]] && printf ','
+              printf '"%s": %s' "${version}" "${push_hash[$version]}"
+              has_previous=1
+            done
+            echo '}'
+            echo "${DELIMITER}"
+          } | tee -a "${GITHUB_OUTPUT}"
+
+  build:
+    needs: generate-tags
+    if: github.repository_owner == 'Homebrew'
+    name: docker (${{ matrix.arch }} Ubuntu ${{ matrix.version }})
+    runs-on: ${{ matrix.arch == 'arm64' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        # odeprecated: remove 20.04 image in Homebrew >=4.7
+        version: ["20.04", "22.04", "24.04"]
+        arch: ["x86_64", "arm64"]
+        exclude:
+          # odeprecated: remove 20.04 image in Homebrew >=4.7
+          - version: "20.04"
+            arch: "arm64"
+    steps:
+      - name: Checkout
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Fetch origin/HEAD from Git
+        run: git fetch origin HEAD
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+        with:
+          cache-binary: false
+
+      - name: Retrieve build attributes
+        id: attributes
+        env:
+          VERSION: ${{ matrix.version }}
+          PUSH: ${{ needs.generate-tags.outputs.push }}
+        run: |
+          # odeprecated: remove 20.04 image in Homebrew >=4.7
+          if [[ "${VERSION}" == "20.04" ]]; then
+            echo "The homebrew/ubuntu20.04 image is deprecated and will soon be retired. Use homebrew/ubuntu24.04 or homebrew/brew." > .docker-deprecate
+          fi
+
+          filter="$(printf '.["%s"]' "${VERSION}")"
+          echo "push=$(jq --raw-output "${filter}" <<<"${PUSH}")" >>"${GITHUB_OUTPUT}"
+
       - name: Log in to GitHub Packages (github-actions[bot])
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
         with:
           registry: ghcr.io
           username: github-actions[bot]
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build Docker image
-        uses: docker/build-push-action@ca877d9245402d1537745e0e356eab47c3520991 # v6.13.0
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: .
           load: true
           tags: brew
           cache-from: type=registry,ref=ghcr.io/homebrew/ubuntu${{ matrix.version }}:cache
           build-args: version=${{ matrix.version }}
-          labels: ${{ steps.attributes.outputs.labels }}
+          labels: ${{ needs.generate-tags.outputs.labels }}
+
+      - name: Set environment variables
+        run: |
+          if [[ "${ARCH}" == "arm64" ]]; then
+            echo "HOMEBREW_ARM64_TESTING=1" >> "$GITHUB_ENV"
+          fi
+
+          # odeprecated: remove 20.04 in Homebrew >=4.7
+          if [[ "${VERSION}" == "20.04" ]]; then
+            echo "HOMEBREW_GLIBC_TESTING=1" >> "$GITHUB_ENV"
+          fi
+        env:
+          VERSION: ${{ matrix.version }}
+          ARCH: ${{ matrix.arch }}
 
       - name: Run brew test-bot --only-setup
-        run: docker run --rm brew brew test-bot --only-setup
+        run: docker run --env HOMEBREW_ARM64_TESTING --env HOMEBREW_GLIBC_TESTING --rm brew brew test-bot --only-setup
 
       - name: Log in to GitHub Packages (BrewTestBot)
-        if: steps.attributes.outputs.push == 'true'
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        if: fromJSON(steps.attributes.outputs.push)
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
         with:
           registry: ghcr.io
           username: BrewTestBot
           password: ${{ secrets.HOMEBREW_BREW_GITHUB_PACKAGES_TOKEN }}
 
+      - name: Deploy the Docker image by digest
+        id: digest
+        if: fromJSON(steps.attributes.outputs.push)
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        with:
+          context: .
+          cache-from: type=registry,ref=ghcr.io/homebrew/ubuntu${{ matrix.version }}:cache
+          cache-to: type=registry,ref=ghcr.io/homebrew/ubuntu${{ matrix.version }}:cache,mode=max
+          build-args: version=${{ matrix.version }}
+          labels: ${{ needs.generate-tags.outputs.labels }}
+          outputs: type=image,name=ghcr.io/homebrew/ubuntu${{ matrix.version }},name-canonical=true,push=true,push-by-digest=true
+
+      - name: Export the Docker image digest
+        if: fromJSON(steps.attributes.outputs.push)
+        run: |
+          mkdir -p "${RUNNER_TEMP}"/digests
+          echo "${DIGEST#sha256:}" >"${RUNNER_TEMP}/digests/${VERSION}-${ARCH}"
+        env:
+          DIGEST: ${{ steps.digest.outputs.digest }}
+          VERSION: ${{ matrix.version }}
+          ARCH: ${{ matrix.arch }}
+
+      - name: Upload the Docker image digest
+        if: fromJSON(steps.attributes.outputs.push)
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: digest-${{ matrix.version }}-${{ matrix.arch }}
+          path: ${{ runner.temp }}/digests/*
+
+  merge:
+    needs: [generate-tags, build]
+    if: github.repository_owner == 'Homebrew' && fromJSON(needs.generate-tags.outputs.merge)
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        version: ${{ fromJSON(needs.generate-tags.outputs.matrix) }}
+    steps:
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+        with:
+          cache-binary: false
+
+      - name: Download Docker image digests
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        with:
+          path: ${{ runner.temp }}/digests
+          pattern: digest-${{ matrix.version }}-*
+          merge-multiple: true
+
       - name: Log in to Docker Hub
-        if: steps.attributes.outputs.push == 'true'
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
         with:
           username: brewtestbot
           password: ${{ secrets.HOMEBREW_BREW_DOCKER_TOKEN }}
 
-      - name: Deploy the tagged Docker image
-        if: steps.attributes.outputs.push == 'true'
-        uses: docker/build-push-action@ca877d9245402d1537745e0e356eab47c3520991 # v6.13.0
+      - name: Log in to GitHub Packages (BrewTestBot)
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
         with:
-          context: .
-          push: true
-          tags: ${{ steps.attributes.outputs.tags }}
-          cache-from: type=registry,ref=ghcr.io/homebrew/ubuntu${{ matrix.version }}:cache
-          cache-to: type=registry,ref=ghcr.io/homebrew/ubuntu${{ matrix.version }}:cache,mode=max
-          build-args: version=${{ matrix.version }}
-          labels: ${{ steps.attributes.outputs.labels }}
+          registry: ghcr.io
+          username: BrewTestBot
+          password: ${{ secrets.HOMEBREW_BREW_GITHUB_PACKAGES_TOKEN }}
+
+      - name: Merge and push Docker image
+        env:
+          TAGS: ${{ needs.generate-tags.outputs.tags }}
+          VERSION: ${{ matrix.version }}
+        run: |
+          filter="$(printf '.["%s"].[]' "${VERSION}")"
+          tag_args=()
+          while IFS=$'\n' read -r tag; do
+            [[ -n "${tag}" ]] || continue
+            tag_args+=("--tag=${tag}")
+          done <<<"$(jq --raw-output "${filter}" <<<"${TAGS}")"
+
+          image_args=("ghcr.io/homebrew/ubuntu${VERSION}@sha256:$(<"${RUNNER_TEMP}/digests/${VERSION}-x86_64")")
+          # odeprecated: remove 20.04 image in Homebrew >=4.7
+          if [[ "${VERSION}" != 20.04 ]]; then
+            image_args+=("ghcr.io/homebrew/ubuntu${VERSION}@sha256:$(<"${RUNNER_TEMP}/digests/${VERSION}-arm64")")
+          fi
+
+          attempts=0
+          until docker buildx imagetools create "${tag_args[@]}" "${image_args[@]}"; do
+            attempts=$((attempts + 1))
+            if [[ $attempts -ge 3 ]]; then
+              echo "[$(date -u)] ERROR: Failed after 3 attempts." >&2
+              exit 1
+            fi
+            delay=$((2 ** attempts))
+            if [[ $delay -gt 15 ]]; then delay=15; fi
+            echo "Push failed (attempt $attempts). Retrying in ${delay} seconds..."
+            sleep ${delay}
+          done

.github/workflows/docs.yml

@@ -12,7 +12,6 @@ env:
   HOMEBREW_DEVELOPER: 1
   HOMEBREW_NO_AUTO_UPDATE: 1
   HOMEBREW_NO_ENV_HINTS: 1
-  HOMEBREW_BOOTSNAP: 1
   HOMEBREW_NO_INSTALL_CLEANUP: 1
 
 defaults:
@@ -25,14 +24,14 @@ jobs:
     steps:
       - name: Set up Homebrew
         id: set-up-homebrew
-        uses: Homebrew/actions/setup-homebrew@master
+        uses: Homebrew/actions/setup-homebrew@main
         with:
           core: false
           cask: false
           test-bot: false
 
       - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
 
@@ -53,7 +52,7 @@ jobs:
         run: vale docs/
 
       - name: Install Ruby
-        uses: ruby/setup-ruby@1287d2b408066abada82d5ad1c63652e758428d9 # v1.214.0
+        uses: ruby/setup-ruby@44511735964dcb71245e7e55f72539531f7bc0eb # v1.257.0
         with:
           bundler-cache: true
           working-directory: docs
@@ -68,7 +67,13 @@ jobs:
       - name: Generate formulae.brew.sh API samples
         if: github.repository == 'Homebrew/formulae.brew.sh'
         working-directory: docs
-        run: ../script/generate-api-samples.rb
+        run: ../script/generate-api-samples.rb --template
+
+      - name: Cache HTML Proofer
+        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        with:
+          path: tmp/.htmlproofer
+          key: ${{ runner.os }}-htmlproofer
 
       - name: Build the site and check for broken links
         working-directory: docs

.github/workflows/doctor.yml

@@ -28,7 +28,7 @@ jobs:
     steps:
       - name: Set up Homebrew
         id: set-up-homebrew
-        uses: Homebrew/actions/setup-homebrew@master
+        uses: Homebrew/actions/setup-homebrew@main
         with:
           core: false
           cask: false
@@ -55,7 +55,7 @@ jobs:
     steps:
       - name: Set up Homebrew
         id: set-up-homebrew
-        uses: Homebrew/actions/setup-homebrew@master
+        uses: Homebrew/actions/setup-homebrew@main
         with:
           core: false
           cask: false

.github/workflows/pkg-installer.yml

@@ -16,6 +16,8 @@ env:
   HOMEBREW_NO_ANALYTICS_THIS_RUN: 1
   HOMEBREW_NO_ANALYTICS_MESSAGE_OUTPUT: 1
 
+permissions: {}
+
 defaults:
   run:
     shell: bash -xeuo pipefail {0}
@@ -30,7 +32,7 @@ jobs:
       TEMPORARY_CERTIFICATE_FILE: 'homebrew_developer_id_installer_certificate.p12'
       TEMPORARY_KEYCHAIN_FILE: 'homebrew_installer_signing.keychain-db'
       # Set to the oldest supported version of macOS
-      HOMEBREW_MACOS_OLDEST_SUPPORTED: '13.0'
+      HOMEBREW_MACOS_OLDEST_SUPPORTED: '14.0'
     permissions:
       contents: read # for code access
       attestations: write # for actions/attest-build-provenance
@@ -41,7 +43,7 @@ jobs:
 
       - name: Set up Homebrew
         id: set-up-homebrew
-        uses: Homebrew/actions/setup-homebrew@master
+        uses: Homebrew/actions/setup-homebrew@main
         with:
           core: false
           cask: false
@@ -79,7 +81,7 @@ jobs:
         run: rm -f "${RUNNER_TEMP}/${TEMPORARY_CERTIFICATE_FILE}"
 
       - name: Checkout another Homebrew to brew subdirectory
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           path: brew
           fetch-depth: 0
@@ -133,12 +135,12 @@ jobs:
           fi
 
       - name: Generate build provenance
-        uses: actions/attest-build-provenance@520d128f165991a6c774bcb264f323e3d70747f4 # v2.2.0
+        uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
         with:
           subject-path: Homebrew-${{ steps.homebrew-version.outputs.version }}.pkg
 
       - name: Upload installer to GitHub Actions
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: Homebrew-${{ steps.homebrew-version.outputs.version }}.pkg
           path: Homebrew-${{ steps.homebrew-version.outputs.version }}.pkg
@@ -150,17 +152,13 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          # Intel
-          - runner: macos-13
-            name: macos-13-x86_64
-          # Apple Silicon
           - runner: macos-14
             name: macos-14-arm64
           - runner: macos-15
             name: macos-15-arm64
     steps:
       - name: Download installer from GitHub Actions
-        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
         with:
           name: "${{ needs.build.outputs.installer_path }}"
 
@@ -213,7 +211,7 @@ jobs:
       contents: write
     steps:
       - name: Download installer from GitHub Actions
-        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
         with:
           name: "${{ needs.build.outputs.installer_path }}"
 
@@ -228,17 +226,15 @@ jobs:
                                     --password "${PKG_APPLE_ID_APP_SPECIFIC_PASSWORD}"
                                     --wait
 
-      - name: Install gh
-        run: brew install gh
-
       - name: Upload installer to GitHub release
         if: github.event_name == 'release'
         env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           INSTALLER_PATH: ${{ needs.build.outputs.installer_path }}
-        run: gh release upload --repo Homebrew/brew
-                                "${GITHUB_REF//refs\/tags\//}"
-                                "${INSTALLER_PATH}"
+        run: |
+          VERSION="${INSTALLER_PATH#Homebrew-}"
+          VERSION="${VERSION%.pkg}"
+          gh release upload --repo Homebrew/brew "${VERSION}" "${INSTALLER_PATH}"
 
   issue:
     needs: [build, test, upload]
@@ -251,7 +247,7 @@ jobs:
       issues: write
     steps:
       - name: Open, update, or close pkg installer issue
-        uses: Homebrew/actions/create-or-update-issue@master
+        uses: Homebrew/actions/create-or-update-issue@main
         with:
           title: Failed to publish pkg installer
           body: >
@@ -259,7 +255,7 @@ jobs:
             ${{ github.ref_name }}. No pkg installer was uploaded to the GitHub
             release.
           labels: bug,release blocker
-          update-existing: ${{ contains(needs.*.result, 'failure') }}
+          update-existing: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped') }}
           close-existing: ${{ needs.upload.result == 'success' }}
           close-from-author: github-actions[bot]
           close-comment: >

.github/workflows/rubydoc.yml

@@ -3,6 +3,7 @@ name: Ruby Documentation CI
 on:
   push:
     branches:
+      - main
       - master
   pull_request:
 
@@ -13,7 +14,6 @@ env:
   HOMEBREW_DEVELOPER: 1
   HOMEBREW_NO_AUTO_UPDATE: 1
   HOMEBREW_NO_ENV_HINTS: 1
-  HOMEBREW_BOOTSNAP: 1
   HOMEBREW_NO_INSTALL_CLEANUP: 1
 
 defaults:
@@ -29,21 +29,21 @@ jobs:
     steps:
       - name: Set up Homebrew
         id: set-up-homebrew
-        uses: Homebrew/actions/setup-homebrew@master
+        uses: Homebrew/actions/setup-homebrew@main
         with:
           core: false
           cask: false
           test-bot: false
 
       - name: Checkout Homebrew/rubydoc.brew.sh
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           repository: Homebrew/rubydoc.brew.sh
           path: rubydoc
           persist-credentials: false
 
       - name: Install Ruby
-        uses: ruby/setup-ruby@1287d2b408066abada82d5ad1c63652e758428d9 # v1.214.0
+        uses: ruby/setup-ruby@44511735964dcb71245e7e55f72539531f7bc0eb # v1.257.0
         with:
           bundler-cache: true
           working-directory: rubydoc

.github/workflows/sbom.yml

@@ -1,9 +1,10 @@
-name: Update schema data
+name: Update SBOM schema
 on:
   push:
     paths:
-      - .github/workflows/schemas.yml
+      - .github/workflows/sbom.yml
     branches-ignore:
+      - main
       - master
   schedule:
     - cron: "0 0 * * *"
@@ -17,33 +18,32 @@ defaults:
     shell: bash -xeuo pipefail {0}
 
 jobs:
-  spdx:
+  sbom:
     if: github.repository == 'Homebrew/brew'
     runs-on: ubuntu-latest
     steps:
       - name: Set up Homebrew
         id: set-up-homebrew
-        uses: Homebrew/actions/setup-homebrew@master
+        uses: Homebrew/actions/setup-homebrew@main
         with:
           core: false
           cask: false
           test-bot: false
 
       - name: Configure Git user
-        uses: Homebrew/actions/git-user-config@master
+        uses: Homebrew/actions/git-user-config@main
         with:
           username: BrewTestBot
 
       - name: Set up commit signing
-        uses: Homebrew/actions/setup-commit-signing@master
+        uses: Homebrew/actions/setup-commit-signing@main
         with:
-          signing_key: ${{ secrets.BREWTESTBOT_GPG_SIGNING_SUBKEY }}
+          signing_key: ${{ secrets.BREWTESTBOT_SSH_SIGNING_KEY }}
 
       - name: Update schema data
         id: update
         env:
           GITHUB_TOKEN: ${{ secrets.HOMEBREW_GITHUB_PUBLIC_REPO_TOKEN }}
-          HOMEBREW_GPG_PASSPHRASE: ${{ secrets.BREWTESTBOT_GPG_SIGNING_SUBKEY_PASSPHRASE }}
         working-directory: ${{ steps.set-up-homebrew.outputs.repository-path }}
         run: |
           git fetch origin
@@ -56,21 +56,22 @@ jobs:
             git checkout "${BRANCH}"
             git checkout "Library/Homebrew/data/schemas"
           else
-            git checkout --no-track -B "${BRANCH}" origin/master
+            git checkout --no-track -B "${BRANCH}" origin/HEAD
           fi
 
           # Intentionally tracking 2.3.x to match what we output in sbom.rb. 3.0 also doesn't have a JSON Schema.
           # Note: this is a 2.3.1 development branch - not a 2.3.1 tag. It contains bugfixes compared to 2.3.0.
-          curl --location --output Library/Homebrew/data/schemas/sbom.json https://raw.githubusercontent.com/spdx/spdx-spec/development/v2.3.1/schemas/spdx-schema.json
+          curl --location --output Library/Homebrew/data/schemas/sbom.json https://raw.githubusercontent.com/spdx/spdx-spec/support/v2.3.1/schemas/spdx-schema.json
           # https://github.com/spdx/spdx-spec/pull/1029
           sed -i -e 's|\(2019-09/schema\)#|\1|' Library/Homebrew/data/schemas/sbom.json
 
           if ! git diff --exit-code Library/Homebrew/data/schemas
           then
             git add "Library/Homebrew/data/schemas"
-            git commit -m "data/schemas: update schema data." -m "Autogenerated by [a scheduled GitHub Action](https://github.com/Homebrew/brew/blob/master/.github/workflows/schemas.yml)."
+            git commit -m "data/schemas: update schema data." -m "Autogenerated by [a scheduled GitHub Action](https://github.com/Homebrew/brew/blob/HEAD/.github/workflows/schemas.yml)."
+
             echo "committed=true" >> "$GITHUB_OUTPUT"
-            PULL_REQUEST_STATE="$(gh pr view --json=state | jq -r ".state")"
+            PULL_REQUEST_STATE="$(gh pr view --json=state | jq -r ".state" || true)"
             if [[ "${PULL_REQUEST_STATE}" != "OPEN" ]]
             then
               echo "pull_request=true" >> "$GITHUB_OUTPUT"
@@ -79,13 +80,13 @@ jobs:
 
       - name: Push commits
         if: steps.update.outputs.committed == 'true'
-        uses: Homebrew/actions/git-try-push@master
+        uses: Homebrew/actions/git-try-push@main
         with:
           token: ${{ secrets.HOMEBREW_GITHUB_PUBLIC_REPO_TOKEN }}
           directory: ${{ steps.set-up-homebrew.outputs.repository-path }}
           branch: ${{ steps.update.outputs.branch }}
           force: true
-          origin_branch: "master"
+          origin_branch: "HEAD"
 
       - name: Open a pull request
         if: steps.update.outputs.pull_request == 'true'
@@ -93,3 +94,26 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.HOMEBREW_GITHUB_PUBLIC_REPO_TOKEN }}
         working-directory: ${{ steps.set-up-homebrew.outputs.repository-path }}
+
+  issue:
+    needs: sbom
+    if: always() && github.event_name == 'schedule'
+    runs-on: ubuntu-latest
+    env:
+      RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+    permissions:
+      # To create or update issues
+      issues: write
+    steps:
+      - name: Open, update, or close schema issue
+        uses: Homebrew/actions/create-or-update-issue@main
+        with:
+          title: Failed to update SBOM schema
+          body: >
+            The SBOM schema workflow [failed](${{ env.RUN_URL }}). No SBOM schema was updated.
+          labels: bug
+          update-existing: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped') }}
+          close-existing: ${{ needs.sbom.result == 'success' }}
+          close-from-author: github-actions[bot]
+          close-comment: >
+            The SBOM schema workflow [succeeded](${{ env.RUN_URL }}). Closing this issue.

.github/workflows/sorbet.yml

@@ -10,6 +10,7 @@ on:
     paths:
       - .github/workflows/sorbet.yml
     branches-ignore:
+      - main
       - master
   schedule:
     - cron: "0 0 * * *"
@@ -29,7 +30,7 @@ jobs:
     steps:
       - name: Set up Homebrew
         id: set-up-homebrew
-        uses: Homebrew/actions/setup-homebrew@master
+        uses: Homebrew/actions/setup-homebrew@main
         with:
           core: false
           cask: false
@@ -37,15 +38,15 @@ jobs:
 
       - name: Configure Git user
         if: github.event_name != 'pull_request'
-        uses: Homebrew/actions/git-user-config@master
+        uses: Homebrew/actions/git-user-config@main
         with:
           username: BrewTestBot
 
       - name: Set up commit signing
         if: github.event_name != 'pull_request'
-        uses: Homebrew/actions/setup-commit-signing@master
+        uses: Homebrew/actions/setup-commit-signing@main
         with:
-          signing_key: ${{ secrets.BREWTESTBOT_GPG_SIGNING_SUBKEY }}
+          signing_key: ${{ secrets.BREWTESTBOT_SSH_SIGNING_KEY }}
 
       - name: Update RBI files
         id: update
@@ -63,7 +64,7 @@ jobs:
               git checkout "${BRANCH}"
               git checkout "Library/Homebrew/sorbet"
             else
-              git checkout --no-track -B "${BRANCH}" origin/master
+              git checkout --no-track -B "${BRANCH}" origin/HEAD
             fi
           fi
 
@@ -74,24 +75,23 @@ jobs:
         if: github.event_name != 'pull_request'
         env:
           GITHUB_TOKEN: ${{ secrets.HOMEBREW_GITHUB_PUBLIC_REPO_TOKEN }}
-          HOMEBREW_GPG_PASSPHRASE: ${{ secrets.BREWTESTBOT_GPG_SIGNING_SUBKEY_PASSPHRASE }}
         working-directory: ${{ steps.set-up-homebrew.outputs.repository-path }}
         run: |
           if ! git diff --stat --exit-code "Library/Homebrew/sorbet"
           then
             git add "Library/Homebrew/sorbet"
             git commit -m "sorbet: Update RBI files." \
-                       -m "Autogenerated by the [sorbet](https://github.com/Homebrew/brew/blob/master/.github/workflows/sorbet.yml) workflow."
+                       -m "Autogenerated by the [sorbet](https://github.com/Homebrew/brew/blob/HEAD/.github/workflows/sorbet.yml) workflow."
 
             if ! git diff --stat --exit-code "Library/Homebrew"
             then
               git add "Library/Homebrew/"
               git commit -m "sorbet: Autobump sigils via Spoom" \
-                         -m "Autogenerated by the [sorbet](https://github.com/Homebrew/brew/blob/master/.github/workflows/sorbet.yml) workflow."
+                         -m "Autogenerated by the [sorbet](https://github.com/Homebrew/brew/blob/HEAD/.github/workflows/sorbet.yml) workflow."
             fi
 
             echo "committed=true" >> "$GITHUB_OUTPUT"
-            PULL_REQUEST_STATE="$(gh pr view --json=state | jq -r ".state")"
+            PULL_REQUEST_STATE="$(gh pr view --json=state | jq -r ".state" || true)"
             if [[ "${PULL_REQUEST_STATE}" != "OPEN" ]]
             then
               echo "pull_request=true" >> "$GITHUB_OUTPUT"
@@ -100,13 +100,13 @@ jobs:
 
       - name: Push commits
         if: steps.commit.outputs.committed == 'true'
-        uses: Homebrew/actions/git-try-push@master
+        uses: Homebrew/actions/git-try-push@main
         with:
           token: ${{ secrets.HOMEBREW_GITHUB_PUBLIC_REPO_TOKEN }}
           directory: ${{ steps.set-up-homebrew.outputs.repository-path }}
           branch: ${{ steps.update.outputs.branch }}
           force: true
-          origin_branch: "master"
+          origin_branch: "HEAD"
 
       - name: Open a pull request
         if: steps.commit.outputs.pull_request == 'true'
@@ -114,3 +114,26 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.HOMEBREW_GITHUB_PUBLIC_REPO_TOKEN }}
         working-directory: ${{ steps.set-up-homebrew.outputs.repository-path }}
+
+  issue:
+    needs: tapioca
+    if: always() && github.event_name == 'schedule'
+    runs-on: ubuntu-latest
+    env:
+      RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+    permissions:
+      # To create or update issues
+      issues: write
+    steps:
+      - name: Open, update, or close Sorbet issue
+        uses: Homebrew/actions/create-or-update-issue@main
+        with:
+          title: Failed to update RBI files
+          body: >
+            The Sorbet workflow [failed](${{ env.RUN_URL }}). No RBI files were updated.
+          labels: bug
+          update-existing: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped') }}
+          close-existing: ${{ needs.tapioca.result == 'success' }}
+          close-from-author: github-actions[bot]
+          close-comment: >
+            The Sorbet workflow [succeeded](${{ env.RUN_URL }}). Closing this issue.

.github/workflows/spdx.yml

@@ -4,6 +4,7 @@ on:
     paths:
       - .github/workflows/spdx.yml
     branches-ignore:
+      - main
       - master
   schedule:
     - cron: "0 0 * * *"
@@ -23,27 +24,26 @@ jobs:
     steps:
       - name: Set up Homebrew
         id: set-up-homebrew
-        uses: Homebrew/actions/setup-homebrew@master
+        uses: Homebrew/actions/setup-homebrew@main
         with:
           core: false
           cask: false
           test-bot: false
 
       - name: Configure Git user
-        uses: Homebrew/actions/git-user-config@master
+        uses: Homebrew/actions/git-user-config@main
         with:
           username: BrewTestBot
 
       - name: Set up commit signing
-        uses: Homebrew/actions/setup-commit-signing@master
+        uses: Homebrew/actions/setup-commit-signing@main
         with:
-          signing_key: ${{ secrets.BREWTESTBOT_GPG_SIGNING_SUBKEY }}
+          signing_key: ${{ secrets.BREWTESTBOT_SSH_SIGNING_KEY }}
 
       - name: Update SPDX license data
         id: update
         env:
           GITHUB_TOKEN: ${{ secrets.HOMEBREW_GITHUB_PUBLIC_REPO_TOKEN }}
-          HOMEBREW_GPG_PASSPHRASE: ${{ secrets.BREWTESTBOT_GPG_SIGNING_SUBKEY_PASSPHRASE }}
         working-directory: ${{ steps.set-up-homebrew.outputs.repository-path }}
         run: |
           git fetch origin
@@ -56,15 +56,16 @@ jobs:
             git checkout "${BRANCH}"
             git checkout "Library/Homebrew/data/spdx"
           else
-            git checkout --no-track -B "${BRANCH}" origin/master
+            git checkout --no-track -B "${BRANCH}" origin/HEAD
           fi
 
           if brew update-license-data
           then
             git add "Library/Homebrew/data/spdx"
-            git commit -m "spdx: update license data." -m "Autogenerated by [a scheduled GitHub Action](https://github.com/Homebrew/brew/blob/master/.github/workflows/spdx.yml)."
+            git commit -m "spdx: update license data." -m "Autogenerated by [a scheduled GitHub Action](https://github.com/Homebrew/brew/blob/HEAD/.github/workflows/spdx.yml)."
+
             echo "committed=true" >> "$GITHUB_OUTPUT"
-            PULL_REQUEST_STATE="$(gh pr view --json=state | jq -r ".state")"
+            PULL_REQUEST_STATE="$(gh pr view --json=state | jq -r ".state" || true)"
             if [[ "${PULL_REQUEST_STATE}" != "OPEN" ]]
             then
               echo "pull_request=true" >> "$GITHUB_OUTPUT"
@@ -73,13 +74,13 @@ jobs:
 
       - name: Push commits
         if: steps.update.outputs.committed == 'true'
-        uses: Homebrew/actions/git-try-push@master
+        uses: Homebrew/actions/git-try-push@main
         with:
           token: ${{ secrets.HOMEBREW_GITHUB_PUBLIC_REPO_TOKEN }}
           directory: ${{ steps.set-up-homebrew.outputs.repository-path }}
           branch: ${{ steps.update.outputs.branch }}
           force: true
-          origin_branch: "master"
+          origin_branch: "HEAD"
 
       - name: Open a pull request
         if: steps.update.outputs.pull_request == 'true'
@@ -87,3 +88,26 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.HOMEBREW_GITHUB_PUBLIC_REPO_TOKEN }}
         working-directory: ${{ steps.set-up-homebrew.outputs.repository-path }}
+
+  issue:
+    needs: spdx
+    if: always() && github.event_name == 'schedule'
+    runs-on: ubuntu-latest
+    env:
+      RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+    permissions:
+      # To create or update issues
+      issues: write
+    steps:
+      - name: Open, update, or close SPDX issue
+        uses: Homebrew/actions/create-or-update-issue@main
+        with:
+          title: Failed to update SPDX license data
+          body: >
+            The SPDX license data workflow [failed](${{ env.RUN_URL }}). No SPDX license data was updated.
+          labels: bug
+          update-existing: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped') }}
+          close-existing: ${{ needs.spdx.result == 'success' }}
+          close-from-author: github-actions[bot]
+          close-comment: >
+            The SPDX license data workflow [succeeded](${{ env.RUN_URL }}). Closing this issue.

.github/workflows/sponsors-maintainers-man-completions.yml

@@ -3,6 +3,7 @@ name: Update sponsors, maintainers, manpage and completions
 on:
   push:
     branches:
+      - main
       - master
     paths:
       - .github/workflows/sponsors-maintainers-man-completions.yml
@@ -32,24 +33,24 @@ jobs:
     steps:
       - name: Setup Homebrew
         id: set-up-homebrew
-        uses: Homebrew/actions/setup-homebrew@master
+        uses: Homebrew/actions/setup-homebrew@main
         with:
           core: false
           cask: false
           test-bot: false
 
       - name: Configure Git user
-        uses: Homebrew/actions/git-user-config@master
+        uses: Homebrew/actions/git-user-config@main
         with:
           username: BrewTestBot
 
       - name: Set up commit signing
-        uses: Homebrew/actions/setup-commit-signing@master
+        uses: Homebrew/actions/setup-commit-signing@main
         with:
-          signing_key: ${{ secrets.BREWTESTBOT_GPG_SIGNING_SUBKEY }}
+          signing_key: ${{ secrets.BREWTESTBOT_SSH_SIGNING_KEY }}
 
       - name: Cache Bundler RubyGems
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
         with:
           path: ${{ steps.set-up-homebrew.outputs.gems-path }}
           key: ${{ runner.os }}-rubygems-${{ steps.set-up-homebrew.outputs.gems-hash }}
@@ -60,7 +61,7 @@ jobs:
         run: |
           git fetch origin
 
-          if [[ -n "$GITHUB_REF_NAME" && "$GITHUB_REF_NAME" != "master" ]]
+          if [[ -n "$GITHUB_REF_NAME" && "$GITHUB_REF_NAME" != "master" && "$GITHUB_REF_NAME" != "main" ]]
           then
             BRANCH="$GITHUB_REF_NAME"
           else
@@ -76,7 +77,7 @@ jobs:
                          "manpages/brew.1" \
                          "completions"
           else
-            git checkout --force --no-track -B "${BRANCH}" origin/master
+            git checkout --force --no-track -B "${BRANCH}" origin/HEAD
           fi
 
           if brew update-sponsors
@@ -111,7 +112,7 @@ jobs:
           if [[ -n "${COMMITTED-}" ]]
           then
             echo "committed=true" >> "$GITHUB_OUTPUT"
-            PULL_REQUEST_STATE="$(gh pr view --json=state | jq -r ".state")"
+            PULL_REQUEST_STATE="$(gh pr view --json=state | jq -r ".state" || true)"
             if [[ "${PULL_REQUEST_STATE}" != "OPEN" ]]
             then
               echo "pull_request=true" >> "$GITHUB_OUTPUT"
@@ -120,12 +121,11 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.HOMEBREW_GITHUB_PUBLIC_REPO_TOKEN }}
           HOMEBREW_GITHUB_API_TOKEN: ${{ secrets.HOMEBREW_BREW_UPDATE_SPONSORS_MAINTAINERS_TOKEN }}
-          HOMEBREW_GPG_PASSPHRASE: ${{ secrets.BREWTESTBOT_GPG_SIGNING_SUBKEY_PASSPHRASE }}
         working-directory: ${{ steps.set-up-homebrew.outputs.repository-path }}
 
       - name: Push commits
         if: steps.update.outputs.committed == 'true'
-        uses: Homebrew/actions/git-try-push@master
+        uses: Homebrew/actions/git-try-push@main
         with:
           token: ${{ secrets.HOMEBREW_GITHUB_PUBLIC_REPO_TOKEN }}
           directory: ${{ steps.set-up-homebrew.outputs.repository-path }}
@@ -138,3 +138,26 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.HOMEBREW_GITHUB_PUBLIC_REPO_TOKEN }}
         working-directory: ${{ steps.set-up-homebrew.outputs.repository-path }}
+
+  issue:
+    needs: updates
+    if: always() && github.event_name == 'schedule'
+    runs-on: ubuntu-latest
+    env:
+      RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+    permissions:
+      # To create or update issues
+      issues: write
+    steps:
+      - name: Open, update, or close sponsors, maintainers, manpage and completions issue
+        uses: Homebrew/actions/create-or-update-issue@main
+        with:
+          title: Failed to update sponsors, maintainers, manpage and completions
+          body: >
+            The sponsors, maintainers, manpage and completions workflow [failed](${{ env.RUN_URL }}). No sponsors, maintainers, manpage and completions were updated.
+          labels: bug
+          update-existing: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped') }}
+          close-existing: ${{ needs.updates.result == 'success' }}
+          close-from-author: github-actions[bot]
+          close-comment: >
+            The sponsors, maintainers, manpage and completions workflow [succeeded](${{ env.RUN_URL }}). Closing this issue.

.github/workflows/stale-issues.yml

@@ -38,7 +38,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Mark/Close Stale Issues and Pull Requests
-        uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e # v9.0.0
+        uses: actions/stale@3a9db7e6a41a89f618792c92c0e97cc736e1b13f # v10.0.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           days-before-stale: 21
@@ -68,7 +68,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Mark/Close Stale `bump-formula-pr` and `bump-cask-pr` Pull Requests
-        uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e # v9.0.0
+        uses: actions/stale@3a9db7e6a41a89f618792c92c0e97cc736e1b13f # v10.0.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           days-before-stale: 2

.github/workflows/sync-default-branches.yml

@@ -0,0 +1,64 @@
+name: Sync default branches
+
+on:
+  push:
+    branches:
+      - main
+      - master
+  pull_request:
+    paths:
+      - .github/workflows/sync-default-branches.yml
+
+permissions: {}
+
+defaults:
+  run:
+    shell: bash -xeuo pipefail {0}
+
+concurrency:
+  group: "sync-default-branches-${{ github.ref }}"
+  cancel-in-progress: true
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Configure Git user
+        uses: Homebrew/actions/git-user-config@main
+        with:
+          username: github-actions[bot]
+
+      - name: Determine source and target branches
+        id: branches
+        run: |
+          if [[ "${GITHUB_REF_NAME}" == "main" ]]; then
+            target="master"
+            source="main"
+          else
+            target="main"
+            source="master"
+          fi
+          echo "target=${target}" >> "$GITHUB_OUTPUT"
+          echo "source=${source}" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          fetch-depth: 1
+          persist-credentials: true
+
+      - name: Get target SHA
+        id: sha
+        run: |
+          TARGET_SHA=$(git ls-remote origin "refs/heads/${SOURCE_BRANCH}" | cut -f1)
+          echo "target=${TARGET_SHA}" >> "$GITHUB_OUTPUT"
+        env:
+          SOURCE_BRANCH: ${{ steps.branches.outputs.source }}
+
+      - name: Push target branch
+        if: github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master'
+        run: git push origin "${TARGET_SHA}:refs/heads/${TARGET_BRANCH}" --force
+        env:
+          TARGET_SHA: ${{ steps.sha.outputs.target }}
+          TARGET_BRANCH: ${{ steps.branches.outputs.target }}

.github/workflows/tests.yml

@@ -3,6 +3,7 @@ name: CI
 on:
   push:
     branches:
+      - main
       - master
   pull_request:
   merge_group:
@@ -14,7 +15,6 @@ env:
   HOMEBREW_DEVELOPER: 1
   HOMEBREW_NO_AUTO_UPDATE: 1
   HOMEBREW_NO_ENV_HINTS: 1
-  HOMEBREW_BOOTSNAP: 1
   HOMEBREW_NO_INSTALL_CLEANUP: 1
   HOMEBREW_VERIFY_ATTESTATIONS: 1
 
@@ -33,14 +33,14 @@ jobs:
     steps:
       - name: Set up Homebrew
         id: set-up-homebrew
-        uses: Homebrew/actions/setup-homebrew@master
+        uses: Homebrew/actions/setup-homebrew@main
         with:
           core: false
           cask: false
           test-bot: false
 
       - name: Cache Bundler RubyGems
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
         with:
           path: ${{ steps.set-up-homebrew.outputs.gems-path }}
           key: ${{ runner.os }}-rubygems-syntax-${{ steps.set-up-homebrew.outputs.gems-hash }}
@@ -53,7 +53,7 @@ jobs:
         run: brew install shellcheck shfmt
 
       - name: Cache style cache
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
         with:
           path: ~/.cache/Homebrew/style
           key: syntax-style-cache-${{ github.sha }}
@@ -81,18 +81,18 @@ jobs:
     name: tap syntax
     needs: syntax
     if: github.repository_owner == 'Homebrew'
-    runs-on: macos-14
+    runs-on: macos-15
     steps:
       - name: Set up Homebrew
         id: set-up-homebrew
-        uses: Homebrew/actions/setup-homebrew@master
+        uses: Homebrew/actions/setup-homebrew@main
         with:
           core: true
           cask: true
           test-bot: true
 
       - name: Cache Bundler RubyGems
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
         with:
           path: ${{ steps.set-up-homebrew.outputs.gems-path }}
           key: ${{ runner.os }}-rubygems-tap-syntax-${{ steps.set-up-homebrew.outputs.gems-hash }}
@@ -102,9 +102,9 @@ jobs:
         run: brew install-bundler-gems --groups=style
 
       - name: Cache style cache
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
         with:
-          path: ~/.cache/Homebrew/style
+          path: ~/Library/Caches/Homebrew/style
           key: tap-syntax-style-cache-${{ github.sha }}
           restore-keys: tap-syntax-style-cache-
 
@@ -113,30 +113,18 @@ jobs:
 
       - name: Set up all Homebrew taps
         run: |
-          brew tap homebrew/aliases
-          brew tap homebrew/bundle
           brew tap homebrew/command-not-found
-          brew tap homebrew/formula-analytics
           brew tap homebrew/portable-ruby
-          brew tap homebrew/services
 
           # brew style doesn't like world writable directories
           sudo chmod -R g-w,o-w "$(brew --repo)/Library/Taps"
 
       - name: Run brew style on official taps
         run: |
-          brew style homebrew/bundle \
-                     homebrew/services \
-                     homebrew/test-bot
-
-          brew style homebrew/aliases \
+          brew style homebrew/test-bot \
                      homebrew/command-not-found \
-                     homebrew/formula-analytics \
-                     homebrew/portable-ruby
-
-      - name: Run brew style on homebrew/cask
-        run: |
-          brew style homebrew/cask
+                     homebrew/portable-ruby \
+                     homebrew/cask
 
   formula-audit:
     name: formula audit
@@ -144,11 +132,11 @@ jobs:
     if: github.repository_owner == 'Homebrew' && github.event_name != 'push'
     runs-on: ubuntu-latest
     container:
-      image: ghcr.io/homebrew/brew:master
+      image: ghcr.io/homebrew/brew:main
     steps:
       - name: Set up Homebrew
         id: set-up-homebrew
-        uses: Homebrew/actions/setup-homebrew@master
+        uses: Homebrew/actions/setup-homebrew@main
         with:
           core: true
           cask: false
@@ -171,7 +159,7 @@ jobs:
     steps:
       - name: Set up Homebrew
         id: set-up-homebrew
-        uses: Homebrew/actions/setup-homebrew@master
+        uses: Homebrew/actions/setup-homebrew@main
         with:
           core: true
           cask: true
@@ -184,9 +172,6 @@ jobs:
         run: |
           brew audit --skip-style --except=version --tap=homebrew/cask
 
-      - name: Generate formula API
-        run: brew generate-formula-api --dry-run
-
       - name: Generate cask API
         run: brew generate-cask-api --dry-run
 
@@ -197,14 +182,14 @@ jobs:
     steps:
       - name: Set up Homebrew
         id: set-up-homebrew
-        uses: Homebrew/actions/setup-homebrew@master
+        uses: Homebrew/actions/setup-homebrew@main
         with:
           core: false
           cask: false
           test-bot: false
 
       - name: Configure Git user
-        uses: Homebrew/actions/git-user-config@master
+        uses: Homebrew/actions/git-user-config@main
         with:
           username: BrewTestBot
 
@@ -225,14 +210,14 @@ jobs:
     strategy:
       matrix:
         include:
-          - name: update-test (Ubuntu)
+          - name: update-test (Linux)
             runs-on: ubuntu-latest
           - name: update-test (macOS)
-            runs-on: macos-15
+            runs-on: macos-latest
     steps:
       - name: Set up Homebrew
         id: set-up-homebrew
-        uses: Homebrew/actions/setup-homebrew@master
+        uses: Homebrew/actions/setup-homebrew@main
         with:
           core: false
           cask: false
@@ -258,25 +243,16 @@ jobs:
           - name: tests (generic OS)
             test-flags: --generic --coverage
             runs-on: ubuntu-latest
-          - name: tests (Ubuntu 24.04)
+          - name: tests (Linux)
             test-flags: --coverage
             runs-on: ubuntu-24.04
-          - name: tests (Ubuntu 22.04)
-            test-flags: --coverage
-            runs-on: ubuntu-22.04
-          - name: tests (Ubuntu 20.04)
-            test-flags: --coverage
-            runs-on: ubuntu-20.04
-          - name: tests (macOS 13 x86_64)
-            test-flags: --coverage
-            runs-on: macos-13
-          - name: tests (macOS 15 arm64)
+          - name: tests (macOS)
             test-flags: --coverage
             runs-on: macos-15
     steps:
       - name: Set up Homebrew
         id: set-up-homebrew
-        uses: Homebrew/actions/setup-homebrew@master
+        uses: Homebrew/actions/setup-homebrew@main
         with:
           # We only test needs_homebrew_core tests on macOS because
           # homebrew/core is not available by default on GitHub-hosted Ubuntu
@@ -286,7 +262,7 @@ jobs:
           test-bot: false
 
       - name: Cache Bundler RubyGems
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
         with:
           path: ${{ steps.set-up-homebrew.outputs.gems-path }}
           key: ${{ matrix.runs-on }}-tests-rubygems-${{ steps.set-up-homebrew.outputs.gems-hash }}
@@ -301,7 +277,7 @@ jobs:
         run: mkdir tests
 
       - name: Cache parallel tests log
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
         with:
           path: tests
           key: ${{ runner.os }}-${{ matrix.test-flags }}-parallel_runtime_rspec-${{ github.sha }}
@@ -348,21 +324,21 @@ jobs:
           filenames=$(find Library/Homebrew/test/junit -name 'rspec*.xml' -print | tr '\n' ',')
           echo "filenames=${filenames%,}" >> "$GITHUB_OUTPUT"
 
-      - uses: codecov/test-results-action@4e79e65778be1cecd5df25e14af1eafb6df80ea9 # v1.0.2
+      - uses: codecov/test-results-action@47f89e9acb64b76debcd5ea40642d25a4adced9f # v1.1.1
         with:
           working-directory: ${{ steps.set-up-homebrew.outputs.repository-path }}
           files: ${{ steps.junit_xml.outputs.filenames }}
           disable_search: true
           token: ${{ secrets.CODECOV_TOKEN }}
 
-      - uses: codecov/codecov-action@13ce06bfc6bbe3ecf90edbbf1bc32fe5978ca1d3 # v5.3.1
+      - uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
         with:
           working-directory: ${{ steps.set-up-homebrew.outputs.repository-path }}
           files: Library/Homebrew/test/coverage/coverage.xml
           disable_search: true
           token: ${{ secrets.CODECOV_TOKEN }}
 
-  test-default-formula:
+  test-bot:
     name: ${{ matrix.name }}
     needs: syntax
     if: github.repository_owner == 'Homebrew' && github.event_name != 'push'
@@ -371,32 +347,178 @@ jobs:
     strategy:
       matrix:
         include:
-          - name: test default formula (Ubuntu 22.04)
+          - name: test-bot (Linux arm64)
+            runs-on: ubuntu-24.04-arm
+            container: ghcr.io/homebrew/ubuntu24.04:latest
+          - name: test-bot (Linux x86_64)
             runs-on: ubuntu-latest
-            container: ghcr.io/homebrew/ubuntu22.04:master
-          - name: test default formula (Ubuntu 20.04)
+            container: ghcr.io/homebrew/ubuntu22.04:main
+          # Use Debian Old Stable for testing Homebrew's glibc support.
+          - name: test-bot (Linux Homebrew glibc)
             runs-on: ubuntu-latest
-            container: ghcr.io/homebrew/ubuntu20.04
-          - name: test default formula (macOS 13 x86_64)
+            container: debian:oldstable
+          - name: test-bot (macOS x86_64)
             runs-on: macos-13
-          - name: test default formula (macOS 15 arm64)
+          - name: test-bot (macOS arm64)
             runs-on: macos-15
     env:
       HOMEBREW_TEST_BOT_ANALYTICS: 1
       HOMEBREW_ENFORCE_SBOM: 1
+      HOMEBREW_DOWNLOAD_CONCURRENCY: auto
     steps:
+      - name: Install Homebrew and Homebrew's dependencies
+        # All other images are built from our Homebrew Dockerfile.
+        # This is the only one that needs to be set up manually.
+        if: matrix.container == 'debian:oldstable'
+        run: |
+          # Slimmed down version from the Homebrew Dockerfile
+          apt-get update
+          apt-get install -y --no-install-recommends \
+            bzip2 \
+            ca-certificates \
+            curl \
+            file \
+            g++ \
+            git-core \
+            less \
+            locales \
+            make \
+            netbase \
+            patch \
+            procps \
+            sudo \
+            uuid-runtime \
+            tzdata
+
+          # Install Homebrew
+          mkdir -p /home/linuxbrew/.linuxbrew/bin
+          # Don't do shallow clone or it's unshallowed by "Set up Homebrew"
+          git clone https://github.com/Homebrew/brew.git /home/linuxbrew/.linuxbrew/Homebrew
+          cd /home/linuxbrew/.linuxbrew/bin
+          ln -s ../Homebrew/bin/brew brew
+          echo "/home/linuxbrew/.linuxbrew/bin" >>"$GITHUB_PATH"
+
       - name: Set up Homebrew
         id: set-up-homebrew
-        uses: Homebrew/actions/setup-homebrew@master
+        uses: Homebrew/actions/setup-homebrew@main
         with:
-          core: true
+          core: false
           cask: false
           test-bot: true
 
       - run: brew test-bot --only-cleanup-before
 
+      - name: Setup environment variables
+        run: |
+          # Set enviroment variables to bypass `brew doctor` failures on Tier >=2 configurations
+          if [[ "${MATRIX_NAME}" == "test-bot (Linux arm64)" ]]; then
+            echo "HOMEBREW_ARM64_TESTING=1" >> "$GITHUB_ENV"
+          elif [[ "${MATRIX_NAME}" == "test-bot (Linux Homebrew glibc)" ]]; then
+            echo "HOMEBREW_GLIBC_TESTING=1" >> "$GITHUB_ENV"
+          fi
+        env:
+          MATRIX_NAME: ${{ matrix.name }}
+
       - run: brew test-bot --only-setup
 
       - run: brew install gnu-tar
 
       - run: brew test-bot --only-formulae --only-json-tab --test-default-formula
+
+  bundle-and-services:
+    name: ${{ matrix.name }}
+    needs: syntax
+    if: github.repository_owner == 'Homebrew' && github.event_name != 'push'
+    runs-on: ${{ matrix.runs-on }}
+    strategy:
+      matrix:
+        include:
+          - name: bundle and services (Linux)
+            runs-on: ubuntu-latest
+          - name: bundle and services (macOS)
+            runs-on: macos-latest
+    steps:
+      - name: Set up Homebrew
+        id: set-up-homebrew
+        uses: Homebrew/actions/setup-homebrew@main
+        with:
+          core: false
+          cask: false
+          test-bot: false
+
+      - run: brew test-bot --only-cleanup-before
+
+      - name: Run brew bundle and brew services integration tests
+        run: |
+          cat <<EOS >> Brewfile
+            brew "git"
+            brew "memcached", restart_service: true
+            brew "postgresql@15", restart_service: true
+            cask "1password"
+            cask "1password-cli"
+            cask "google-chrome"
+            # VSCode cask is not available on Linux.
+            vscode "github.copilot" if OS.mac?
+          EOS
+
+          brew bundle check && exit 1
+          brew bundle check --verbose && exit 1
+          brew bundle list
+          brew bundle --verbose
+          brew bundle --upgrade-formulae=memcached,postgresql@15
+          brew bundle upgrade
+          brew bundle env | grep PATH | grep git
+          brew bundle env --install
+          brew bundle exec --services true
+          brew bundle dump --force --describe
+          brew services list
+          brew services info memcached postgresql@15
+          brew services info --json memcached postgresql@15
+          brew services cleanup
+          brew bundle cleanup --force
+
+  analytics:
+    name: ${{ matrix.name }}
+    runs-on: ${{ matrix.runs-on }}
+    strategy:
+      matrix:
+        include:
+          - name: analytics (Linux)
+            runs-on: ubuntu-latest
+          - name: analytics (macOS)
+            runs-on: macos-latest
+    needs: syntax
+    if: github.repository_owner == 'Homebrew' && github.event_name != 'push'
+    steps:
+    - name: Set up Homebrew
+      id: set-up-homebrew
+      uses: Homebrew/actions/setup-homebrew@main
+
+    - name: Setup Python
+      uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+      with:
+        python-version-file: ${{ steps.set-up-homebrew.outputs.repository-path }}/Library/Homebrew/formula-analytics/.python-version
+
+    - name: Cache Homebrew Bundler RubyGems
+      id: cache
+      uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+      with:
+        path: ${{ steps.set-up-homebrew.outputs.gems-path }}
+        key: ${{ runner.os }}-rubygems-${{ steps.set-up-homebrew.outputs.gems-hash }}
+        restore-keys: ${{ runner.os }}-rubygems-
+
+    - name: Install Homebrew Bundler RubyGems
+      if: steps.cache.outputs.cache-hit != 'true'
+      run: brew install-bundler-gems
+
+    - run: brew formula-analytics --setup
+
+    - run: brew formula-analytics --install --json --days-ago=2
+      if: github.event.pull_request.head.repo.fork == false && (github.event_name == 'pull_request' && github.event.pull_request.user.login != 'dependabot[bot]')
+      env:
+        HOMEBREW_INFLUXDB_TOKEN: ${{ secrets.HOMEBREW_INFLUXDB_READ_TOKEN }}
+
+    - run: brew generate-analytics-api
+      if: github.event.pull_request.head.repo.fork == false && (github.event_name == 'pull_request' && github.event.pull_request.user.login != 'dependabot[bot]')
+      env:
+        HOMEBREW_INFLUXDB_TOKEN: ${{ secrets.HOMEBREW_INFLUXDB_READ_TOKEN }}

.github/workflows/vendor-gems.yml

@@ -9,6 +9,7 @@ on:
     paths:
       - .github/workflows/vendor-gems.yml
     branches-ignore:
+      - main
       - master
   workflow_dispatch:
     inputs:
@@ -17,7 +18,7 @@ on:
         required: true
 
 permissions:
-  contents: read
+  contents: write
   pull-requests: read
 
 defaults:
@@ -31,7 +32,7 @@ jobs:
     steps:
       - name: Set up Homebrew
         id: set-up-homebrew
-        uses: Homebrew/actions/setup-homebrew@master
+        uses: Homebrew/actions/setup-homebrew@main
         with:
           core: false
           cask: false
@@ -39,19 +40,19 @@ jobs:
 
       - name: Configure Git user
         if: github.event_name == 'workflow_dispatch'
-        uses: Homebrew/actions/git-user-config@master
+        uses: Homebrew/actions/git-user-config@main
         with:
           username: BrewTestBot
 
       - name: Set up commit signing
         if: github.event_name == 'workflow_dispatch'
-        uses: Homebrew/actions/setup-commit-signing@master
+        uses: Homebrew/actions/setup-commit-signing@main
         with:
-          signing_key: ${{ secrets.BREWTESTBOT_GPG_SIGNING_SUBKEY }}
+          signing_key: ${{ secrets.BREWTESTBOT_SSH_SIGNING_KEY }}
 
       - name: Check out pull request
         id: checkout
-        if: github.event_name == 'workflow_dispatch'
+        if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.user.login == 'dependabot')
         run: |
           gh pr checkout "${PR}"
 
@@ -66,10 +67,8 @@ jobs:
         working-directory: ${{ steps.set-up-homebrew.outputs.repository-path }}
 
       - name: Vendor Gems
-        env:
-          HOMEBREW_GPG_PASSPHRASE: ${{ secrets.BREWTESTBOT_GPG_SIGNING_SUBKEY_PASSPHRASE }}
         run: |
-          if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]
+          if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" || ("${GITHUB_EVENT_NAME}" == "pull_request" && "${GITHUB_ACTOR}" == "dependabot") ]]
           then
             brew vendor-gems --non-bundler-gems
           else
@@ -80,10 +79,9 @@ jobs:
         run: brew typecheck --update
 
       - name: Commit RBI changes
-        if: github.event_name == 'workflow_dispatch'
+        if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.user.login == 'dependabot')
         env:
           GEM_NAME: ${{ steps.checkout.outputs.gem_name }}
-          HOMEBREW_GPG_PASSPHRASE: ${{ secrets.BREWTESTBOT_GPG_SIGNING_SUBKEY_PASSPHRASE }}
         working-directory: ${{ steps.set-up-homebrew.outputs.repository-path }}
         run: |
           if ! git diff --stat --exit-code "Library/Homebrew/sorbet"
@@ -94,7 +92,7 @@ jobs:
           fi
 
       - name: Generate push token
-        uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
+        uses: actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b # v2.1.1
         id: app-token
         if: github.event_name == 'workflow_dispatch'
         with:
@@ -102,10 +100,10 @@ jobs:
           private-key: ${{ secrets.BREW_COMMIT_APP_KEY }}
 
       - name: Push to pull request
-        if: github.event_name == 'workflow_dispatch'
-        uses: Homebrew/actions/git-try-push@master
+        if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.user.login == 'dependabot')
+        uses: Homebrew/actions/git-try-push@main
         with:
-          token: ${{ steps.app-token.outputs.token }}
+          token: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
           directory: ${{ steps.set-up-homebrew.outputs.repository-path }}
           branch: ${{ steps.checkout.outputs.branch }}
           force: true

.github/workflows/vendor-version.yml

@@ -19,7 +19,7 @@ jobs:
     steps:
       - name: Set up Homebrew
         id: set-up-homebrew
-        uses: Homebrew/actions/setup-homebrew@master
+        uses: Homebrew/actions/setup-homebrew@main
         with:
           core: false
           cask: false
@@ -46,13 +46,16 @@ jobs:
       - name: Compare to base ref
         working-directory: ${{ steps.set-up-homebrew.outputs.gems-path }}/${{ steps.ruby-abi.outputs.version }}
         env:
+          ABI_VERSION: ${{ steps.ruby-abi.outputs.version }}
           VENDOR_VERSION: ${{ steps.gem-info.outputs.vendor-version }}
           IGNORED_GEMS: ${{ steps.gem-info.outputs.ignored }}
         run: |
           git checkout "origin/${GITHUB_BASE_REF}"
           rm .homebrew_vendor_version
           brew install-bundler-gems --groups=all
-          if [[ "$(<.homebrew_vendor_version)" == "${VENDOR_VERSION}" ]]; then
+          if [[ "$(brew ruby -e "puts Gem.ruby_api_version")" == "${ABI_VERSION}" && \
+                "$(<.homebrew_vendor_version)" == "${VENDOR_VERSION}" ]]
+          then
             while IFS= read -r gem; do
               gem_dir="./gems/${gem}"
               [[ -d "${gem_dir}" ]] || continue

.github/zizmor.yml

@@ -0,0 +1,6 @@
+# This file is synced from the `.github` repository, do not modify it directly.
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        Homebrew/actions/*: ref-pin

.gitignore

@@ -40,7 +40,7 @@
 # Ignore Ruby gems for versions other than we explicitly vendor.
 # Keep this in sync with the list in standalone/init.rb.
 **/vendor/bundle/ruby/*/
-!**/vendor/bundle/ruby/3.3.0/
+!**/vendor/bundle/ruby/3.4.0/
 
 # Ignore Bundler binary files
 **/vendor/bundle/ruby/*/gems/**/*.bundle
@@ -79,6 +79,7 @@
 **/vendor/bundle/ruby/*/gems/coderay-*/
 **/vendor/bundle/ruby/*/gems/colorize-*/
 **/vendor/bundle/ruby/*/gems/commander-*/
+**/vendor/bundle/ruby/*/gems/csv-*/
 **/vendor/bundle/ruby/*/gems/diff-lcs-*/
 **/vendor/bundle/ruby/*/gems/docile-*/
 **/vendor/bundle/ruby/*/gems/ecma-re-validator-*/
@@ -90,6 +91,7 @@
 **/vendor/bundle/ruby/*/gems/json_schemer-*/
 **/vendor/bundle/ruby/*/gems/kramdown-*/
 **/vendor/bundle/ruby/*/gems/language_server-protocol-*/
+**/vendor/bundle/ruby/*/gems/lint_roller-*/
 **/vendor/bundle/ruby/*/gems/logger-*/
 **/vendor/bundle/ruby/*/gems/method_source-*/
 **/vendor/bundle/ruby/*/gems/mini_portile2-*/
@@ -106,6 +108,7 @@
 **/vendor/bundle/ruby/*/gems/prism-*/
 **/vendor/bundle/ruby/*/gems/psych-*/
 **/vendor/bundle/ruby/*/gems/pry-*/
+**/vendor/bundle/ruby/*/gems/pycall-*/
 **/vendor/bundle/ruby/*/gems/racc-*/
 **/vendor/bundle/ruby/*/gems/rainbow-*/
 **/vendor/bundle/ruby/*/gems/rbi-*/
@@ -113,6 +116,7 @@
 **/vendor/bundle/ruby/*/gems/rdoc-*/
 **/vendor/bundle/ruby/*/gems/redcarpet-*/
 **/vendor/bundle/ruby/*/gems/regexp_parser-*/
+**/vendor/bundle/ruby/*/gems/require-hooks-*/
 **/vendor/bundle/ruby/*/gems/rexml-*/
 **/vendor/bundle/ruby/*/gems/rspec-*/
 **/vendor/bundle/ruby/*/gems/rspec-core-*/
@@ -161,6 +165,7 @@
 !/completions
 !/docs
 !/manpages
+!/CODEOWNERS
 
 # Unignore our packaging files
 !/package
@@ -168,8 +173,8 @@
 
 # Ignore generated documentation site
 /docs/_site
-/docs/bin
 /docs/.jekyll-metadata
+/docs/tmp/.htmlproofer
 /docs/vendor
 /docs/Gemfile.lock
 

.vscode/mcp.json

@@ -0,0 +1,11 @@
+{
+  "servers": {
+    "Homebrew": {
+      "type": "stdio",
+      "command": "brew",
+      "args": [
+        "mcp-server"
+      ]
+    }
+  }
+}

.vscode/ruby-lsp-activate.sh

@@ -1,5 +1,12 @@
 #!/bin/bash
-HOMEBREW_PREFIX="$(cd "$(dirname "$0")"/../ && pwd)"
+if [[ -n "${BASH_SOURCE[0]}" ]]; then
+    SCRIPT_PATH="${BASH_SOURCE[0]}"
+elif [[ -n "${ZSH_VERSION}" ]]; then
+    SCRIPT_PATH="${(%):-%x}"
+else
+    SCRIPT_PATH="$0"
+fi
+HOMEBREW_PREFIX="$(cd "$(dirname "${SCRIPT_PATH}")"/../ && pwd)"
 
 "${HOMEBREW_PREFIX}/bin/brew" install-bundler-gems --add-groups=style,typecheck,vscode >/dev/null 2>&1
 

.vscode/settings.json

@@ -40,7 +40,6 @@
       "id": "default",
       "name": "Brew Typecheck",
       "description": "Default configuration",
-      "cwd": "${workspaceFolder}",
       "command": [
         "./bin/brew",
         "typecheck",

CODEOWNERS

@@ -0,0 +1,11 @@
+# Note that the naming of this file is incorrect for our case: these people do not "own" the provided files but are
+# people with write-access to this repository who wish to approve changes to these files.
+#
+# Their review is required to merge PRs that change these files.
+#
+# To be explicit: we will never accept changes to this file adding people from outside the Homebrew GitHub
+# organisation. If you are not a Homebrew maintainer: you do not personally "own" or "maintain" any files.
+#
+# Note: @Homebrew/plc does not have write-access to this repository, and therefore cannot be listed in this file.
+
+docs/Support-Tiers.md  @Homebrew/tsc @MikeMcQuaid

Dockerfile

@@ -20,7 +20,7 @@ RUN touch /var/mail/ubuntu && chown ubuntu /var/mail/ubuntu && userdel -r ubuntu
 # shellcheck disable=SC1091,SC2154,SC2292
 RUN apt-get update \
   && apt-get install -y --no-install-recommends software-properties-common gnupg-agent \
-  && add-apt-repository -y ppa:git-core/ppa \
+  && if [ "$(uname -m)" != aarch64 ]; then add-apt-repository -y ppa:git-core/ppa; fi \
   && apt-get update \
   && apt-get install -y --no-install-recommends \
   acl \
@@ -69,15 +69,15 @@ WORKDIR /home/linuxbrew
 
 
 RUN --mount=type=cache,target=/tmp/homebrew-core,uid="${USER_ID}",sharing=locked \
-    # Clone the homebre-core repo into /tmp/homebrew-core or pull latest changes if it exists
-    git clone https://github.com/homebrew/homebrew-core /tmp/homebrew-core || { cd /tmp/homebrew-core && git pull; } \
-    && mkdir -p /home/linuxbrew/.linuxbrew/Homebrew/Library/Taps/homebrew/homebrew-core \
-    && cp -r /tmp/homebrew-core /home/linuxbrew/.linuxbrew/Homebrew/Library/Taps/homebrew/
+  # Clone the homebrew-core repo into /tmp/homebrew-core or pull latest changes if it exists
+  git clone https://github.com/homebrew/homebrew-core /tmp/homebrew-core || { cd /tmp/homebrew-core && git pull; } \
+  && mkdir -p /home/linuxbrew/.linuxbrew/Homebrew/Library/Taps/homebrew/homebrew-core \
+  && cp -r /tmp/homebrew-core /home/linuxbrew/.linuxbrew/Homebrew/Library/Taps/homebrew/
 
 
 RUN --mount=type=cache,target=/home/linuxbrew/.cache,uid="${USER_ID}" \
-   --mount=type=cache,target=/home/linuxbrew/.bundle,uid="${USER_ID}" \
-   mkdir -p \
+  --mount=type=cache,target=/home/linuxbrew/.bundle,uid="${USER_ID}" \
+  mkdir -p \
   .linuxbrew/bin \
   .linuxbrew/etc \
   .linuxbrew/include \

Library/.rubocop.yml

@@ -1,10 +1,16 @@
 ---
+plugins:
+  - rubocop-md:
+      plugin_class_name: RuboCop::Markdown::Plugin
+  - rubocop-performance:
+      plugin_class_name: RuboCop::Performance::Plugin
+  - rubocop-rspec:
+      plugin_class_name: RuboCop::RSpec::Plugin
+  - rubocop-sorbet:
+      plugin_class_name: RuboCop::Sorbet::Plugin
+
 require:
   - ./Homebrew/rubocops.rb
-  - rubocop-md
-  - rubocop-performance
-  - rubocop-rspec
-  - rubocop-sorbet
 
 inherit_mode:
   merge:
@@ -12,12 +18,16 @@ inherit_mode:
     - Exclude
 
 AllCops:
+  # TODO: This is the default parser in Ruby >= 3.4
+  # https://github.com/rubocop/rubocop-ast/blob/6b9136235219e9448ee4f369e17cf69bcd9db621/lib/rubocop/ast/processed_source.rb#L385
+  ParserEngine: parser_prism
   TargetRubyVersion: 3.3
   NewCops: enable
   Include:
     - "**/*.rbi"
   Exclude:
-    - "Homebrew/sorbet/rbi/{dsl,gems}/**/*.rbi"
+    - "Homebrew/sorbet/rbi/{annotations,dsl,gems}/**/*.rbi"
+    - "Homebrew/sorbet/rbi/parser*.rbi"
     - "Homebrew/bin/*"
     - "Homebrew/vendor/**/*"
     - "Taps/*/*/vendor/**/*"
@@ -86,6 +96,11 @@ Layout/ArgumentAlignment:
 Layout/CaseIndentation:
   EnforcedStyle: end
 
+# currently bugged and as relevant/urgent in taps:
+# https://github.com/rubocop/rubocop/issues/14443
+Layout/EmptyLinesAfterModuleInclusion:
+  Enabled: false
+
 # significantly less indentation involved; more consistent
 Layout/FirstArrayElementIndentation:
   EnforcedStyle: consistent
@@ -206,6 +221,10 @@ Naming/MethodParameterName:
     merge:
       - AllowedNames
 
+# Allows a nicer API for boolean methods with side effects.
+Naming/PredicateMethod:
+  AllowBangMethods: true
+
 # Both styles are used depending on context,
 # e.g. `sha256` and `something_countable_1`.
 Naming/VariableNumber:
@@ -230,6 +249,8 @@ RSpec:
 # Intentionally disabled as it doesn't fit with our code style.
 RSpec/AnyInstance:
   Enabled: false
+RSpec/IncludeExamples:
+  Enabled: false
 RSpec/SpecFilePathFormat:
   Enabled: false
 RSpec/StubbedMock:
@@ -255,6 +276,11 @@ RSpec/Focus:
 RSpec/MessageSpies:
   EnforcedStyle: receive
 
+# These are legacy violations that we should try to fix.
+Sorbet/AllowIncompatibleOverride:
+  Exclude:
+    - "Homebrew/livecheck/strategy/*.rb"
+
 # Try getting rid of these.
 Sorbet/ConstantsFromStrings:
   Enabled: false
@@ -271,13 +297,6 @@ Sorbet/ForbidRBIOutsideOfAllowedPaths:
 Sorbet/RedundantExtendTSig:
   Enabled: true
 
-# We make limited and intentional use of refinements.
-# It's posssible this may change in the future, though we probably still do not want to ban it in taps
-# and Sorbet typecheck will tell us what is and isn't a problem anyway.
-# Right now, our use of refinements isn't problematic (or at least not yet).
-Sorbet/Refinement:
-  Enabled: false
-
 Sorbet/StrictSigil:
   Enabled: true
   Exclude:
@@ -287,6 +306,7 @@ Sorbet/StrictSigil:
     - "Homebrew/utils/ruby_check_version_script.rb" # A standalone script.
     - "Homebrew/{standalone,startup}/*.rb" # These are loaded before sorbet-runtime
     - "Homebrew/test/**/*.rb"
+    - "Homebrew/bundle/{formula_dumper,checker,commands/exec}.rb" # These aren't typed: true yet.
 
 Sorbet/TrueSigil:
   Enabled: true
@@ -399,12 +419,10 @@ Style/MutableConstant:
 Style/NumericLiteralPrefix:
   EnforcedOctalStyle: zero_only
 
-# Only use this for numbers >= `1_000_000`.
+# Only require this for numbers >= `10_000_000_000`.
 Style/NumericLiterals:
-  MinDigits: 7
+  MinDigits: 11
   Strict: true
-  Exclude:
-    - "**/Brewfile"
 
 Style/OpenStructUse:
   Exclude:

Library/Homebrew/.rubocop.yml

@@ -10,7 +10,13 @@ Homebrew/MoveToExtendOS:
     - "{extend,test,requirements}/**/*"
     - "os.rb"
 
-Naming/PredicateName:
+# We don't use Sorbet for RSpec tests so let's disable this there.
+Sorbet/BlockMethodDefinition:
+  Exclude:
+    - test/**/*
+
+# Want to preserve our own API for these methods for now.
+Naming/PredicatePrefix:
   inherit_mode:
     merge:
       - AllowedMethods
@@ -25,6 +31,7 @@ Style/Documentation:
     - Homebrew
   Include:
     - abstract_command.rb
+    - autobump_constants.rb
     - cask/cask.rb
     - cask/dsl.rb
     - cask/dsl/version.rb
@@ -37,10 +44,10 @@ Style/Documentation:
     - formula.rb
     - formula_assertions.rb
     - formula_free_port.rb
-    - language/go.rb
     - language/java.rb
     - language/node.rb
     - language/perl.rb
+    - language/php.rb
     - language/python.rb
     - livecheck/strategy/apache.rb
     - livecheck/strategy/bitbucket.rb
@@ -65,7 +72,9 @@ Style/Documentation:
     - livecheck/strategy/yaml.rb
     - os.rb
     - resource.rb
+    - startup/config.rb
     - utils/inreplace.rb
+    - utils/output.rb
     - utils/shebang.rb
     - utils/string_inreplace_extension.rb
     - version.rb

Library/Homebrew/.ruby-version

@@ -1 +1 @@
-3.3.7
+3.4.5

Library/Homebrew/Gemfile

@@ -5,9 +5,9 @@ source "https://rubygems.org"
 # The default case (no envs), should always be a restrictive bound on the lowest supported minor version.
 # This is the branch that Dependabot will use.
 if ENV.fetch("HOMEBREW_USE_RUBY_FROM_PATH", "").empty?
-  ruby "~> 3.3.0"
+  ruby "~> 3.4.0"
 else
-  ruby ">= 3.3.0"
+  ruby ">= 3.4.0"
 end
 
 # disallowed gems (should not be used)
@@ -71,6 +71,12 @@ end
 group :vscode, optional: true do
   gem "ruby-lsp", require: false
 end
+group :formula_analytics, optional: true do
+  gem "pycall", require: false
+end
+group :contributions, optional: true do
+  gem "csv", require: false
+end
 
 # shared gems (used by multiple groups)
 group :audit, :bump_unversioned_casks, :livecheck, optional: true do

Library/Homebrew/Gemfile.lock

@@ -3,147 +3,161 @@ GEM
   specs:
     addressable (2.8.7)
       public_suffix (>= 2.0.2, < 7.0)
-    ast (2.4.2)
-    base64 (0.2.0)
-    benchmark (0.4.0)
-    bigdecimal (3.1.9)
-    bindata (2.5.0)
+    ast (2.4.3)
+    base64 (0.3.0)
+    benchmark (0.4.1)
+    bigdecimal (3.2.3)
+    bindata (2.5.1)
     coderay (1.1.3)
     concurrent-ruby (1.3.5)
-    diff-lcs (1.5.1)
+    csv (3.3.5)
+    diff-lcs (1.6.2)
     docile (1.4.1)
     elftools (1.3.1)
       bindata (~> 2)
     erubi (1.13.1)
     hana (1.3.7)
-    json (2.9.1)
-    json_schemer (2.3.0)
+    json (2.13.2)
+    json_schemer (2.4.0)
       bigdecimal
       hana (~> 1.3)
       regexp_parser (~> 2.0)
       simpleidn (~> 0.2)
     kramdown (2.5.1)
       rexml (>= 3.3.9)
-    language_server-protocol (3.17.0.4)
-    logger (1.6.5)
+    language_server-protocol (3.17.0.5)
+    lint_roller (1.1.0)
+    logger (1.7.0)
     method_source (1.1.0)
-    minitest (5.25.4)
+    minitest (5.25.5)
     netrc (0.11.0)
-    parallel (1.26.3)
-    parallel_tests (4.9.0)
+    parallel (1.27.0)
+    parallel_tests (5.4.0)
       parallel
-    parser (3.3.7.0)
+    parser (3.3.9.0)
       ast (~> 2.4.1)
       racc
     patchelf (1.5.1)
       elftools (>= 1.3)
     plist (3.7.2)
-    prism (1.3.0)
+    prism (1.4.0)
     pry (0.15.2)
       coderay (~> 1.1)
       method_source (~> 1.0)
-    public_suffix (6.0.1)
+    public_suffix (6.0.2)
+    pycall (1.5.2)
     racc (1.8.1)
     rainbow (3.1.1)
-    rbi (0.2.4)
+    rbi (0.3.6)
       prism (~> 1.0)
-      sorbet-runtime (>= 0.5.9204)
-    rbs (3.8.1)
+      rbs (>= 3.4.4)
+    rbs (4.0.0.dev.4)
       logger
-    redcarpet (3.6.0)
-    regexp_parser (2.10.0)
-    rexml (3.4.0)
-    rspec (3.13.0)
+      prism (>= 1.3.0)
+    redcarpet (3.6.1)
+    regexp_parser (2.11.2)
+    require-hooks (0.2.2)
+    rexml (3.4.4)
+    rspec (3.13.1)
       rspec-core (~> 3.13.0)
       rspec-expectations (~> 3.13.0)
       rspec-mocks (~> 3.13.0)
-    rspec-core (3.13.2)
+    rspec-core (3.13.5)
       rspec-support (~> 3.13.0)
-    rspec-expectations (3.13.3)
+    rspec-expectations (3.13.5)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
     rspec-github (3.0.0)
       rspec-core (~> 3.0)
-    rspec-mocks (3.13.2)
+    rspec-mocks (3.13.5)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
     rspec-retry (0.6.2)
       rspec-core (> 3.3)
     rspec-sorbet (1.9.2)
       sorbet-runtime
-    rspec-support (3.13.2)
+    rspec-support (3.13.5)
     rspec_junit_formatter (0.6.0)
       rspec-core (>= 2, < 4, != 2.12.0)
-    rubocop (1.71.1)
+    rubocop (1.80.2)
       json (~> 2.3)
-      language_server-protocol (>= 3.17.0)
+      language_server-protocol (~> 3.17.0.2)
+      lint_roller (~> 1.1.0)
       parallel (~> 1.10)
       parser (>= 3.3.0.2)
       rainbow (>= 2.2.2, < 4.0)
       regexp_parser (>= 2.9.3, < 3.0)
-      rubocop-ast (>= 1.38.0, < 2.0)
+      rubocop-ast (>= 1.46.0, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 2.4.0, < 4.0)
-    rubocop-ast (1.38.0)
-      parser (>= 3.3.1.0)
-    rubocop-md (1.2.4)
-      rubocop (>= 1.45)
-    rubocop-performance (1.23.1)
-      rubocop (>= 1.48.1, < 2.0)
-      rubocop-ast (>= 1.31.1, < 2.0)
-    rubocop-rspec (3.4.0)
-      rubocop (~> 1.61)
-    rubocop-sorbet (0.8.7)
-      rubocop (>= 1)
-    ruby-lsp (0.23.8)
+    rubocop-ast (1.46.0)
+      parser (>= 3.3.7.2)
+      prism (~> 1.4)
+    rubocop-md (2.0.2)
+      lint_roller (~> 1.1)
+      rubocop (>= 1.72.1)
+    rubocop-performance (1.26.0)
+      lint_roller (~> 1.1)
+      rubocop (>= 1.75.0, < 2.0)
+      rubocop-ast (>= 1.44.0, < 2.0)
+    rubocop-rspec (3.7.0)
+      lint_roller (~> 1.1)
+      rubocop (~> 1.72, >= 1.72.1)
+    rubocop-sorbet (0.10.5)
+      lint_roller
+      rubocop (>= 1.75.2)
+    ruby-lsp (0.26.1)
       language_server-protocol (~> 3.17.0)
       prism (>= 1.2, < 2.0)
-      rbs (>= 3, < 4)
-      sorbet-runtime (>= 0.5.10782)
+      rbs (>= 3, < 5)
     ruby-macho (4.1.0)
-    ruby-prof (1.7.1)
+    ruby-prof (1.7.2)
+      base64
     ruby-progressbar (1.13.0)
     simplecov (0.22.0)
       docile (~> 1.1)
       simplecov-html (~> 0.11)
       simplecov_json_formatter (~> 0.1)
-    simplecov-cobertura (2.1.0)
+    simplecov-cobertura (3.1.0)
       rexml
       simplecov (~> 0.19)
-    simplecov-html (0.13.1)
+    simplecov-html (0.13.2)
     simplecov_json_formatter (0.1.4)
     simpleidn (0.2.3)
-    sorbet (0.5.11796)
-      sorbet-static (= 0.5.11796)
-    sorbet-runtime (0.5.11796)
-    sorbet-static (0.5.11796-aarch64-linux)
-    sorbet-static (0.5.11796-universal-darwin)
-    sorbet-static (0.5.11796-x86_64-linux)
-    sorbet-static-and-runtime (0.5.11796)
-      sorbet (= 0.5.11796)
-      sorbet-runtime (= 0.5.11796)
-    spoom (1.5.3)
+    sorbet (0.6.12521)
+      sorbet-static (= 0.6.12521)
+    sorbet-runtime (0.6.12521)
+    sorbet-static (0.6.12521-aarch64-linux)
+    sorbet-static (0.6.12521-universal-darwin)
+    sorbet-static (0.6.12521-x86_64-linux)
+    sorbet-static-and-runtime (0.6.12521)
+      sorbet (= 0.6.12521)
+      sorbet-runtime (= 0.6.12521)
+    spoom (1.7.6)
       erubi (>= 1.10.0)
       prism (>= 0.28.0)
-      rbi (>= 0.2.3)
+      rbi (>= 0.3.3)
+      rbs (>= 4.0.0.dev.4)
+      rexml (>= 3.2.6)
       sorbet-static-and-runtime (>= 0.5.10187)
       thor (>= 0.19.2)
     stackprof (0.2.27)
-    tapioca (0.16.8)
+    tapioca (0.17.7)
       benchmark
       bundler (>= 2.2.25)
       netrc (>= 0.11.0)
       parallel (>= 1.21.0)
-      rbi (~> 0.2)
+      rbi (>= 0.3.1)
+      require-hooks (>= 0.2.2)
       sorbet-static-and-runtime (>= 0.5.11087)
-      spoom (>= 1.2.0)
+      spoom (>= 1.7.0)
       thor (>= 1.2.0)
       yard-sorbet
-    thor (1.3.2)
-    unicode-display_width (3.1.4)
-      unicode-emoji (~> 4.0, >= 4.0.4)
-    unicode-emoji (4.0.4)
-    vernier (1.5.0)
+    thor (1.4.0)
+    unicode-display_width (3.2.0)
+      unicode-emoji (~> 4.1)
+    unicode-emoji (4.1.0)
+    vernier (1.8.0)
     warning (1.5.0)
     yard (0.9.37)
     yard-sorbet (0.9.0)
@@ -161,6 +175,7 @@ DEPENDENCIES
   addressable
   base64
   concurrent-ruby
+  csv
   json_schemer
   kramdown
   method_source
@@ -169,6 +184,7 @@ DEPENDENCIES
   patchelf
   plist
   pry
+  pycall
   redcarpet
   rexml
   rspec
@@ -201,7 +217,7 @@ DEPENDENCIES
   yard-sorbet
 
 RUBY VERSION
-   ruby 3.3.7p123
+   ruby 3.4.5p51
 
 BUNDLED WITH
-   2.5.20
+   2.6.8

Library/Homebrew/PATH.rb

@@ -15,7 +15,6 @@ class PATH
   Element = T.type_alias { T.nilable(T.any(Pathname, String, PATH)) }
   private_constant :Element
   Elements = T.type_alias { T.any(Element, T::Array[Element]) }
-  private_constant :Elements
   sig { params(paths: Elements).void }
   def initialize(*paths)
     @paths = T.let(parse(paths), T::Array[String])
@@ -39,12 +38,12 @@ class PATH
     self
   end
 
-  sig { params(block: T.proc.params(arg0: String).returns(T::Boolean)).returns(T.self_type) }
+  sig { params(block: T.proc.params(arg0: String).returns(BasicObject)).returns(T.self_type) }
   def select(&block)
     self.class.new(@paths.select(&block))
   end
 
-  sig { params(block: T.proc.params(arg0: String).returns(T::Boolean)).returns(T.self_type) }
+  sig { params(block: T.proc.params(arg0: String).returns(BasicObject)).returns(T.self_type) }
   def reject(&block)
     self.class.new(@paths.reject(&block))
   end

Library/Homebrew/abstract_command.rb

@@ -3,6 +3,7 @@
 
 require "cli/parser"
 require "shell_command"
+require "utils/output"
 
 module Homebrew
   # Subclass this to implement a `brew` command. This is preferred to declaring a named function in the `Homebrew`
@@ -19,6 +20,7 @@ module Homebrew
   # @api public
   class AbstractCommand
     extend T::Helpers
+    include Utils::Output::Mixin
 
     abstract!
 

Library/Homebrew/aliases/alias.rb

@@ -0,0 +1,120 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "fileutils"
+require "utils/output"
+
+module Homebrew
+  module Aliases
+    class Alias
+      include ::Utils::Output::Mixin
+
+      sig { returns(String) }
+      attr_accessor :name
+
+      sig { returns(T.nilable(String)) }
+      attr_accessor :command
+
+      sig { params(name: String, command: T.nilable(String)).void }
+      def initialize(name, command = nil)
+        @name = T.let(name.strip, String)
+        @command = T.let(nil, T.nilable(String))
+        @script = T.let(nil, T.nilable(Pathname))
+        @symlink = T.let(nil, T.nilable(Pathname))
+
+        @command = if command&.start_with?("!", "%")
+          command[1..]
+        elsif command
+          "brew #{command}"
+        end
+      end
+
+      sig { returns(T::Boolean) }
+      def reserved?
+        RESERVED.include? name
+      end
+
+      sig { returns(T::Boolean) }
+      def cmd_exists?
+        path = which("brew-#{name}.rb") || which("brew-#{name}")
+        !path.nil? && path.realpath.parent != HOMEBREW_ALIASES
+      end
+
+      sig { returns(Pathname) }
+      def script
+        @script ||= Pathname.new("#{HOMEBREW_ALIASES}/#{name.gsub(/\W/, "_")}")
+      end
+
+      sig { returns(Pathname) }
+      def symlink
+        @symlink ||= Pathname.new("#{HOMEBREW_PREFIX}/bin/brew-#{name}")
+      end
+
+      sig { returns(T::Boolean) }
+      def valid_symlink?
+        symlink.realpath.parent == HOMEBREW_ALIASES.realpath
+      rescue NameError
+        false
+      end
+
+      sig { void }
+      def link
+        FileUtils.rm symlink if File.symlink? symlink
+        FileUtils.ln_s script, symlink
+      end
+
+      sig { params(opts: T::Hash[Symbol, T::Boolean]).void }
+      def write(opts = {})
+        odie "'#{name}' is a reserved command. Sorry." if reserved?
+        odie "'brew #{name}' already exists. Sorry." if cmd_exists?
+
+        return if !opts[:override] && script.exist?
+
+        content = if command
+          <<~EOS
+            #:  * `#{name}` [args...]
+            #:    `brew #{name}` is an alias for `#{command}`
+            #{command} $*
+          EOS
+        else
+          <<~EOS
+            #:  * `#{name}` [args...]
+            #:    `brew #{name}` is an alias for *command*
+
+            # This is a Homebrew alias script. It'll be called when the user
+            # types `brew #{name}`. Any remaining arguments are passed to
+            # this script. You can retrieve those with $*, or only the first
+            # one with $1. Please keep your script on one line.
+
+            # TODO: Replace the line below with your script
+            echo "Hello I'm 'brew "#{name}"' and my args are:" $*
+          EOS
+        end
+
+        script.open("w") do |f|
+          f.write <<~EOS
+            #! #{`which bash`.chomp}
+            # alias: brew #{name}
+            #{content}
+          EOS
+        end
+        script.chmod 0744
+        link
+      end
+
+      sig { void }
+      def remove
+        odie "'brew #{name}' is not aliased to anything." if !symlink.exist? || !valid_symlink?
+
+        script.unlink
+        symlink.unlink
+      end
+
+      sig { void }
+      def edit
+        write(override: false)
+        exec_editor script.to_s
+      end
+    end
+  end
+end

Library/Homebrew/aliases/aliases.rb

@@ -0,0 +1,80 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "aliases/alias"
+require "utils/output"
+
+module Homebrew
+  module Aliases
+    extend Utils::Output::Mixin
+
+    RESERVED = T.let((
+        Commands.internal_commands +
+        Commands.internal_developer_commands +
+        Commands.internal_commands_aliases +
+        %w[alias unalias]
+      ).freeze, T::Array[String])
+
+    sig { void }
+    def self.init
+      FileUtils.mkdir_p HOMEBREW_ALIASES
+    end
+
+    sig { params(name: String, command: String).void }
+    def self.add(name, command)
+      new_alias = Alias.new(name, command)
+      odie "alias 'brew #{name}' already exists!" if new_alias.script.exist?
+      new_alias.write
+    end
+
+    sig { params(name: String).void }
+    def self.remove(name)
+      Alias.new(name).remove
+    end
+
+    sig { params(only: T::Array[String], block: T.proc.params(name: String, command: String).void).void }
+    def self.each(only, &block)
+      Dir["#{HOMEBREW_ALIASES}/*"].each do |path|
+        next if path.end_with? "~" # skip Emacs-like backup files
+        next if File.directory?(path)
+
+        _shebang, meta, *lines = File.readlines(path)
+        name = T.must(meta)[/alias: brew (\S+)/, 1] || File.basename(path)
+        next if !only.empty? && only.exclude?(name)
+
+        lines.reject! { |line| line.start_with?("#") || line =~ /^\s*$/ }
+        first_line = lines.fetch(0)
+        command = first_line.chomp
+        command.sub!(/ \$\*$/, "")
+
+        if command.start_with? "brew "
+          command.sub!(/^brew /, "")
+        else
+          command = "!#{command}"
+        end
+
+        yield name, command if block.present?
+      end
+    end
+
+    sig { params(aliases: String).void }
+    def self.show(*aliases)
+      each([*aliases]) do |name, command|
+        puts "brew alias #{name}='#{command}'"
+        existing_alias = Alias.new(name, command)
+        existing_alias.link unless existing_alias.symlink.exist?
+      end
+    end
+
+    sig { params(name: String, command: T.nilable(String)).void }
+    def self.edit(name, command = nil)
+      Alias.new(name, command).write unless command.nil?
+      Alias.new(name, command).edit
+    end
+
+    sig { void }
+    def self.edit_all
+      exec_editor(*Dir[HOMEBREW_ALIASES])
+    end
+  end
+end

Library/Homebrew/api.rb

@@ -1,20 +1,25 @@
-# typed: true # rubocop:todo Sorbet/StrictSigil
+# typed: strict
 # frozen_string_literal: true
 
 require "api/analytics"
 require "api/cask"
 require "api/formula"
-require "base64" # TODO: vendor this for Ruby 3.4.
+require "api/internal"
+require "base64"
+require "utils/output"
 
 module Homebrew
   # Helper functions for using Homebrew's formulae.brew.sh API.
   module API
+    extend Utils::Output::Mixin
+
     extend Cachable
 
-    HOMEBREW_CACHE_API = (HOMEBREW_CACHE/"api").freeze
-    HOMEBREW_CACHE_API_SOURCE = (HOMEBREW_CACHE/"api-source").freeze
+    HOMEBREW_CACHE_API = T.let((HOMEBREW_CACHE/"api").freeze, Pathname)
+    HOMEBREW_CACHE_API_SOURCE = T.let((HOMEBREW_CACHE/"api-source").freeze, Pathname)
+    DEFAULT_API_STALE_SECONDS = T.let(86400, Integer) # 1 day
 
-    sig { params(endpoint: String).returns(Hash) }
+    sig { params(endpoint: String).returns(T::Hash[String, T.untyped]) }
     def self.fetch(endpoint)
       return cache[endpoint] if cache.present? && cache.key?(endpoint)
 
@@ -25,18 +30,32 @@ module Homebrew
         api_url = "#{HOMEBREW_API_DEFAULT_DOMAIN}/#{endpoint}"
         output = Utils::Curl.curl_output("--fail", api_url)
       end
-      raise ArgumentError, "No file found at #{Tty.underline}#{api_url}#{Tty.reset}" unless output.success?
+      raise ArgumentError, "No file found at: #{Tty.underline}#{api_url}#{Tty.reset}" unless output.success?
 
       cache[endpoint] = JSON.parse(output.stdout, freeze: true)
     rescue JSON::ParserError
       raise ArgumentError, "Invalid JSON file: #{Tty.underline}#{api_url}#{Tty.reset}"
     end
 
+    sig { params(target: Pathname, stale_seconds: T.nilable(Integer)).returns(T::Boolean) }
+    def self.skip_download?(target:, stale_seconds:)
+      return true if Homebrew.running_as_root_but_not_owned_by_root?
+      return false if !target.exist? || target.empty?
+      return true unless stale_seconds
+
+      (Time.now - stale_seconds) < target.mtime
+    end
+
     sig {
-      params(endpoint: String, target: Pathname, stale_seconds: Integer).returns([T.any(Array, Hash), T::Boolean])
+      params(
+        endpoint:       String,
+        target:         Pathname,
+        stale_seconds:  T.nilable(Integer),
+        download_queue: T.nilable(DownloadQueue),
+      ).returns([T.any(T::Array[T.untyped], T::Hash[String, T.untyped]), T::Boolean])
     }
     def self.fetch_json_api_file(endpoint, target: HOMEBREW_CACHE_API/endpoint,
-                                 stale_seconds: Homebrew::EnvConfig.api_auto_update_secs.to_i)
+                                 stale_seconds: nil, download_queue: nil)
       # Lazy-load dependency.
       require "development_tools"
 
@@ -57,12 +76,16 @@ module Homebrew
 
       insecure_download = DevelopmentTools.ca_file_substitution_required? ||
                           DevelopmentTools.curl_substitution_required?
-      skip_download = target.exist? &&
-                      !target.empty? &&
-                      (!Homebrew.auto_update_command? ||
-                        (Homebrew::EnvConfig.no_auto_update? && !Homebrew::EnvConfig.force_api_auto_update?) ||
-                      ((Time.now - stale_seconds) < target.mtime))
-      skip_download ||= Homebrew.running_as_root_but_not_owned_by_root?
+      skip_download = skip_download?(target:, stale_seconds:)
+
+      if download_queue
+        unless skip_download
+          require "api/json_download"
+          download = Homebrew::API::JSONDownload.new(endpoint, target:, stale_seconds:)
+          download_queue.enqueue(download)
+        end
+        return [{}, false]
+      end
 
       json_data = begin
         begin
@@ -96,7 +119,8 @@ module Homebrew
 
         mtime = insecure_download ? Time.new(1970, 1, 1) : Time.now
         FileUtils.touch(target, mtime:) unless skip_download
-        JSON.parse(target.read, freeze: true)
+        # Can use `target.read` again when/if https://github.com/sorbet/sorbet/pull/8999 is merged/released.
+        JSON.parse(File.read(target, encoding: Encoding::UTF_8), freeze: true)
       rescue JSON::ParserError
         target.unlink
         retry_count += 1
@@ -122,24 +146,76 @@ module Homebrew
       end
     end
 
-    sig { params(json: Hash).returns(Hash) }
-    def self.merge_variations(json)
+    sig {
+      params(json:       T::Hash[String, T.untyped],
+             bottle_tag: ::Utils::Bottles::Tag).returns(T::Hash[String, T.untyped])
+    }
+    def self.merge_variations(json, bottle_tag: T.unsafe(nil))
       return json unless json.key?("variations")
 
-      bottle_tag = ::Utils::Bottles::Tag.new(system: Homebrew::SimulateSystem.current_os,
-                                             arch:   Homebrew::SimulateSystem.current_arch)
+      bottle_tag ||= Homebrew::SimulateSystem.current_tag
 
-      if (variation = json.dig("variations", bottle_tag.to_s).presence)
+      if (variation = json.dig("variations", bottle_tag.to_s).presence) ||
+         (variation = json.dig("variations", bottle_tag.to_sym).presence)
         json = json.merge(variation)
       end
 
       json.except("variations")
     end
 
+    sig { void }
+    def self.fetch_api_files!
+      download_queue = if Homebrew::EnvConfig.download_concurrency > 1
+        require "download_queue"
+        Homebrew::DownloadQueue.new
+      end
+
+      stale_seconds = if ENV["HOMEBREW_API_UPDATED"].present? ||
+                         (Homebrew::EnvConfig.no_auto_update? && !Homebrew::EnvConfig.force_api_auto_update?)
+        nil
+      elsif Homebrew.auto_update_command?
+        Homebrew::EnvConfig.api_auto_update_secs.to_i
+      else
+        DEFAULT_API_STALE_SECONDS
+      end
+
+      if Homebrew::EnvConfig.use_internal_api?
+        Homebrew::API::Internal.fetch_formula_api!(download_queue:, stale_seconds:)
+        Homebrew::API::Internal.fetch_cask_api!(download_queue:, stale_seconds:)
+      else
+        Homebrew::API::Formula.fetch_api!(download_queue:, stale_seconds:)
+        Homebrew::API::Formula.fetch_tap_migrations!(download_queue:, stale_seconds: DEFAULT_API_STALE_SECONDS)
+        Homebrew::API::Cask.fetch_api!(download_queue:, stale_seconds:)
+        Homebrew::API::Cask.fetch_tap_migrations!(download_queue:, stale_seconds: DEFAULT_API_STALE_SECONDS)
+      end
+
+      ENV["HOMEBREW_API_UPDATED"] = "1"
+
+      return unless download_queue
+
+      begin
+        download_queue.fetch
+      ensure
+        download_queue.shutdown
+      end
+    end
+
+    sig { void }
+    def self.write_names_and_aliases
+      if Homebrew::EnvConfig.use_internal_api?
+        Homebrew::API::Internal.write_formula_names_and_aliases
+        Homebrew::API::Internal.write_cask_names
+      else
+        Homebrew::API::Formula.write_names_and_aliases
+        Homebrew::API::Cask.write_names
+      end
+    end
+
     sig { params(names: T::Array[String], type: String, regenerate: T::Boolean).returns(T::Boolean) }
-    def self.write_names_file(names, type, regenerate:)
+    def self.write_names_file!(names, type, regenerate:)
       names_path = HOMEBREW_CACHE_API/"#{type}_names.txt"
       if !names_path.exist? || regenerate
+        names_path.unlink if names_path.exist?
         names_path.write(names.join("\n"))
         return true
       end
@@ -147,7 +223,25 @@ module Homebrew
       false
     end
 
-    sig { params(json_data: Hash).returns([T::Boolean, T.any(String, Array, Hash)]) }
+    sig { params(aliases: T::Hash[String, String], type: String, regenerate: T::Boolean).returns(T::Boolean) }
+    def self.write_aliases_file!(aliases, type, regenerate:)
+      aliases_path = HOMEBREW_CACHE_API/"#{type}_aliases.txt"
+      if !aliases_path.exist? || regenerate
+        aliases_text = aliases.map do |alias_name, real_name|
+          "#{alias_name}|#{real_name}"
+        end
+        aliases_path.unlink if aliases_path.exist?
+        aliases_path.write(aliases_text.join("\n"))
+        return true
+      end
+
+      false
+    end
+
+    sig {
+      params(json_data: T::Hash[String, T.untyped])
+        .returns([T::Boolean, T.any(String, T::Array[T.untyped], T::Hash[String, T.untyped])])
+    }
     private_class_method def self.verify_and_parse_jws(json_data)
       signatures = json_data["signatures"]
       homebrew_signature = signatures&.find { |sig| sig.dig("header", "kid") == "homebrew-1" }
@@ -185,9 +279,67 @@ module Homebrew
       Tap.fetch(org, repo)
     end
 
-    sig { returns(T::Boolean) }
-    def self.internal_json_v3?
-      ENV["HOMEBREW_INTERNAL_JSON_V3"].present?
+    sig { returns(T::Array[String]) }
+    def self.formula_names
+      if Homebrew::EnvConfig.use_internal_api?
+        Homebrew::API::Internal.formula_arrays.keys
+      else
+        Homebrew::API::Formula.all_formulae.keys
+      end
+    end
+
+    sig { returns(T::Hash[String, String]) }
+    def self.formula_aliases
+      if Homebrew::EnvConfig.use_internal_api?
+        Homebrew::API::Internal.formula_aliases
+      else
+        Homebrew::API::Formula.all_aliases
+      end
+    end
+
+    sig { returns(T::Hash[String, String]) }
+    def self.formula_renames
+      if Homebrew::EnvConfig.use_internal_api?
+        Homebrew::API::Internal.formula_renames
+      else
+        Homebrew::API::Formula.all_renames
+      end
+    end
+
+    sig { returns(T::Hash[String, String]) }
+    def self.formula_tap_migrations
+      if Homebrew::EnvConfig.use_internal_api?
+        Homebrew::API::Internal.formula_tap_migrations
+      else
+        Homebrew::API::Formula.tap_migrations
+      end
+    end
+
+    sig { returns(T::Array[String]) }
+    def self.cask_tokens
+      if Homebrew::EnvConfig.use_internal_api?
+        Homebrew::API::Internal.cask_hashes.keys
+      else
+        Homebrew::API::Cask.all_casks.keys
+      end
+    end
+
+    sig { returns(T::Hash[String, String]) }
+    def self.cask_renames
+      if Homebrew::EnvConfig.use_internal_api?
+        Homebrew::API::Internal.cask_renames
+      else
+        Homebrew::API::Cask.all_renames
+      end
+    end
+
+    sig { returns(T::Hash[String, String]) }
+    def self.cask_tap_migrations
+      if Homebrew::EnvConfig.use_internal_api?
+        Homebrew::API::Internal.cask_tap_migrations
+      else
+        Homebrew::API::Cask.tap_migrations
+      end
     end
   end
 

Library/Homebrew/api/analytics.rb

@@ -10,7 +10,6 @@ module Homebrew
         def analytics_api_path
           "analytics"
         end
-        alias generic_analytics_api_path analytics_api_path
 
         sig { params(category: String, days: T.any(Integer, String)).returns(T::Hash[String, T.untyped]) }
         def fetch(category, days)

Library/Homebrew/api/cask.rb

@@ -1,8 +1,10 @@
-# typed: true # rubocop:todo Sorbet/StrictSigil
+# typed: strict
 # frozen_string_literal: true
 
-require "extend/cachable"
-require "api/download"
+require "cachable"
+require "api"
+require "api/source_download"
+require "download_queue"
 
 module Homebrew
   module API
@@ -14,20 +16,34 @@ module Homebrew
 
       private_class_method :cache
 
-      sig { params(token: String).returns(Hash) }
-      def self.fetch(token)
-        Homebrew::API.fetch "cask/#{token}.json"
+      sig { params(name: String).returns(T::Hash[String, T.untyped]) }
+      def self.cask_json(name)
+        fetch_cask_json! name if !cache.key?("cask_json") || !cache.fetch("cask_json").key?(name)
+
+        cache.fetch("cask_json").fetch(name)
       end
 
-      sig { params(cask: ::Cask::Cask).returns(::Cask::Cask) }
-      def self.source_download(cask)
-        path = cask.ruby_source_path.to_s || "Casks/#{cask.token}.rb"
+      sig { params(name: String, download_queue: T.nilable(DownloadQueue)).void }
+      def self.fetch_cask_json!(name, download_queue: nil)
+        endpoint = "cask/#{name}.json"
+        json_cask, updated = Homebrew::API.fetch_json_api_file endpoint, download_queue: download_queue
+        return if download_queue
+
+        json_cask = JSON.parse((HOMEBREW_CACHE_API/endpoint).read) unless updated
+
+        cache["cask_json"] ||= {}
+        cache["cask_json"][name] = json_cask
+      end
+
+      sig { params(cask: ::Cask::Cask, download_queue: T.nilable(Homebrew::DownloadQueue)).returns(Homebrew::API::SourceDownload) }
+      def self.source_download(cask, download_queue: nil)
+        path = cask.ruby_source_path.to_s
         sha256 = cask.ruby_source_checksum[:sha256]
         checksum = Checksum.new(sha256) if sha256
         git_head = cask.tap_git_head || "HEAD"
         tap = cask.tap&.full_name || "Homebrew/homebrew-cask"
 
-        download = Homebrew::API::Download.new(
+        download = Homebrew::API::SourceDownload.new(
           "https://raw.githubusercontent.com/#{tap}/#{git_head}/#{path}",
           checksum,
           mirrors: [
@@ -35,18 +51,48 @@ module Homebrew
           ],
           cache:   HOMEBREW_CACHE_API_SOURCE/"#{tap}/#{git_head}/Cask",
         )
-        download.fetch
+
+        if download_queue
+          download_queue.enqueue(download)
+        elsif !download.symlink_location.exist?
+          download.fetch
+        end
+
+        download
+      end
+
+      sig { params(cask: ::Cask::Cask).returns(::Cask::Cask) }
+      def self.source_download_cask(cask)
+        download = source_download(cask)
+
         ::Cask::CaskLoader::FromPathLoader.new(download.symlink_location)
                                           .load(config: cask.config)
       end
 
+      sig { returns(Pathname) }
       def self.cached_json_file_path
         HOMEBREW_CACHE_API/DEFAULT_API_FILENAME
       end
 
+      sig {
+        params(download_queue: T.nilable(::Homebrew::DownloadQueue), stale_seconds: T.nilable(Integer))
+          .returns([T.any(T::Array[T.untyped], T::Hash[String, T.untyped]), T::Boolean])
+      }
+      def self.fetch_api!(download_queue: nil, stale_seconds: nil)
+        Homebrew::API.fetch_json_api_file DEFAULT_API_FILENAME, stale_seconds:, download_queue:
+      end
+
+      sig {
+        params(download_queue: T.nilable(::Homebrew::DownloadQueue), stale_seconds: T.nilable(Integer))
+          .returns([T.any(T::Array[T.untyped], T::Hash[String, T.untyped]), T::Boolean])
+      }
+      def self.fetch_tap_migrations!(download_queue: nil, stale_seconds: nil)
+        Homebrew::API.fetch_json_api_file "cask_tap_migrations.jws.json", stale_seconds:, download_queue:
+      end
+
       sig { returns(T::Boolean) }
       def self.download_and_cache_data!
-        json_casks, updated = Homebrew::API.fetch_json_api_file DEFAULT_API_FILENAME
+        json_casks, updated = fetch_api!
 
         cache["renames"] = {}
         cache["casks"] = json_casks.to_h do |json_cask|
@@ -63,7 +109,7 @@ module Homebrew
       end
       private_class_method :download_and_cache_data!
 
-      sig { returns(T::Hash[String, Hash]) }
+      sig { returns(T::Hash[String, T::Hash[String, T.untyped]]) }
       def self.all_casks
         unless cache.key?("casks")
           json_updated = download_and_cache_data!
@@ -83,11 +129,21 @@ module Homebrew
         cache.fetch("renames")
       end
 
+      sig { returns(T::Hash[String, T.untyped]) }
+      def self.tap_migrations
+        unless cache.key?("tap_migrations")
+          json_migrations, = fetch_tap_migrations!
+          cache["tap_migrations"] = json_migrations
+        end
+
+        cache.fetch("tap_migrations")
+      end
+
       sig { params(regenerate: T::Boolean).void }
       def self.write_names(regenerate: false)
         download_and_cache_data! unless cache.key?("casks")
 
-        Homebrew::API.write_names_file(all_casks.keys, "cask", regenerate:)
+        Homebrew::API.write_names_file!(all_casks.keys, "cask", regenerate:)
       end
     end
   end

Library/Homebrew/api/formula.rb

@@ -1,8 +1,10 @@
 # typed: strict
 # frozen_string_literal: true
 
-require "extend/cachable"
-require "api/download"
+require "cachable"
+require "api"
+require "api/source_download"
+require "download_queue"
 
 module Homebrew
   module API
@@ -11,29 +13,54 @@ module Homebrew
       extend Cachable
 
       DEFAULT_API_FILENAME = "formula.jws.json"
-      INTERNAL_V3_API_FILENAME = "internal/v3/homebrew-core.jws.json"
 
       private_class_method :cache
 
       sig { params(name: String).returns(T::Hash[String, T.untyped]) }
-      def self.fetch(name)
-        Homebrew::API.fetch "formula/#{name}.json"
+      def self.formula_json(name)
+        fetch_formula_json! name if !cache.key?("formula_json") || !cache.fetch("formula_json").key?(name)
+
+        cache.fetch("formula_json").fetch(name)
       end
 
-      sig { params(formula: ::Formula).returns(::Formula) }
-      def self.source_download(formula)
+      sig { params(name: String, download_queue: T.nilable(DownloadQueue)).void }
+      def self.fetch_formula_json!(name, download_queue: nil)
+        endpoint = "formula/#{name}.json"
+        json_formula, updated = Homebrew::API.fetch_json_api_file endpoint, download_queue: download_queue
+        return if download_queue
+
+        json_formula = JSON.parse((HOMEBREW_CACHE_API/endpoint).read) unless updated
+
+        cache["formula_json"] ||= {}
+        cache["formula_json"][name] = json_formula
+      end
+
+      sig { params(formula: ::Formula, download_queue: T.nilable(Homebrew::DownloadQueue)).returns(Homebrew::API::SourceDownload) }
+      def self.source_download(formula, download_queue: nil)
         path = formula.ruby_source_path || "Formula/#{formula.name}.rb"
         git_head = formula.tap_git_head || "HEAD"
         tap = formula.tap&.full_name || "Homebrew/homebrew-core"
 
-        download = Homebrew::API::Download.new(
+        download = Homebrew::API::SourceDownload.new(
           "https://raw.githubusercontent.com/#{tap}/#{git_head}/#{path}",
           formula.ruby_source_checksum,
           cache: HOMEBREW_CACHE_API_SOURCE/"#{tap}/#{git_head}/Formula",
         )
-        download.fetch
 
-        with_env(HOMEBREW_FORBID_PACKAGES_FROM_PATHS: nil) do
+        if download_queue
+          download_queue.enqueue(download)
+        elsif !download.symlink_location.exist?
+          download.fetch
+        end
+
+        download
+      end
+
+      sig { params(formula: ::Formula).returns(::Formula) }
+      def self.source_download_formula(formula)
+        download = source_download(formula)
+
+        with_env(HOMEBREW_INTERNAL_ALLOW_PACKAGES_FROM_PATHS: "1") do
           Formulary.factory(download.symlink_location,
                             formula.active_spec_sym,
                             alias_path: formula.alias_path,
@@ -43,33 +70,40 @@ module Homebrew
 
       sig { returns(Pathname) }
       def self.cached_json_file_path
-        if Homebrew::API.internal_json_v3?
-          HOMEBREW_CACHE_API/INTERNAL_V3_API_FILENAME
-        else
-          HOMEBREW_CACHE_API/DEFAULT_API_FILENAME
-        end
+        HOMEBREW_CACHE_API/DEFAULT_API_FILENAME
+      end
+
+      sig {
+        params(download_queue: T.nilable(Homebrew::DownloadQueue), stale_seconds: T.nilable(Integer))
+          .returns([T.any(T::Array[T.untyped], T::Hash[String, T.untyped]), T::Boolean])
+      }
+      def self.fetch_api!(download_queue: nil, stale_seconds: nil)
+        Homebrew::API.fetch_json_api_file DEFAULT_API_FILENAME, stale_seconds:, download_queue:
+      end
+
+      sig {
+        params(download_queue: T.nilable(Homebrew::DownloadQueue), stale_seconds: T.nilable(Integer))
+          .returns([T.any(T::Array[T.untyped], T::Hash[String, T.untyped]), T::Boolean])
+      }
+      def self.fetch_tap_migrations!(download_queue: nil, stale_seconds: nil)
+        Homebrew::API.fetch_json_api_file "formula_tap_migrations.jws.json", stale_seconds:, download_queue:
       end
 
       sig { returns(T::Boolean) }
       def self.download_and_cache_data!
-        if Homebrew::API.internal_json_v3?
-          json_formulae, updated = Homebrew::API.fetch_json_api_file INTERNAL_V3_API_FILENAME
-          overwrite_cache! T.cast(json_formulae, T::Hash[String, T.untyped])
-        else
-          json_formulae, updated = Homebrew::API.fetch_json_api_file DEFAULT_API_FILENAME
+        json_formulae, updated = fetch_api!
 
-          cache["aliases"] = {}
-          cache["renames"] = {}
-          cache["formulae"] = json_formulae.to_h do |json_formula|
-            json_formula["aliases"].each do |alias_name|
-              cache["aliases"][alias_name] = json_formula["name"]
-            end
-            (json_formula["oldnames"] || [json_formula["oldname"]].compact).each do |oldname|
-              cache["renames"][oldname] = json_formula["name"]
-            end
-
-            [json_formula["name"], json_formula.except("name")]
+        cache["aliases"] = {}
+        cache["renames"] = {}
+        cache["formulae"] = json_formulae.to_h do |json_formula|
+          json_formula["aliases"].each do |alias_name|
+            cache["aliases"][alias_name] = json_formula["name"]
           end
+          (json_formula["oldnames"] || [json_formula["oldname"]].compact).each do |oldname|
+            cache["renames"][oldname] = json_formula["name"]
+          end
+
+          [json_formula["name"], json_formula.except("name")]
         end
 
         updated
@@ -83,7 +117,7 @@ module Homebrew
           write_names_and_aliases(regenerate: json_updated)
         end
 
-        cache["formulae"]
+        cache.fetch("formulae")
       end
 
       sig { returns(T::Hash[String, String]) }
@@ -93,7 +127,7 @@ module Homebrew
           write_names_and_aliases(regenerate: json_updated)
         end
 
-        cache["aliases"]
+        cache.fetch("aliases")
       end
 
       sig { returns(T::Hash[String, String]) }
@@ -103,42 +137,25 @@ module Homebrew
           write_names_and_aliases(regenerate: json_updated)
         end
 
-        cache["renames"]
+        cache.fetch("renames")
       end
 
       sig { returns(T::Hash[String, T.untyped]) }
       def self.tap_migrations
-        # Not sure that we need to reload here.
         unless cache.key?("tap_migrations")
-          json_updated = download_and_cache_data!
-          write_names_and_aliases(regenerate: json_updated)
+          json_migrations, = fetch_tap_migrations!
+          cache["tap_migrations"] = json_migrations
         end
 
-        cache["tap_migrations"]
-      end
-
-      sig { returns(String) }
-      def self.tap_git_head
-        # Note sure we need to reload here.
-        unless cache.key?("tap_git_head")
-          json_updated = download_and_cache_data!
-          write_names_and_aliases(regenerate: json_updated)
-        end
-
-        cache["tap_git_head"]
+        cache.fetch("tap_migrations")
       end
 
       sig { params(regenerate: T::Boolean).void }
       def self.write_names_and_aliases(regenerate: false)
         download_and_cache_data! unless cache.key?("formulae")
 
-        return unless Homebrew::API.write_names_file(all_formulae.keys, "formula", regenerate:)
-
-        (HOMEBREW_CACHE_API/"formula_aliases.txt").open("w") do |file|
-          all_aliases.each do |alias_name, real_name|
-            file.puts "#{alias_name}|#{real_name}"
-          end
-        end
+        Homebrew::API.write_names_file!(all_formulae.keys, "formula", regenerate:)
+        Homebrew::API.write_aliases_file!(all_aliases, "formula", regenerate:)
       end
     end
   end

Library/Homebrew/api/internal.rb

@@ -0,0 +1,187 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "cachable"
+require "api"
+require "api/source_download"
+require "download_queue"
+require "formula_stub"
+
+module Homebrew
+  module API
+    # Helper functions for using the JSON internal API.
+    module Internal
+      extend Cachable
+
+      private_class_method :cache
+
+      sig { returns(String) }
+      def self.formula_endpoint
+        "internal/formula.#{SimulateSystem.current_tag}.jws.json"
+      end
+
+      sig { returns(String) }
+      def self.cask_endpoint
+        "internal/cask.#{SimulateSystem.current_tag}.jws.json"
+      end
+
+      sig { params(name: String).returns(Homebrew::FormulaStub) }
+      def self.formula_stub(name)
+        return cache["formula_stubs"][name] if cache.key?("formula_stubs") && cache["formula_stubs"].key?(name)
+
+        stub_array = formula_arrays[name]
+        raise "No formula stub found for #{name}" unless stub_array
+
+        aliases = formula_aliases.filter_map do |alias_name, original_name|
+          alias_name if original_name == name
+        end
+
+        oldnames = formula_renames.filter_map do |oldname, newname|
+          oldname if newname == name
+        end
+
+        stub = Homebrew::FormulaStub.new(
+          name:        name,
+          pkg_version: PkgVersion.parse(stub_array[0]),
+          rebuild:     stub_array[1],
+          sha256:      stub_array[2],
+          aliases:,
+          oldnames:,
+        )
+
+        cache["formula_stubs"] ||= {}
+        cache["formula_stubs"][name] = stub
+
+        stub
+      end
+
+      sig {
+        params(download_queue: T.nilable(Homebrew::DownloadQueue), stale_seconds: T.nilable(Integer))
+          .returns([T::Hash[String, T.untyped], T::Boolean])
+      }
+      def self.fetch_formula_api!(download_queue: nil, stale_seconds: nil)
+        json_contents, updated = Homebrew::API.fetch_json_api_file(formula_endpoint, stale_seconds:, download_queue:)
+        [T.cast(json_contents, T::Hash[String, T.untyped]), updated]
+      end
+
+      sig {
+        params(download_queue: T.nilable(Homebrew::DownloadQueue), stale_seconds: T.nilable(Integer))
+          .returns([T::Hash[String, T.untyped], T::Boolean])
+      }
+      def self.fetch_cask_api!(download_queue: nil, stale_seconds: nil)
+        json_contents, updated = Homebrew::API.fetch_json_api_file(cask_endpoint, stale_seconds:, download_queue:)
+        [T.cast(json_contents, T::Hash[String, T.untyped]), updated]
+      end
+
+      sig { returns(T::Boolean) }
+      def self.download_and_cache_formula_data!
+        json_contents, updated = fetch_formula_api!
+        cache["formula_stubs"] = {}
+        cache["formula_aliases"] = json_contents["aliases"]
+        cache["formula_renames"] = json_contents["renames"]
+        cache["formula_tap_migrations"] = json_contents["tap_migrations"]
+        cache["formula_arrays"] = json_contents["formulae"]
+
+        updated
+      end
+      private_class_method :download_and_cache_formula_data!
+
+      sig { returns(T::Boolean) }
+      def self.download_and_cache_cask_data!
+        json_contents, updated = fetch_cask_api!
+        cache["cask_stubs"] = {}
+        cache["cask_renames"] = json_contents["renames"]
+        cache["cask_tap_migrations"] = json_contents["tap_migrations"]
+        cache["cask_hashes"] = json_contents["casks"]
+
+        updated
+      end
+      private_class_method :download_and_cache_cask_data!
+
+      sig { params(regenerate: T::Boolean).void }
+      def self.write_formula_names_and_aliases(regenerate: false)
+        download_and_cache_formula_data! unless cache.key?("formula_arrays")
+
+        Homebrew::API.write_names_file!(formula_arrays.keys, "formula", regenerate:)
+        Homebrew::API.write_aliases_file!(formula_aliases, "formula", regenerate:)
+      end
+
+      sig { params(regenerate: T::Boolean).void }
+      def self.write_cask_names(regenerate: false)
+        download_and_cache_cask_data! unless cache.key?("cask_hashes")
+
+        Homebrew::API.write_names_file!(cask_hashes.keys, "cask", regenerate:)
+      end
+
+      sig { returns(T::Hash[String, [String, Integer, T.nilable(String)]]) }
+      def self.formula_arrays
+        unless cache.key?("formula_arrays")
+          updated = download_and_cache_formula_data!
+          write_formula_names_and_aliases(regenerate: updated)
+        end
+
+        cache["formula_arrays"]
+      end
+
+      sig { returns(T::Hash[String, String]) }
+      def self.formula_aliases
+        unless cache.key?("formula_aliases")
+          updated = download_and_cache_formula_data!
+          write_formula_names_and_aliases(regenerate: updated)
+        end
+
+        cache["formula_aliases"]
+      end
+
+      sig { returns(T::Hash[String, String]) }
+      def self.formula_renames
+        unless cache.key?("formula_renames")
+          updated = download_and_cache_formula_data!
+          write_formula_names_and_aliases(regenerate: updated)
+        end
+
+        cache["formula_renames"]
+      end
+
+      sig { returns(T::Hash[String, String]) }
+      def self.formula_tap_migrations
+        unless cache.key?("formula_tap_migrations")
+          updated = download_and_cache_formula_data!
+          write_formula_names_and_aliases(regenerate: updated)
+        end
+
+        cache["formula_tap_migrations"]
+      end
+
+      sig { returns(T::Hash[String, T::Hash[String, T.untyped]]) }
+      def self.cask_hashes
+        unless cache.key?("cask_hashes")
+          updated = download_and_cache_cask_data!
+          write_cask_names(regenerate: updated)
+        end
+
+        cache["cask_hashes"]
+      end
+
+      sig { returns(T::Hash[String, String]) }
+      def self.cask_renames
+        unless cache.key?("cask_renames")
+          updated = download_and_cache_cask_data!
+          write_cask_names(regenerate: updated)
+        end
+
+        cache["cask_renames"]
+      end
+
+      sig { returns(T::Hash[String, String]) }
+      def self.cask_tap_migrations
+        unless cache.key?("cask_tap_migrations")
+          updated = download_and_cache_cask_data!
+          write_cask_names(regenerate: updated)
+        end
+
+        cache["cask_tap_migrations"]
+      end
+    end
+  end
+end

Library/Homebrew/api/json_download.rb

@@ -0,0 +1,50 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "downloadable"
+
+module Homebrew
+  module API
+    class JSONDownloadStrategy < AbstractDownloadStrategy
+      sig { params(url: String, name: String, version: T.any(NilClass, String, Version), meta: T.untyped).void }
+      def initialize(url, name, version, **meta)
+        super
+        @target = T.let(meta.fetch(:target), Pathname)
+        @stale_seconds = T.let(meta[:stale_seconds], T.nilable(Integer))
+      end
+
+      sig { override.params(timeout: T.nilable(T.any(Integer, Float))).returns(Pathname) }
+      def fetch(timeout: nil)
+        with_context quiet: quiet? do
+          Homebrew::API.fetch_json_api_file(url, target: cached_location, stale_seconds: meta[:stale_seconds])
+        end
+        cached_location
+      end
+
+      sig { override.returns(Pathname) }
+      def cached_location
+        meta.fetch(:target)
+      end
+    end
+
+    class JSONDownload
+      include Downloadable
+
+      sig { params(url: String, target: Pathname, stale_seconds: T.nilable(Integer)).void }
+      def initialize(url, target:, stale_seconds:)
+        super()
+        @url = T.let(URL.new(url, using: API::JSONDownloadStrategy, target:, stale_seconds:), URL)
+        @target = target
+        @stale_seconds = stale_seconds
+      end
+
+      sig { override.returns(API::JSONDownloadStrategy) }
+      def downloader
+        T.cast(super, API::JSONDownloadStrategy)
+      end
+
+      sig { override.returns(String) }
+      def download_queue_type = "JSON API"
+    end
+  end
+end

Library/Homebrew/api/source_download.rb

@@ -5,14 +5,14 @@ require "downloadable"
 
 module Homebrew
   module API
-    class DownloadStrategy < CurlDownloadStrategy
+    class SourceDownloadStrategy < CurlDownloadStrategy
       sig { override.returns(Pathname) }
       def symlink_location
         cache/name
       end
     end
 
-    class Download
+    class SourceDownload
       include Downloadable
 
       sig {
@@ -25,26 +25,19 @@ module Homebrew
       }
       def initialize(url, checksum, mirrors: [], cache: nil)
         super()
-        @url = T.let(URL.new(url, using: API::DownloadStrategy), URL)
+        @url = T.let(URL.new(url, using: API::SourceDownloadStrategy), URL)
         @checksum = checksum
         @mirrors = mirrors
         @cache = cache
       end
 
-      sig { override.returns(API::DownloadStrategy) }
+      sig { override.returns(API::SourceDownloadStrategy) }
       def downloader
-        T.cast(super, API::DownloadStrategy)
+        T.cast(super, API::SourceDownloadStrategy)
       end
 
       sig { override.returns(String) }
-      def name
-        download_name
-      end
-
-      sig { override.returns(String) }
-      def download_type
-        "API source"
-      end
+      def download_queue_type = "API Source"
 
       sig { override.returns(Pathname) }
       def cache

Library/Homebrew/api_hashable.rb

@@ -1,22 +1,26 @@
-# typed: true # rubocop:todo Sorbet/StrictSigil
+# typed: strict
 # frozen_string_literal: true
 
 # Used to substitute common paths with generic placeholders when generating JSON for the API.
 module APIHashable
+  sig { void }
   def generating_hash!
     return if generating_hash?
 
     # Apply monkeypatches for API generation
-    @old_homebrew_prefix = HOMEBREW_PREFIX
-    @old_homebrew_cellar = HOMEBREW_CELLAR
-    @old_home = Dir.home
+    @old_homebrew_prefix = T.let(HOMEBREW_PREFIX, T.nilable(Pathname))
+    @old_homebrew_cellar = T.let(HOMEBREW_CELLAR, T.nilable(Pathname))
+    @old_home = T.let(Dir.home, T.nilable(String))
+    @old_git_config_global = T.let(ENV.fetch("GIT_CONFIG_GLOBAL", nil), T.nilable(String))
     Object.send(:remove_const, :HOMEBREW_PREFIX)
     Object.const_set(:HOMEBREW_PREFIX, Pathname.new(HOMEBREW_PREFIX_PLACEHOLDER))
     ENV["HOME"] = HOMEBREW_HOME_PLACEHOLDER
+    ENV["GIT_CONFIG_GLOBAL"] = File.join(@old_home, ".gitconfig")
 
-    @generating_hash = true
+    @generating_hash = T.let(true, T.nilable(T::Boolean))
   end
 
+  sig { void }
   def generated_hash!
     return unless generating_hash?
 
@@ -24,10 +28,12 @@ module APIHashable
     Object.send(:remove_const, :HOMEBREW_PREFIX)
     Object.const_set(:HOMEBREW_PREFIX, @old_homebrew_prefix)
     ENV["HOME"] = @old_home
+    ENV["GIT_CONFIG_GLOBAL"] = @old_git_config_global
 
     @generating_hash = false
   end
 
+  sig { returns(T::Boolean) }
   def generating_hash?
     @generating_hash ||= false
     @generating_hash == true

Library/Homebrew/ast_constants.rb

@@ -17,7 +17,8 @@ FORMULA_COMPONENT_PRECEDENCE_LIST = T.let([
   [{ name: :head,      type: :method_call }],
   [{ name: :stable,    type: :block_call }],
   [{ name: :livecheck, type: :block_call }],
-  [{ name: :bottle,    type: :block_call }],
+  [{ name: :no_autobump!, type: :method_call }],
+  [{ name: :bottle, type: :block_call }],
   [{ name: :pour_bottle?, type: :block_call }],
   [{ name: :head,      type: :block_call }],
   [{ name: :bottle,    type: :method_call }],
@@ -51,4 +52,4 @@ FORMULA_COMPONENT_PRECEDENCE_LIST = T.let([
   [{ name: :caveats, type: :method_definition }],
   [{ name: :plist_options, type: :method_call }, { name: :plist, type: :method_definition }],
   [{ name: :test, type: :block_call }],
-].freeze, T::Array[[{ name: Symbol, type: Symbol }]])
+].freeze, T::Array[T::Array[{ name: Symbol, type: Symbol }]])

Library/Homebrew/attestation.rb

@@ -7,10 +7,12 @@ require "utils/popen"
 require "utils/github/api"
 require "exceptions"
 require "system_command"
+require "utils/output"
 
 module Homebrew
   module Attestation
     extend SystemCommand::Mixin
+    extend Utils::Output::Mixin
 
     # @api private
     HOMEBREW_CORE_REPO = "Homebrew/homebrew-core"
@@ -64,12 +66,8 @@ module Homebrew
     sig { returns(T::Boolean) }
     def self.enabled?
       return false if Homebrew::EnvConfig.no_verify_attestations?
-      return true if Homebrew::EnvConfig.verify_attestations?
-      return false if ENV.fetch("CI", false)
-      return false if OS.unsupported_configuration?
 
-      # Always check credentials last to avoid unnecessary credential extraction.
-      (Homebrew::EnvConfig.developer? || Homebrew::EnvConfig.devcmdrun?) && GitHub::API.credentials.present?
+      Homebrew::EnvConfig.verify_attestations?
     end
 
     # Returns a path to a suitable `gh` executable for attestation verification.
@@ -226,7 +224,7 @@ module Homebrew
         attestation = check_attestation bottle, HOMEBREW_CORE_REPO
         return attestation
       rescue MissingAttestationError
-        odebug "falling back on backfilled attestation for #{bottle}"
+        odebug "falling back on backfilled attestation for #{bottle.filename}"
 
         # Our backfilled attestation is a little unique: the subject is not just the bottle
         # filename, but also has the bottle's hosted URL hash prepended to it.

Library/Homebrew/attrable.rb

@@ -1,30 +0,0 @@
-# typed: strict
-# frozen_string_literal: true
-
-# This module provides methods to define specialized attributes.
-# Method stubs are generated by the {Tapioca::Compilers::Attrables} compiler.
-# @note The compiler is fragile, and must be updated if the filename changes, if methods are added or removed,
-#   or if a method's arity changes.
-module Attrable
-  extend T::Helpers
-
-  requires_ancestor { Module }
-
-  sig { params(attrs: Symbol).void }
-  def attr_predicate(*attrs)
-    attrs.each do |attr|
-      define_method attr do
-        instance_variable_get("@#{attr.to_s.sub(/\?$/, "")}") == true
-      end
-    end
-  end
-
-  sig { params(attrs: Symbol).void }
-  def attr_rw(*attrs)
-    attrs.each do |attr|
-      define_method attr do |val = nil|
-        val.nil? ? instance_variable_get(:"@#{attr}") : instance_variable_set(:"@#{attr}", val)
-      end
-    end
-  end
-end

Library/Homebrew/autobump_constants.rb

@@ -0,0 +1,15 @@
+# typed: strict
+# frozen_string_literal: true
+
+NO_AUTOBUMP_REASONS_INTERNAL = T.let({
+  extract_plist:  "livecheck uses `:extract_plist` strategy",
+  latest_version: "`version` is set to `:latest`",
+}.freeze, T::Hash[Symbol, String])
+
+# The valid symbols for passing to `no_autobump!` in a `Formula` or `Cask`.
+# @api public
+NO_AUTOBUMP_REASONS_LIST = T.let({
+  incompatible_version_format: "the package has a version format that can only be updated manually",
+  bumped_by_upstream:          "updates to the package are handled by the upstream developers",
+  requires_manual_review:      "a manual review of this package is required for inclusion in autobump",
+}.merge(NO_AUTOBUMP_REASONS_INTERNAL).freeze, T::Hash[Symbol, String])

Library/Homebrew/bottle.rb

@@ -0,0 +1,225 @@
+# typed: true # rubocop:todo Sorbet/StrictSigil
+# frozen_string_literal: true
+
+class Bottle
+  include Downloadable
+
+  class Filename
+    attr_reader :name, :version, :tag, :rebuild
+
+    sig { params(formula: Formula, tag: Utils::Bottles::Tag, rebuild: Integer).returns(T.attached_class) }
+    def self.create(formula, tag, rebuild)
+      new(formula.name, formula.pkg_version, tag, rebuild)
+    end
+
+    sig { params(name: String, version: PkgVersion, tag: Utils::Bottles::Tag, rebuild: Integer).void }
+    def initialize(name, version, tag, rebuild)
+      @name = File.basename name
+
+      raise ArgumentError, "Invalid bottle name" unless Utils.safe_filename?(@name)
+      raise ArgumentError, "Invalid bottle version" unless Utils.safe_filename?(version.to_s)
+
+      @version = version
+      @tag = tag.to_unstandardized_sym.to_s
+      @rebuild = rebuild
+    end
+
+    sig { returns(String) }
+    def to_str
+      "#{name}--#{version}#{extname}"
+    end
+
+    sig { returns(String) }
+    def to_s = to_str
+
+    sig { returns(String) }
+    def json
+      "#{name}--#{version}.#{tag}.bottle.json"
+    end
+
+    def url_encode
+      ERB::Util.url_encode("#{name}-#{version}#{extname}")
+    end
+
+    def github_packages
+      "#{name}--#{version}#{extname}"
+    end
+
+    sig { returns(String) }
+    def extname
+      s = rebuild.positive? ? ".#{rebuild}" : ""
+      ".#{tag}.bottle#{s}.tar.gz"
+    end
+  end
+
+  extend Forwardable
+
+  attr_reader :name, :resource, :tag, :cellar, :rebuild
+
+  def_delegators :resource, :url, :verify_download_integrity
+  def_delegators :resource, :cached_download, :downloader
+
+  def initialize(formula, spec, tag = nil)
+    super()
+
+    @name = formula.name
+    @resource = Resource.new
+    @resource.owner = formula
+    @spec = spec
+
+    tag_spec = spec.tag_specification_for(Utils::Bottles.tag(tag))
+
+    @tag = tag_spec.tag
+    @cellar = tag_spec.cellar
+    @rebuild = spec.rebuild
+
+    @resource.version(formula.pkg_version.to_s)
+    @resource.checksum = tag_spec.checksum
+
+    @fetch_tab_retried = false
+
+    root_url(spec.root_url, spec.root_url_specs)
+  end
+
+  sig {
+    override.params(
+      verify_download_integrity: T::Boolean,
+      timeout:                   T.nilable(T.any(Integer, Float)),
+      quiet:                     T.nilable(T::Boolean),
+    ).returns(Pathname)
+  }
+  def fetch(verify_download_integrity: true, timeout: nil, quiet: false)
+    resource.fetch(verify_download_integrity:, timeout:, quiet:)
+  rescue DownloadError
+    raise unless fallback_on_error?
+
+    fetch_tab
+    retry
+  end
+
+  sig { override.void }
+  def clear_cache
+    @resource.clear_cache
+    github_packages_manifest_resource&.clear_cache
+    @fetch_tab_retried = false
+  end
+
+  def compatible_locations?
+    @spec.compatible_locations?(tag: @tag)
+  end
+
+  # Does the bottle need to be relocated?
+  def skip_relocation?
+    @spec.skip_relocation?(tag: @tag)
+  end
+
+  def stage = downloader.stage
+
+  def fetch_tab(timeout: nil, quiet: false)
+    return unless (resource = github_packages_manifest_resource)
+
+    begin
+      resource.fetch(timeout:, quiet:)
+    rescue DownloadError
+      raise unless fallback_on_error?
+
+      retry
+    rescue Resource::BottleManifest::Error
+      raise if @fetch_tab_retried
+
+      @fetch_tab_retried = true
+      resource.clear_cache
+      retry
+    end
+  end
+
+  def tab_attributes
+    if (resource = github_packages_manifest_resource) && resource.downloaded?
+      return resource.tab
+    end
+
+    {}
+  end
+
+  sig { returns(T.nilable(Integer)) }
+  def bottle_size
+    resource = github_packages_manifest_resource
+    return unless resource&.downloaded?
+
+    resource.bottle_size
+  end
+
+  sig { returns(T.nilable(Integer)) }
+  def installed_size
+    resource = github_packages_manifest_resource
+    return unless resource&.downloaded?
+
+    resource.installed_size
+  end
+
+  sig { returns(Filename) }
+  def filename
+    Filename.create(resource.owner, @tag, @spec.rebuild)
+  end
+
+  sig { returns(T.nilable(Resource::BottleManifest)) }
+  def github_packages_manifest_resource
+    return if @resource.download_strategy != CurlGitHubPackagesDownloadStrategy
+
+    @github_packages_manifest_resource ||= begin
+      resource = Resource::BottleManifest.new(self)
+
+      version_rebuild = GitHubPackages.version_rebuild(@resource.version, rebuild)
+      resource.version(version_rebuild)
+
+      image_name = GitHubPackages.image_formula_name(@name)
+      image_tag = GitHubPackages.image_version_rebuild(version_rebuild)
+      resource.url(
+        "#{root_url}/#{image_name}/manifests/#{image_tag}",
+        using:   CurlGitHubPackagesDownloadStrategy,
+        headers: ["Accept: application/vnd.oci.image.index.v1+json"],
+      )
+      T.cast(resource.downloader, CurlGitHubPackagesDownloadStrategy).resolved_basename =
+        "#{name}-#{version_rebuild}.bottle_manifest.json"
+      resource
+    end
+  end
+
+  sig { override.returns(String) }
+  def download_queue_type = "Bottle"
+
+  sig { override.returns(String) }
+  def download_queue_name = "#{name} (#{resource.version})"
+
+  private
+
+  def select_download_strategy(specs)
+    specs[:using] ||= DownloadStrategyDetector.detect(@root_url)
+    specs[:bottle] = true
+    specs
+  end
+
+  def fallback_on_error?
+    # Use the default bottle domain as a fallback mirror
+    if @resource.url.start_with?(Homebrew::EnvConfig.bottle_domain) &&
+       Homebrew::EnvConfig.bottle_domain != HOMEBREW_BOTTLE_DEFAULT_DOMAIN
+      opoo "Bottle missing, falling back to the default domain..."
+      root_url(HOMEBREW_BOTTLE_DEFAULT_DOMAIN)
+      @github_packages_manifest_resource = nil
+      true
+    else
+      false
+    end
+  end
+
+  def root_url(val = nil, specs = {})
+    return @root_url if val.nil?
+
+    @root_url = val
+
+    filename = Filename.create(resource.owner, @tag, @spec.rebuild)
+    path, resolved_basename = Utils::Bottles.path_resolved_basename(val, name, resource.checksum, filename)
+    @resource.url("#{val}/#{path}", **select_download_strategy(specs))
+    @resource.downloader.resolved_basename = resolved_basename if resolved_basename.present?
+  end
+end

Library/Homebrew/bottle_specification.rb

@@ -0,0 +1,148 @@
+# typed: true # rubocop:todo Sorbet/StrictSigil
+# frozen_string_literal: true
+
+class BottleSpecification
+  RELOCATABLE_CELLARS = [:any, :any_skip_relocation].freeze
+
+  sig { returns(T.nilable(Tap)) }
+  attr_accessor :tap
+
+  attr_reader :collector
+
+  sig { returns(T::Hash[String, T.untyped]) }
+  attr_reader :root_url_specs
+
+  sig { returns(String) }
+  attr_reader :repository
+
+  sig { void }
+  def initialize
+    @rebuild = T.let(0, Integer)
+    @repository = T.let(Homebrew::DEFAULT_REPOSITORY, String)
+    @collector = T.let(Utils::Bottles::Collector.new, Utils::Bottles::Collector)
+    @root_url_specs = T.let({}, T::Hash[String, T.untyped])
+    @root_url = T.let(nil, T.nilable(String))
+  end
+
+  sig { params(val: Integer).returns(Integer) }
+  def rebuild(val = T.unsafe(nil))
+    val.nil? ? @rebuild : @rebuild = val
+  end
+
+  def root_url(var = nil, specs = {})
+    if var.nil?
+      @root_url ||= if (github_packages_url = GitHubPackages.root_url_if_match(Homebrew::EnvConfig.bottle_domain))
+        github_packages_url
+      else
+        Homebrew::EnvConfig.bottle_domain
+      end
+    else
+      @root_url = if (github_packages_url = GitHubPackages.root_url_if_match(var))
+        github_packages_url
+      else
+        var
+      end
+      @root_url_specs.merge!(specs)
+    end
+  end
+
+  def ==(other)
+    self.class == other.class && rebuild == other.rebuild && collector == other.collector &&
+      root_url == other.root_url && root_url_specs == other.root_url_specs && tap == other.tap
+  end
+  alias eql? ==
+
+  sig { params(tag: Utils::Bottles::Tag).returns(T.any(Symbol, String)) }
+  def tag_to_cellar(tag = Utils::Bottles.tag)
+    spec = collector.specification_for(tag)
+    if spec.present?
+      spec.cellar
+    else
+      tag.default_cellar
+    end
+  end
+
+  sig { params(tag: Utils::Bottles::Tag).returns(T::Boolean) }
+  def compatible_locations?(tag: Utils::Bottles.tag)
+    cellar = tag_to_cellar(tag)
+
+    return true if RELOCATABLE_CELLARS.include?(cellar)
+
+    prefix = Pathname(cellar.to_s).parent.to_s
+
+    cellar_relocatable = cellar.size >= HOMEBREW_CELLAR.to_s.size && ENV["HOMEBREW_RELOCATE_BUILD_PREFIX"].present?
+    prefix_relocatable = prefix.size >= HOMEBREW_PREFIX.to_s.size && ENV["HOMEBREW_RELOCATE_BUILD_PREFIX"].present?
+
+    compatible_cellar = cellar == HOMEBREW_CELLAR.to_s || cellar_relocatable
+    compatible_prefix = prefix == HOMEBREW_PREFIX.to_s || prefix_relocatable
+
+    compatible_cellar && compatible_prefix
+  end
+
+  # Does the {Bottle} this {BottleSpecification} belongs to need to be relocated?
+  sig { params(tag: Utils::Bottles::Tag).returns(T::Boolean) }
+  def skip_relocation?(tag: Utils::Bottles.tag)
+    spec = collector.specification_for(tag)
+    spec&.cellar == :any_skip_relocation
+  end
+
+  sig { params(tag: T.any(Symbol, Utils::Bottles::Tag), no_older_versions: T::Boolean).returns(T::Boolean) }
+  def tag?(tag, no_older_versions: false)
+    collector.tag?(tag, no_older_versions:)
+  end
+
+  # Checksum methods in the DSL's bottle block take
+  # a Hash, which indicates the platform the checksum applies on.
+  # Example bottle block syntax:
+  # bottle do
+  #  sha256 cellar: :any_skip_relocation, big_sur: "69489ae397e4645..."
+  #  sha256 cellar: :any, catalina: "449de5ea35d0e94..."
+  # end
+  def sha256(hash)
+    sha256_regex = /^[a-f0-9]{64}$/i
+
+    # find new `sha256 big_sur: "69489ae397e4645..."` format
+    tag, digest = hash.find do |key, value|
+      key.is_a?(Symbol) && value.is_a?(String) && value.match?(sha256_regex)
+    end
+
+    cellar = hash[:cellar] if digest && tag
+
+    tag = Utils::Bottles::Tag.from_symbol(tag)
+
+    cellar ||= tag.default_cellar
+
+    collector.add(tag, checksum: Checksum.new(digest), cellar:)
+  end
+
+  sig {
+    params(tag: Utils::Bottles::Tag, no_older_versions: T::Boolean)
+      .returns(T.nilable(Utils::Bottles::TagSpecification))
+  }
+  def tag_specification_for(tag, no_older_versions: false)
+    collector.specification_for(tag, no_older_versions:)
+  end
+
+  def checksums
+    tags = collector.tags.sort_by do |tag|
+      version = tag.to_macos_version
+      # Give `arm64` bottles a higher priority so they are first.
+      priority = (tag.arch == :arm64) ? 3 : 2
+      "#{priority}.#{version}_#{tag}"
+    rescue MacOSVersion::Error
+      # Sort non-macOS tags below macOS tags, and arm64 tags before other tags.
+      priority = (tag.arch == :arm64) ? 1 : 0
+      "#{priority}.#{tag}"
+    end
+    tags.reverse.map do |tag|
+      spec = collector.specification_for(tag)
+      {
+        "tag"    => spec.tag.to_sym,
+        "digest" => spec.checksum,
+        "cellar" => spec.cellar,
+      }
+    end
+  end
+end
+
+require "extend/os/bottle_specification"

Library/Homebrew/brew.rb

@@ -16,6 +16,7 @@ end
 std_trap = trap("INT") { exit! 130 } # no backtrace thanks
 
 require_relative "global"
+require "utils/output"
 
 begin
   trap("INT", std_trap) # restore default CTRL-C handler
@@ -88,6 +89,11 @@ begin
     cmd_class = Homebrew::AbstractCommand.command(cmd)
     Homebrew.running_command = cmd
     if cmd_class
+      if !Homebrew::EnvConfig.no_install_from_api? && Homebrew::EnvConfig.download_concurrency > 1
+        require "api"
+        Homebrew::API.fetch_api_files!
+      end
+
       command_instance = cmd_class.new
 
       require "utils/analytics"
@@ -100,14 +106,14 @@ begin
         converted_cmd = cmd.downcase.tr("-", "_")
         case_error = "undefined method `#{converted_cmd}' for module Homebrew"
         private_method_error = "private method `#{converted_cmd}' called for module Homebrew"
-        odie "Unknown command: brew #{cmd}" if [case_error, private_method_error].include?(e.message)
+        Utils::Output.odie "Unknown command: brew #{cmd}" if [case_error, private_method_error].include?(e.message)
 
         raise
       end
     end
   elsif (path = Commands.external_ruby_cmd_path(cmd))
     Homebrew.running_command = cmd
-    require?(path)
+    Homebrew.require?(path)
     exit Homebrew.failed? ? 1 : 0
   elsif Commands.external_cmd_path(cmd)
     %w[CACHE LIBRARY_PATH].each do |env|
@@ -124,14 +130,16 @@ begin
        possible_tap.installed? ||
        (blocked_tap = Tap.untapped_official_taps.include?(possible_tap.name))
       if blocked_tap
-        onoe <<~EOS
+        Utils::Output.onoe <<~EOS
           `brew #{cmd}` is unavailable because #{possible_tap.name} was manually untapped.
           Run `brew tap #{possible_tap.name}` to reenable `brew #{cmd}`.
         EOS
       end
       # Check for cask explicitly because it's very common in old guides
-      odie "`brew cask` is no longer a `brew` command. Use `brew <command> --cask` instead." if cmd == "cask"
-      odie "Unknown command: brew #{cmd}"
+      if cmd == "cask"
+        Utils::Output.odie "`brew cask` is no longer a `brew` command. Use `brew <command> --cask` instead."
+      end
+      Utils::Output.odie "Unknown command: brew #{cmd}"
     end
 
     # Unset HOMEBREW_HELP to avoid confusing the tap
@@ -156,7 +164,7 @@ rescue UsageError => e
   require "help"
   Homebrew::Help.help cmd, remaining_args: args&.remaining || [], usage_error: e.message
 rescue SystemExit => e
-  onoe "Kernel.exit" if args&.debug? && !e.success?
+  Utils::Output.onoe "Kernel.exit" if args&.debug? && !e.success?
   if args&.debug? || ARGV.include?("--debug")
     require "utils/backtrace"
     $stderr.puts Utils::Backtrace.clean(e)
@@ -169,8 +177,13 @@ rescue BuildError => e
   Utils::Analytics.report_build_error(e)
   e.dump(verbose: args&.verbose? || false)
 
-  if OS.unsupported_configuration?
-    $stderr.puts "#{Tty.bold}Do not report this issue: you are running in an unsupported configuration.#{Tty.reset}"
+  if OS.not_tier_one_configuration?
+    $stderr.puts <<~EOS
+      This build failure was expected, as this is not a Tier 1 configuration:
+        #{Formatter.url("https://docs.brew.sh/Support-Tiers")}
+      #{Formatter.bold("Do not report any issues to Homebrew/* repositories!")}
+      Read the above document instead before opening any issues or PRs.
+    EOS
   elsif e.formula.head? || e.formula.deprecated? || e.formula.disabled?
     reason = if e.formula.head?
       "was built from an unstable upstream --HEAD"
@@ -182,21 +195,14 @@ rescue BuildError => e
     $stderr.puts <<~EOS
       #{e.formula.name}'s formula #{reason}.
       This build failure is expected behaviour.
-      Do not create issues about this on Homebrew's GitHub repositories.
-      Any opened issues will be immediately closed without response.
-      Do not ask for help from Homebrew or its maintainers on social media.
-      You may ask for help in Homebrew's discussions but are unlikely to receive a response.
-      Try to figure out the problem yourself and submit a fix as a pull request.
-      We will review it but may or may not accept it.
     EOS
-
   end
 
   exit 1
 rescue RuntimeError, SystemCallError => e
   raise if e.message.empty?
 
-  onoe e
+  Utils::Output.onoe e
   if args&.debug? || ARGV.include?("--debug")
     require "utils/backtrace"
     $stderr.puts Utils::Backtrace.clean(e)
@@ -205,21 +211,26 @@ rescue RuntimeError, SystemCallError => e
   exit 1
 # Catch any other types of exceptions.
 rescue Exception => e # rubocop:disable Lint/RescueException
-  onoe e
+  Utils::Output.onoe e
 
   method_deprecated_error = e.is_a?(MethodDeprecatedError)
   require "utils/backtrace"
   $stderr.puts Utils::Backtrace.clean(e) if args&.debug? || ARGV.include?("--debug") || !method_deprecated_error
 
-  if OS.unsupported_configuration?
-    $stderr.puts "#{Tty.bold}Do not report this issue: you are running in an unsupported configuration.#{Tty.reset}"
+  if OS.not_tier_one_configuration?
+    $stderr.puts <<~EOS
+      This error was expected, as this is not a Tier 1 configuration:
+        #{Formatter.url("https://docs.brew.sh/Support-Tiers")}
+      #{Formatter.bold("Do not report any issues to Homebrew/* repositories!")}
+      Read the above document instead before opening any issues or PRs.
+    EOS
   elsif Homebrew::EnvConfig.no_auto_update? &&
         (fetch_head = HOMEBREW_REPOSITORY/".git/FETCH_HEAD") &&
         (!fetch_head.exist? || (fetch_head.mtime.to_date < Date.today))
     $stderr.puts "#{Tty.bold}You have disabled automatic updates and have not updated today.#{Tty.reset}"
     $stderr.puts "#{Tty.bold}Do not report this issue until you've run `brew update` and tried again.#{Tty.reset}"
   elsif (issues_url = (method_deprecated_error && e.issues_url) || Utils::Backtrace.tap_error_url(e))
-    $stderr.puts "If reporting this issue please do so at (not Homebrew/brew or Homebrew/homebrew-core):"
+    $stderr.puts "If reporting this issue please do so at (not Homebrew/* repositories):"
     $stderr.puts "  #{Formatter.url(issues_url)}"
   elsif internal_cmd
     $stderr.puts "#{Tty.bold}Please report this issue:#{Tty.reset}"

Library/Homebrew/brew.sh

@@ -65,7 +65,12 @@ else
   CACHE_HOME="${HOMEBREW_XDG_CACHE_HOME:-${HOME}/.cache}"
   HOMEBREW_DEFAULT_CACHE="${CACHE_HOME}/Homebrew"
   HOMEBREW_DEFAULT_LOGS="${CACHE_HOME}/Homebrew/Logs"
-  HOMEBREW_DEFAULT_TEMP="/tmp"
+  if [[ -r "/var/tmp" && -w "/var/tmp" ]]
+  then
+    HOMEBREW_DEFAULT_TEMP="/var/tmp"
+  else
+    HOMEBREW_DEFAULT_TEMP="/tmp"
+  fi
 fi
 
 realpath() {
@@ -104,6 +109,10 @@ HOMEBREW_CASKROOM="${HOMEBREW_PREFIX}/Caskroom"
 HOMEBREW_CACHE="${HOMEBREW_CACHE:-${HOMEBREW_DEFAULT_CACHE}}"
 HOMEBREW_LOGS="${HOMEBREW_LOGS:-${HOMEBREW_DEFAULT_LOGS}}"
 HOMEBREW_TEMP="${HOMEBREW_TEMP:-${HOMEBREW_DEFAULT_TEMP}}"
+if [[ ! -w "${HOMEBREW_TEMP}" ]]
+then
+  HOMEBREW_TEMP="${HOMEBREW_DEFAULT_TEMP}"
+fi
 
 # commands that take a single or no arguments.
 # HOMEBREW_LIBRARY set by bin/brew
@@ -178,38 +187,10 @@ case "$@" in
     ;;
 esac
 
-# Include some helper functions.
-source "${HOMEBREW_LIBRARY}/Homebrew/utils/helpers.sh"
-
-# Require HOMEBREW_BREW_WRAPPER to be set if HOMEBREW_FORCE_BREW_WRAPPER is set
-# (and HOMEBREW_NO_FORCE_BREW_WRAPPER is not set) for all non-trivial commands
+# Check `HOMEBREW_FORCE_BREW_WRAPPER` for all non-trivial commands
 # (i.e. not defined above this line e.g. formulae or --cellar).
-if [[ -z "${HOMEBREW_NO_FORCE_BREW_WRAPPER:-}" && -n "${HOMEBREW_FORCE_BREW_WRAPPER:-}" ]]
-then
-  if [[ -z "${HOMEBREW_BREW_WRAPPER:-}" ]]
-  then
-    odie <<EOS
-HOMEBREW_FORCE_BREW_WRAPPER was set to
-  ${HOMEBREW_FORCE_BREW_WRAPPER}
-but HOMEBREW_BREW_WRAPPER was unset. This indicates that you are running
-  ${HOMEBREW_BREW_FILE}
-directly but should instead run
-  ${HOMEBREW_FORCE_BREW_WRAPPER}
-EOS
-  elif [[ "${HOMEBREW_FORCE_BREW_WRAPPER}" != "${HOMEBREW_BREW_WRAPPER}" ]]
-  then
-    odie <<EOS
-HOMEBREW_FORCE_BREW_WRAPPER was set to
-  ${HOMEBREW_FORCE_BREW_WRAPPER}
-but HOMEBREW_BREW_WRAPPER was set to
-  ${HOMEBREW_BREW_WRAPPER}
-This indicates that you are running
-  ${HOMEBREW_BREW_FILE}
-directly but should instead run:
-  ${HOMEBREW_FORCE_BREW_WRAPPER}
-EOS
-  fi
-fi
+source "${HOMEBREW_LIBRARY}/Homebrew/utils/wrapper.sh"
+check-brew-wrapper
 
 # commands that take a single or no arguments and need to write to HOMEBREW_PREFIX.
 # HOMEBREW_LIBRARY set by bin/brew
@@ -229,6 +210,8 @@ esac
 ##### Next, define all other helper functions.
 #####
 
+source "${HOMEBREW_LIBRARY}/Homebrew/utils/helpers.sh"
+
 check-run-command-as-root() {
   [[ "${EUID}" == 0 || "${UID}" == 0 ]] || return
 
@@ -237,8 +220,15 @@ check-run-command-as-root() {
   [[ -f /run/.containerenv ]] && return
   [[ -f /proc/1/cgroup ]] && grep -E "azpl_job|actions_job|docker|garden|kubepods" -q /proc/1/cgroup && return
 
-  # Homebrew Services may need `sudo` for system-wide daemons.
-  [[ "${HOMEBREW_COMMAND}" == "services" ]] && return
+  # `brew services` may need `sudo` for system-wide daemons.
+  if [[ "${HOMEBREW_COMMAND}" == "services" ]]
+  then
+    # Need to disable Bootsnap when running as root to avoid permission errors:
+    # https://github.com/Homebrew/brew/issues/19904
+    export HOMEBREW_NO_BOOTSNAP="1"
+
+    return
+  fi
 
   # It's fine to run this as root as it's not changing anything.
   [[ "${HOMEBREW_COMMAND}" == "--prefix" ]] && return
@@ -364,8 +354,11 @@ auto-update() {
     unset HOMEBREW_AUTO_UPDATING
     unset HOMEBREW_AUTO_UPDATE_TAP
 
-    # exec a new process to set any new environment variables.
-    exec "${HOMEBREW_BREW_FILE}" "$@"
+    if [[ $# -gt 0 ]]
+    then
+      # exec a new process to set any new environment variables.
+      exec "${HOMEBREW_BREW_FILE}" "$@"
+    fi
   fi
 
   unset AUTO_UPDATE_COMMANDS
@@ -375,6 +368,22 @@ auto-update() {
   unset HOMEBREW_AUTO_UPDATE_CASK_TAP
 }
 
+# Only `brew update-if-needed` should be handled here.
+# We want it as fast as possible but it needs auto-update() defined above.
+# HOMEBREW_LIBRARY set by bin/brew
+# shellcheck disable=SC2154
+# doesn't need a default case as other arguments handled elsewhere.
+# shellcheck disable=SC2249
+# Don't need to pass through any arguments.
+# shellcheck disable=SC2119
+case "$@" in
+  update-if-needed)
+    source "${HOMEBREW_LIBRARY}/Homebrew/cmd/update-if-needed.sh"
+    homebrew-update-if-needed
+    exit 0
+    ;;
+esac
+
 #####
 ##### Setup output so e.g. odie looks as nice as possible.
 #####
@@ -428,7 +437,7 @@ fi
 #####
 
 # Docker image deprecation
-if [[ -f "${HOMEBREW_REPOSITORY}/.docker-deprecate" ]]
+if [[ -f "${HOMEBREW_REPOSITORY}/.docker-deprecate" && -z "${HOMEBREW_TESTS}" ]]
 then
   read -r DOCKER_DEPRECATION_MESSAGE <"${HOMEBREW_REPOSITORY}/.docker-deprecate"
   if [[ -n "${GITHUB_ACTIONS}" ]]
@@ -487,9 +496,9 @@ GIT_REVISION=$("${HOMEBREW_GIT}" -C "${HOMEBREW_REPOSITORY}" rev-parse HEAD 2>/d
 if [[ -z "${GIT_REVISION}" ]]
 then
   read -r GIT_HEAD 2>/dev/null <"${HOMEBREW_REPOSITORY}/.git/HEAD"
-  if [[ "${GIT_HEAD}" == "ref: refs/heads/master" ]]
+  if [[ "${GIT_HEAD}" == "ref: refs/heads/main" ]]
   then
-    read -r GIT_REVISION 2>/dev/null <"${HOMEBREW_REPOSITORY}/.git/refs/heads/master"
+    read -r GIT_REVISION 2>/dev/null <"${HOMEBREW_REPOSITORY}/.git/refs/heads/main"
   elif [[ "${GIT_HEAD}" == "ref: refs/heads/stable" ]]
   then
     read -r GIT_REVISION 2>/dev/null <"${HOMEBREW_REPOSITORY}/.git/refs/heads/stable"
@@ -556,22 +565,30 @@ case "$1" in
     homebrew-version
     exit 0
     ;;
+  mcp-server)
+    source "${HOMEBREW_LIBRARY}/Homebrew/cmd/mcp-server.sh"
+    homebrew-mcp-server "$@"
+    exit 0
+    ;;
 esac
 
 # TODO: bump version when new macOS is released or announced and update references in:
 # - docs/Installation.md
 # - https://github.com/Homebrew/install/blob/HEAD/install.sh
 # - Library/Homebrew/os/mac.rb (latest_sdk_version)
+# - Library/Homebrew/os/mac/xcode.rb (latest_version), (minimum_version)
 # and, if needed:
 # - MacOSVersion::SYMBOLS
-HOMEBREW_MACOS_NEWEST_UNSUPPORTED="16"
+HOMEBREW_MACOS_NEWEST_UNSUPPORTED="27"
+# TODO: bump version when new macOS is released
+HOMEBREW_MACOS_NEWEST_SUPPORTED="26"
 # TODO: bump version when new macOS is released and update references in:
 # - docs/Installation.md
 # - HOMEBREW_MACOS_OLDEST_SUPPORTED in .github/workflows/pkg-installer.yml
 # - `os-version min` in package/Distribution.xml
 # - https://github.com/Homebrew/install/blob/HEAD/install.sh
-HOMEBREW_MACOS_OLDEST_SUPPORTED="13"
-HOMEBREW_MACOS_OLDEST_ALLOWED="10.11"
+HOMEBREW_MACOS_OLDEST_SUPPORTED="14"
+HOMEBREW_MACOS_OLDEST_ALLOWED="10.15"
 
 if [[ -n "${HOMEBREW_MACOS}" ]]
 then
@@ -662,8 +679,8 @@ else
   then
     message="Please update your system curl or set HOMEBREW_CURL_PATH to a newer version.
 Minimum required version: ${HOMEBREW_MINIMUM_CURL_VERSION}
-Your curl version: ${curl_name_and_version##* }
-Your curl executable: $(type -p "${HOMEBREW_CURL}")"
+       Your curl version: ${curl_name_and_version##* }
+    Your curl executable: $(type -p "${HOMEBREW_CURL}")"
 
     if [[ -z ${HOMEBREW_CURL_PATH} ]]
     then
@@ -690,8 +707,8 @@ Your curl executable: $(type -p "${HOMEBREW_CURL}")"
   then
     message="Please update your system Git or set HOMEBREW_GIT_PATH to a newer version.
 Minimum required version: ${HOMEBREW_MINIMUM_GIT_VERSION}
-Your Git version: ${major}.${minor}.${micro}.${build}
-Your Git executable: $(unset git && type -p "${HOMEBREW_GIT}")"
+        Your Git version: ${major}.${minor}.${micro}.${build}
+     Your Git executable: $(unset git && type -p "${HOMEBREW_GIT}")"
     if [[ -z ${HOMEBREW_GIT_PATH} ]]
     then
       HOMEBREW_FORCE_BREWED_GIT="1"
@@ -792,6 +809,7 @@ export HOMEBREW_OS_VERSION
 export HOMEBREW_MACOS_VERSION
 export HOMEBREW_MACOS_VERSION_NUMERIC
 export HOMEBREW_MACOS_NEWEST_UNSUPPORTED
+export HOMEBREW_MACOS_NEWEST_SUPPORTED
 export HOMEBREW_MACOS_OLDEST_SUPPORTED
 export HOMEBREW_MACOS_OLDEST_ALLOWED
 export HOMEBREW_USER_AGENT
@@ -960,13 +978,6 @@ then
   export HOMEBREW_DEVELOPER_COMMAND="1"
 fi
 
-# Provide a (temporary, undocumented) way to disable Sorbet globally if needed
-# to avoid reverting the above.
-if [[ -n "${HOMEBREW_NO_SORBET_RUNTIME}" ]]
-then
-  unset HOMEBREW_SORBET_RUNTIME
-fi
-
 if [[ -n "${HOMEBREW_DEVELOPER_COMMAND}" && -z "${HOMEBREW_DEVELOPER}" ]]
 then
   if [[ -z "${HOMEBREW_DEV_CMD_RUN}" ]]
@@ -990,6 +1001,13 @@ then
   export HOMEBREW_SORBET_RUNTIME="1"
 fi
 
+# Provide a (temporary, undocumented) way to disable Sorbet globally if needed
+# to avoid reverting the above.
+if [[ -n "${HOMEBREW_NO_SORBET_RUNTIME}" ]]
+then
+  unset HOMEBREW_SORBET_RUNTIME
+fi
+
 if [[ -f "${HOMEBREW_LIBRARY}/Homebrew/cmd/${HOMEBREW_COMMAND}.sh" ]]
 then
   HOMEBREW_BASH_COMMAND="${HOMEBREW_LIBRARY}/Homebrew/cmd/${HOMEBREW_COMMAND}.sh"
@@ -1034,6 +1052,25 @@ else
   export HOMEBREW_GITHUB_PACKAGES_AUTH="Bearer QQ=="
 fi
 
+# Avoid picking up any random `sudo` in `PATH`.
+if [[ -x /usr/bin/sudo ]]
+then
+  SUDO=/usr/bin/sudo
+else
+  # Do this after ensuring we're using default Bash builtins.
+  SUDO="$(command -v sudo 2>/dev/null)"
+fi
+
+# Reset sudo timestamp to avoid running unauthorized sudo commands
+if [[ -n "${SUDO}" ]]
+then
+  "${SUDO}" --reset-timestamp 2>/dev/null || true
+fi
+unset SUDO
+
+# Remove internal variables
+unset HOMEBREW_INTERNAL_ALLOW_PACKAGES_FROM_PATHS
+
 if [[ -n "${HOMEBREW_BASH_COMMAND}" ]]
 then
   # source rather than executing directly to ensure the entire file is read into

Library/Homebrew/build.rb

@@ -1,4 +1,4 @@
-# typed: true # rubocop:todo Sorbet/StrictSigil
+# typed: strict
 # frozen_string_literal: true
 
 # This script is loaded by formula_installer as a separate instance.
@@ -16,31 +16,47 @@ require "fcntl"
 require "utils/socket"
 require "cmd/install"
 require "json/add/exception"
+require "utils/output"
+require "extend/pathname/write_mkpath_extension"
 
 # A formula build.
 class Build
-  attr_reader :formula, :deps, :reqs, :args
+  include Utils::Output::Mixin
 
+  sig { returns(Formula) }
+  attr_reader :formula
+
+  sig { returns(T::Array[Dependency]) }
+  attr_reader :deps
+
+  sig { returns(Requirements) }
+  attr_reader :reqs
+
+  sig { returns(Homebrew::Cmd::InstallCmd::Args) }
+  attr_reader :args
+
+  sig { params(formula: Formula, options: Options, args: Homebrew::Cmd::InstallCmd::Args).void }
   def initialize(formula, options, args:)
     @formula = formula
     @formula.build = BuildOptions.new(options, formula.options)
-    @args = args
+    @args = T.let(args, Homebrew::Cmd::InstallCmd::Args)
+    @deps = T.let([], T::Array[Dependency])
+    @reqs = T.let(Requirements.new, Requirements)
 
-    if args.ignore_dependencies?
-      @deps = []
-      @reqs = []
-    else
-      @deps = expand_deps
-      @reqs = expand_reqs
-    end
+    return if args.ignore_dependencies?
+
+    @deps = expand_deps
+    @reqs = expand_reqs
   end
 
+  sig { params(dependent: Formula).returns(BuildOptions) }
   def effective_build_options_for(dependent)
     args  = dependent.build.used_options
     args |= Tab.for_formula(dependent).used_options
     BuildOptions.new(args, dependent.options)
   end
 
+  sig { returns(Requirements) }
   def expand_reqs
     formula.recursive_requirements do |dependent, req|
       build = effective_build_options_for(dependent)
@@ -50,6 +66,7 @@ class Build
     end
   end
 
+  sig { returns(T::Array[Dependency]) }
   def expand_deps
     formula.recursive_dependencies do |dependent, dep|
       build = effective_build_options_for(dependent)
@@ -63,6 +80,7 @@ class Build
     end
   end
 
+  sig { void }
   def install
     formula_deps = deps.map(&:to_formula)
     keg_only_deps = formula_deps.select(&:keg_only?)
@@ -75,7 +93,7 @@ class Build
     ENV.activate_extensions!(env: args.env)
 
     if superenv?(args.env)
-      superenv = T.cast(ENV, Superenv)
+      superenv = ENV
       superenv.keg_only_deps = keg_only_deps
       superenv.deps = formula_deps
       superenv.run_time_deps = run_time_deps
@@ -148,12 +166,15 @@ class Build
           # https://github.com/Homebrew/homebrew-core/pull/87470
           TZ:                         "UTC0",
         ) do
-          formula.patch
-
           if args.git?
+            formula.selective_patch(is_data: false)
             system "git", "init"
             system "git", "add", "-A"
+            formula.selective_patch(is_data: true)
+          else
+            formula.patch
           end
+
           if args.interactive?
             ohai "Entering interactive mode..."
             puts <<~EOS
@@ -176,6 +197,8 @@ class Build
 
             (formula.logs/"00.options.out").write \
               "#{formula.full_name} #{formula.build.used_options.sort.join(" ")}".strip
+
+            Pathname.prepend WriteMkpathExtension
             formula.install
 
             stdlibs = detect_stdlibs
@@ -183,14 +206,17 @@ class Build
             tab.write
 
             # Find and link metafiles
-            formula.prefix.install_metafiles formula.buildpath
+            formula.prefix.install_metafiles T.must(formula.buildpath)
             formula.prefix.install_metafiles formula.libexec if formula.libexec.exist?
+
+            normalize_pod2man_outputs!(formula)
           end
         end
       end
     end
   end
 
+  sig { returns(T::Array[Symbol]) }
   def detect_stdlibs
     keg = Keg.new(formula.prefix)
 
@@ -200,13 +226,15 @@ class Build
     keg.detect_cxx_stdlibs(skip_executables: true)
   end
 
+  sig { params(formula: Formula).void }
   def fixopt(formula)
     path = if formula.linked_keg.directory? && formula.linked_keg.symlink?
       formula.linked_keg.resolved_path
     elsif formula.prefix.directory?
       formula.prefix
-    elsif (kids = formula.rack.children).size == 1 && kids.first.directory?
-      kids.first
+    elsif (children = formula.rack.children.presence) && children.size == 1 &&
+          (first_child = children.first.presence) && first_child.directory?
+      first_child
     else
       raise
     end
@@ -214,10 +242,19 @@ class Build
   rescue
     raise "#{formula.opt_prefix} not present or broken\nPlease reinstall #{formula.full_name}. Sorry :("
   end
+
+  sig { params(formula: Formula).void }
+  def normalize_pod2man_outputs!(formula)
+    keg = Keg.new(formula.prefix)
+    keg.normalize_pod2man_outputs!
+  end
 end
 
 begin
-  ENV.delete("HOMEBREW_FORBID_PACKAGES_FROM_PATHS")
+  # Undocumented opt-out for internal use.
+  # We need to allow formulae from paths here due to how we pass them through.
+  ENV["HOMEBREW_INTERNAL_ALLOW_PACKAGES_FROM_PATHS"] = "1"
+
   args = Homebrew::Cmd::InstallCmd.new.args
   Context.current = args.context
 
@@ -226,9 +263,10 @@ begin
 
   trap("INT", old_trap)
 
-  formula = args.named.to_formulae.first
+  formula = args.named.to_formulae.fetch(0)
   options = Options.create(args.flags_only)
   build   = Build.new(formula, options, args:)
+
   build.install
 # Any exception means the build did not complete.
 # The `case` for what to do per-exception class is further down.
@@ -258,7 +296,7 @@ rescue Exception => e # rubocop:disable Lint/RescueException
     error_hash["output"] = e.output
   end
 
-  error_pipe.puts error_hash.to_json
-  error_pipe.close
+  error_pipe&.puts error_hash.to_json
+  error_pipe&.close
   exit! 1
 end

Library/Homebrew/build_environment.rb

@@ -1,11 +1,11 @@
-# typed: true # rubocop:todo Sorbet/StrictSigil
+# typed: strict
 # frozen_string_literal: true
 
 # Settings for the build environment.
 class BuildEnvironment
   sig { params(settings: Symbol).void }
   def initialize(*settings)
-    @settings = Set.new(settings)
+    @settings = T.let(Set.new(settings), T::Set[Symbol])
   end
 
   sig { params(args: T::Enumerable[Symbol]).returns(T.self_type) }
@@ -29,16 +29,17 @@ class BuildEnvironment
   module DSL
     # Initialise @env for each class which may use this DSL (e.g. each formula subclass).
     # `env` may never be called and it needs to be initialised before the class is frozen.
+    sig { params(child: T.untyped).void }
     def inherited(child)
       super
       child.instance_eval do
-        @env = BuildEnvironment.new
+        @env = T.let(BuildEnvironment.new, T.nilable(BuildEnvironment))
       end
     end
 
     sig { params(settings: Symbol).returns(BuildEnvironment) }
     def env(*settings)
-      @env.merge(settings)
+      T.must(@env).merge(settings)
     end
   end
 

Library/Homebrew/build_options.rb

@@ -1,11 +1,12 @@
-# typed: true # rubocop:todo Sorbet/StrictSigil
+# typed: strict
 # frozen_string_literal: true
 
 # Options for a formula build.
 class BuildOptions
+  sig { params(args: Options, options: Options).void }
   def initialize(args, options)
-    @args = args
-    @options = options
+    @args = T.let(args, Options)
+    @options = T.let(options, Options)
   end
 
   # True if a {Formula} is being built with a specific option.
@@ -29,8 +30,13 @@ class BuildOptions
   #   args << "--with-example1"
   # end
   # ```
+  sig { params(val: T.any(String, Requirement, Dependency)).returns(T::Boolean) }
   def with?(val)
-    option_names = val.respond_to?(:option_names) ? val.option_names : [val]
+    option_names = if val.is_a?(String)
+      [val]
+    else
+      val.option_names
+    end
 
     option_names.any? do |name|
       if option_defined? "with-#{name}"
@@ -50,11 +56,13 @@ class BuildOptions
   # ```ruby
   # args << "--no-spam-plz" if build.without? "spam"
   # ```
+  sig { params(val: T.any(String, Requirement, Dependency)).returns(T::Boolean) }
   def without?(val)
     !with?(val)
   end
 
   # True if a {Formula} is being built as a bottle (i.e. binary package).
+  sig { returns(T::Boolean) }
   def bottle?
     include? "build-bottle"
   end
@@ -75,6 +83,7 @@ class BuildOptions
   #   args << "--and-a-cold-beer" if build.with? "cold-beer"
   # end
   # ```
+  sig { returns(T::Boolean) }
   def head?
     include? "HEAD"
   end
@@ -85,31 +94,37 @@ class BuildOptions
   # ### Example
   #
   # ```ruby
-  # args << "--some-beta" if build.head?
+  # args << "--some-feature" if build.stable?
   # ```
+  sig { returns(T::Boolean) }
   def stable?
     !head?
   end
 
   # True if the build has any arguments or options specified.
+  sig { returns(T::Boolean) }
   def any_args_or_options?
     !@args.empty? || !@options.empty?
   end
 
+  sig { returns(Options) }
   def used_options
     @options & @args
   end
 
+  sig { returns(Options) }
   def unused_options
     @options - @args
   end
 
   private
 
+  sig { params(name: String).returns(T::Boolean) }
   def include?(name)
     @args.include?("--#{name}")
   end
 
+  sig { params(name: String).returns(T::Boolean) }
   def option_defined?(name)
     @options.include? name
   end

Library/Homebrew/bump_version_parser.rb

@@ -4,6 +4,8 @@
 module Homebrew
   # Class handling architecture-specific version information.
   class BumpVersionParser
+    VERSION_SYMBOLS = [:general, :arm, :intel].freeze
+
     sig { returns(T.nilable(T.any(Version, Cask::DSL::Version))) }
     attr_reader :arm, :general, :intel
 

Library/Homebrew/bundle.rb

@@ -0,0 +1,150 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "English"
+
+module Homebrew
+  module Bundle
+    class << self
+      sig { params(args_upgrade_formula: T.nilable(String)).void }
+      def upgrade_formulae=(args_upgrade_formula)
+        @upgrade_formulae = args_upgrade_formula.to_s.split(",")
+      end
+
+      sig { returns(T::Array[String]) }
+      def upgrade_formulae
+        @upgrade_formulae || []
+      end
+
+      sig { params(cmd: T.any(String, Pathname), args: T.anything, verbose: T::Boolean).returns(T::Boolean) }
+      def system(cmd, *args, verbose: false)
+        return super cmd, *args if verbose
+
+        logs = []
+        success = T.let(false, T::Boolean)
+        IO.popen([cmd, *args], err: [:child, :out]) do |pipe|
+          while (buf = pipe.gets)
+            logs << buf
+          end
+          Process.wait(pipe.pid)
+          success = $CHILD_STATUS.success?
+          pipe.close
+        end
+        puts logs.join unless success
+        success
+      end
+
+      sig { params(args: T.anything, verbose: T::Boolean).returns(T::Boolean) }
+      def brew(*args, verbose: false)
+        system(HOMEBREW_BREW_FILE, *args, verbose:)
+      end
+
+      sig { returns(T::Boolean) }
+      def mas_installed?
+        @mas_installed ||= which_formula?("mas")
+      end
+
+      sig { returns(T::Boolean) }
+      def vscode_installed?
+        @vscode_installed ||= which_vscode.present?
+      end
+
+      sig { returns(T.nilable(Pathname)) }
+      def which_vscode
+        @which_vscode ||= which("code", ORIGINAL_PATHS)
+        @which_vscode ||= which("codium", ORIGINAL_PATHS)
+        @which_vscode ||= which("cursor", ORIGINAL_PATHS)
+        @which_vscode ||= which("code-insiders", ORIGINAL_PATHS)
+      end
+
+      sig { returns(T::Boolean) }
+      def whalebrew_installed?
+        @whalebrew_installed ||= which_formula?("whalebrew")
+      end
+
+      sig { returns(T::Boolean) }
+      def cask_installed?
+        @cask_installed ||= File.directory?("#{HOMEBREW_PREFIX}/Caskroom") &&
+                            (File.directory?("#{HOMEBREW_LIBRARY}/Taps/homebrew/homebrew-cask") ||
+                             !Homebrew::EnvConfig.no_install_from_api?)
+      end
+
+      sig { params(name: String).returns(T::Boolean) }
+      def which_formula?(name)
+        formula = Formulary.factory(name)
+        ENV["PATH"] = "#{formula.opt_bin}:#{ENV.fetch("PATH", nil)}" if formula.any_version_installed?
+        which(name).present?
+      end
+
+      sig { params(block: T.proc.returns(T.anything)).returns(T.untyped) }
+      def exchange_uid_if_needed!(&block)
+        euid = Process.euid
+        uid = Process.uid
+        return yield if euid == uid
+
+        old_euid = euid
+        process_reexchangeable = Process::UID.re_exchangeable?
+        if process_reexchangeable
+          Process::UID.re_exchange
+        else
+          Process::Sys.seteuid(uid)
+        end
+
+        home = T.must(Etc.getpwuid(Process.uid)).dir
+        return_value = with_env("HOME" => home, &block)
+
+        if process_reexchangeable
+          Process::UID.re_exchange
+        else
+          Process::Sys.seteuid(old_euid)
+        end
+
+        return_value
+      end
+
+      sig { params(formula_name: String).returns(T.nilable(String)) }
+      def formula_versions_from_env(formula_name)
+        @formula_versions_from_env ||= begin
+          formula_versions = {}
+
+          ENV.each do |key, value|
+            match = key.match(/^HOMEBREW_BUNDLE_FORMULA_VERSION_(.+)$/)
+            next if match.blank?
+
+            env_formula_name = match[1]
+            next if env_formula_name.blank?
+
+            ENV.delete(key)
+            formula_versions[env_formula_name] = value
+          end
+
+          formula_versions
+        end
+
+        # Fix up formula name for a valid environment variable name.
+        formula_env_name = formula_name.upcase
+                                       .gsub("@", "AT")
+                                       .tr("+", "X")
+                                       .tr("-", "_")
+
+        @formula_versions_from_env[formula_env_name]
+      end
+
+      sig { void }
+      def prepend_pkgconf_path_if_needed!; end
+
+      sig { void }
+      def reset!
+        @mas_installed = T.let(nil, T.nilable(T::Boolean))
+        @vscode_installed = T.let(nil, T.nilable(T::Boolean))
+        @which_vscode = T.let(nil, T.nilable(Pathname))
+        @whalebrew_installed = T.let(nil, T.nilable(T::Boolean))
+        @cask_installed = T.let(nil, T.nilable(T::Boolean))
+        @formula_versions_from_env = T.let(nil, T.nilable(T::Hash[String, String]))
+        @upgrade_formulae = T.let(nil, T.nilable(T::Array[String]))
+      end
+    end
+  end
+end
+
+require "extend/os/bundle/bundle"

Library/Homebrew/bundle/adder.rb

@@ -0,0 +1,38 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "bundle/brewfile"
+require "bundle/dumper"
+
+module Homebrew
+  module Bundle
+    module Adder
+      module_function
+
+      sig { params(args: String, type: Symbol, global: T::Boolean, file: String).void }
+      def add(*args, type:, global:, file:)
+        brewfile_path = Brewfile.path(global:, file:)
+        brewfile_path.write("") unless brewfile_path.exist?
+
+        brewfile = Brewfile.read(global:, file:)
+        content = brewfile.input
+        # TODO: - support `:describe`
+        new_content = args.map do |arg|
+          case type
+          when :brew
+            Formulary.factory(arg)
+          when :cask
+            Cask::CaskLoader.load(arg)
+          end
+
+          "#{type} \"#{arg}\""
+        end
+
+        content << new_content.join("\n") << "\n"
+        path = Dumper.brewfile_path(global:, file:)
+
+        Dumper.write_file path, content
+      end
+    end
+  end
+end

Library/Homebrew/bundle/brew_checker.rb

@@ -0,0 +1,20 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "bundle/formula_installer"
+
+module Homebrew
+  module Bundle
+    module Checker
+      class BrewChecker < Homebrew::Bundle::Checker::Base
+        PACKAGE_TYPE = :brew
+        PACKAGE_TYPE_NAME = "Formula"
+
+        sig { params(formula: String, no_upgrade: T::Boolean).returns(T::Boolean) }
+        def installed_and_up_to_date?(formula, no_upgrade: false)
+          Homebrew::Bundle::FormulaInstaller.formula_installed_and_up_to_date?(formula, no_upgrade:)
+        end
+      end
+    end
+  end
+end

Library/Homebrew/bundle/brew_service_checker.rb

@@ -0,0 +1,54 @@
+# typed: true # rubocop:todo Sorbet/StrictSigil
+# frozen_string_literal: true
+
+module Homebrew
+  module Bundle
+    module Checker
+      class BrewServiceChecker < Homebrew::Bundle::Checker::Base
+        PACKAGE_TYPE = :brew
+        PACKAGE_TYPE_NAME = "Service"
+        PACKAGE_ACTION_PREDICATE = "needs to be started."
+
+        def failure_reason(name, no_upgrade:)
+          "#{PACKAGE_TYPE_NAME} #{name} needs to be started."
+        end
+
+        def installed_and_up_to_date?(formula, no_upgrade: false)
+          return true unless formula_needs_to_start?(entry_to_formula(formula))
+          return true if service_is_started?(formula.name)
+
+          old_name = lookup_old_name(formula.name)
+          return true if old_name && service_is_started?(old_name)
+
+          false
+        end
+
+        def entry_to_formula(entry)
+          require "bundle/formula_installer"
+          Homebrew::Bundle::FormulaInstaller.new(entry.name, entry.options)
+        end
+
+        def formula_needs_to_start?(formula)
+          formula.start_service? || formula.restart_service?
+        end
+
+        def service_is_started?(service_name)
+          require "bundle/brew_services"
+          Homebrew::Bundle::BrewServices.started?(service_name)
+        end
+
+        def lookup_old_name(service_name)
+          require "bundle/formula_dumper"
+          @old_names ||= Homebrew::Bundle::FormulaDumper.formula_oldnames
+          old_name = @old_names[service_name]
+          old_name ||= @old_names[service_name.split("/").last]
+          old_name
+        end
+
+        def format_checkable(entries)
+          checkable_entries(entries)
+        end
+      end
+    end
+  end
+end

Library/Homebrew/bundle/brew_services.rb

@@ -0,0 +1,85 @@
+# typed: true # rubocop:todo Sorbet/StrictSigil
+# frozen_string_literal: true
+
+require "services/system"
+
+module Homebrew
+  module Bundle
+    module BrewServices
+      def self.reset!
+        @started_services = nil
+      end
+
+      def self.stop(name, keep: false, verbose: false)
+        return true unless started?(name)
+
+        args = ["services", "stop", name]
+        args << "--keep" if keep
+        return unless Bundle.brew(*args, verbose:)
+
+        started_services.delete(name)
+        true
+      end
+
+      def self.start(name, file: nil, verbose: false)
+        args = ["services", "start", name]
+        args << "--file=#{file}" if file
+        return unless Bundle.brew(*args, verbose:)
+
+        started_services << name
+        true
+      end
+
+      def self.run(name, file: nil, verbose: false)
+        args = ["services", "run", name]
+        args << "--file=#{file}" if file
+        return unless Bundle.brew(*args, verbose:)
+
+        started_services << name
+        true
+      end
+
+      def self.restart(name, file: nil, verbose: false)
+        args = ["services", "restart", name]
+        args << "--file=#{file}" if file
+        return unless Bundle.brew(*args, verbose:)
+
+        started_services << name
+        true
+      end
+
+      def self.started?(name)
+        started_services.include? name
+      end
+
+      def self.started_services
+        @started_services ||= begin
+          states_to_skip = %w[stopped none]
+          Utils.safe_popen_read(HOMEBREW_BREW_FILE, "services", "list").lines.filter_map do |line|
+            name, state, _plist = line.split(/\s+/)
+            next if states_to_skip.include? state
+
+            name
+          end
+        end
+      end
+
+      def self.versioned_service_file(name)
+        env_version = Bundle.formula_versions_from_env(name)
+        return if env_version.nil?
+
+        formula = Formula[name]
+        prefix = formula.rack/env_version
+        return unless prefix.directory?
+
+        service_file = if Homebrew::Services::System.launchctl?
+          prefix/"#{formula.plist_name}.plist"
+        else
+          prefix/"#{formula.service_name}.service"
+        end
+
+        service_file if service_file.file?
+      end
+    end
+  end
+end

Library/Homebrew/bundle/brewfile.rb

@@ -0,0 +1,70 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "bundle/dsl"
+
+module Homebrew
+  module Bundle
+    module Brewfile
+      sig {
+        params(
+          dash_writes_to_stdout: T::Boolean,
+          global:                T::Boolean,
+          file:                  T.nilable(String),
+        ).returns(Pathname)
+      }
+      def self.path(dash_writes_to_stdout: false, global: false, file: nil)
+        env_bundle_file_global = ENV.fetch("HOMEBREW_BUNDLE_FILE_GLOBAL", nil)
+        env_bundle_file = ENV.fetch("HOMEBREW_BUNDLE_FILE", nil)
+        user_config_home = ENV.fetch("HOMEBREW_USER_CONFIG_HOME", nil)
+
+        filename = if global
+          if env_bundle_file_global.present?
+            env_bundle_file_global
+          else
+            raise "'HOMEBREW_BUNDLE_FILE' cannot be specified with '--global'" if env_bundle_file.present?
+
+            if user_config_home && File.exist?("#{user_config_home}/Brewfile")
+              "#{user_config_home}/Brewfile"
+            else
+              Bundle.exchange_uid_if_needed! do
+                "#{Dir.home}/.Brewfile"
+              end
+            end
+          end
+        elsif file.present?
+          handle_file_value(file, dash_writes_to_stdout)
+        elsif env_bundle_file.present?
+          env_bundle_file
+        else
+          "Brewfile"
+        end
+
+        Pathname.new(filename).expand_path(Dir.pwd)
+      end
+
+      sig { params(global: T::Boolean, file: T.nilable(String)).returns(Dsl) }
+      def self.read(global: false, file: nil)
+        Homebrew::Bundle::Dsl.new(Brewfile.path(global:, file:))
+      rescue Errno::ENOENT
+        raise "No Brewfile found"
+      end
+
+      sig {
+        params(
+          filename:              String,
+          dash_writes_to_stdout: T::Boolean,
+        ).returns(String)
+      }
+      private_class_method def self.handle_file_value(filename, dash_writes_to_stdout)
+        if filename != "-"
+          filename
+        elsif dash_writes_to_stdout
+          "/dev/stdout"
+        else
+          "/dev/stdin"
+        end
+      end
+    end
+  end
+end

Library/Homebrew/bundle/cask_checker.rb

@@ -0,0 +1,20 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "bundle/cask_installer"
+
+module Homebrew
+  module Bundle
+    module Checker
+      class CaskChecker < Homebrew::Bundle::Checker::Base
+        PACKAGE_TYPE = :cask
+        PACKAGE_TYPE_NAME = "Cask"
+
+        sig { params(cask: String, no_upgrade: T::Boolean).returns(T::Boolean) }
+        def installed_and_up_to_date?(cask, no_upgrade: false)
+          Homebrew::Bundle::CaskInstaller.cask_installed_and_up_to_date?(cask, no_upgrade:)
+        end
+      end
+    end
+  end
+end

Library/Homebrew/bundle/cask_dumper.rb

@@ -0,0 +1,91 @@
+# typed: true # rubocop:todo Sorbet/StrictSigil
+# frozen_string_literal: true
+
+module Homebrew
+  module Bundle
+    module CaskDumper
+      def self.reset!
+        @casks = nil
+        @cask_names = nil
+        @cask_hash = nil
+        @cask_oldnames = nil
+      end
+
+      def self.cask_names
+        @cask_names ||= casks.map(&:to_s)
+      end
+
+      def self.outdated_cask_names
+        return [] unless Bundle.cask_installed?
+
+        casks.select { |c| c.outdated?(greedy: false) }
+             .map(&:to_s)
+      end
+
+      def self.cask_is_outdated_using_greedy?(cask_name)
+        return false unless Bundle.cask_installed?
+
+        cask = casks.find { |c| c.to_s == cask_name }
+        return false if cask.nil?
+
+        cask.outdated?(greedy: true)
+      end
+
+      def self.dump(describe: false)
+        casks.map do |cask|
+          description = "# #{cask.desc}\n" if describe && cask.desc.present?
+          config = ", args: { #{explicit_s(cask.config)} }" if cask.config.present? && cask.config.explicit.present?
+          "#{description}cask \"#{cask}\"#{config}"
+        end.join("\n")
+      end
+
+      def self.cask_oldnames
+        return @cask_oldnames if @cask_oldnames
+
+        @cask_oldnames = {}
+        casks.each do |c|
+          oldnames = c.old_tokens
+          next if oldnames.blank?
+
+          oldnames.each do |oldname|
+            @cask_oldnames[oldname] = c.full_name
+            if c.full_name.include? "/" # tap cask
+              tap_name = c.full_name.rpartition("/").first
+              @cask_oldnames["#{tap_name}/#{oldname}"] = c.full_name
+            end
+          end
+        end
+        @cask_oldnames
+      end
+
+      def self.formula_dependencies(cask_list)
+        return [] unless Bundle.cask_installed?
+        return [] if cask_list.blank?
+
+        casks.flat_map do |cask|
+          next unless cask_list.include?(cask.to_s)
+
+          cask.depends_on[:formula]
+        end.compact
+      end
+
+      private_class_method def self.casks
+        return [] unless Bundle.cask_installed?
+
+        require "cask/caskroom"
+        @casks ||= Cask::Caskroom.casks
+      end
+
+      private_class_method def self.explicit_s(cask_config)
+        cask_config.explicit.map do |key, value|
+          # inverse of #env - converts :languages config key back to --language flag
+          if key == :languages
+            key = "language"
+            value = cask_config.explicit.fetch(:languages, []).join(",")
+          end
+          "#{key}: \"#{value.to_s.sub(/^#{Dir.home}/, "~")}\""
+        end.join(", ")
+      end
+    end
+  end
+end

Library/Homebrew/bundle/cask_installer.rb

@@ -0,0 +1,122 @@
+# typed: true # rubocop:todo Sorbet/StrictSigil
+# frozen_string_literal: true
+
+module Homebrew
+  module Bundle
+    module CaskInstaller
+      def self.reset!
+        @installed_casks = nil
+        @outdated_casks = nil
+      end
+
+      private_class_method def self.upgrading?(no_upgrade, name, options)
+        return false if no_upgrade
+        return true if outdated_casks.include?(name)
+        return false unless options[:greedy]
+
+        require "bundle/cask_dumper"
+        Homebrew::Bundle::CaskDumper.cask_is_outdated_using_greedy?(name)
+      end
+
+      def self.preinstall!(name, no_upgrade: false, verbose: false, **options)
+        if installed_casks.include?(name) && !upgrading?(no_upgrade, name, options)
+          puts "Skipping install of #{name} cask. It is already installed." if verbose
+          return false
+        end
+
+        true
+      end
+
+      def self.install!(name, preinstall: true, no_upgrade: false, verbose: false, force: false, **options)
+        return true unless preinstall
+
+        full_name = options.fetch(:full_name, name)
+
+        install_result = if installed_casks.include?(name) && upgrading?(no_upgrade, name, options)
+          status = "#{options[:greedy] ? "may not be" : "not"} up-to-date"
+          puts "Upgrading #{name} cask. It is installed but #{status}." if verbose
+          Bundle.brew("upgrade", "--cask", full_name, verbose:)
+        else
+          args = options.fetch(:args, []).filter_map do |k, v|
+            case v
+            when TrueClass
+              "--#{k}"
+            when FalseClass, NilClass
+              nil
+            else
+              "--#{k}=#{v}"
+            end
+          end
+
+          args << "--force" if force
+          args << "--adopt" unless args.include?("--force")
+          args.uniq!
+
+          with_args = " with #{args.join(" ")}" if args.present?
+          puts "Installing #{name} cask#{with_args}. It is not currently installed." if verbose
+
+          if Bundle.brew("install", "--cask", full_name, *args, verbose:)
+            installed_casks << name
+            true
+          else
+            false
+          end
+        end
+        result = install_result
+
+        if cask_installed?(name)
+          postinstall_result = postinstall_change_state!(name:, options:, verbose:)
+          result &&= postinstall_result
+        end
+
+        result
+      end
+
+      private_class_method def self.postinstall_change_state!(name:, options:, verbose:)
+        postinstall = options.fetch(:postinstall, nil)
+        return true if postinstall.blank?
+
+        puts "Running postinstall for #{@name}: #{postinstall}" if verbose
+        Kernel.system(postinstall)
+      end
+
+      def self.cask_installed_and_up_to_date?(cask, no_upgrade: false)
+        return false unless cask_installed?(cask)
+        return true if no_upgrade
+
+        !cask_upgradable?(cask)
+      end
+
+      def self.cask_in_array?(cask, array)
+        return true if array.include?(cask)
+        return true if array.include?(cask.split("/").last)
+
+        require "bundle/cask_dumper"
+        old_names = Homebrew::Bundle::CaskDumper.cask_oldnames
+        old_name = old_names[cask]
+        old_name ||= old_names[cask.split("/").last]
+        return true if old_name && array.include?(old_name)
+
+        false
+      end
+
+      def self.cask_installed?(cask)
+        cask_in_array?(cask, installed_casks)
+      end
+
+      def self.cask_upgradable?(cask)
+        cask_in_array?(cask, outdated_casks)
+      end
+
+      def self.installed_casks
+        require "bundle/cask_dumper"
+        @installed_casks ||= Homebrew::Bundle::CaskDumper.cask_names
+      end
+
+      def self.outdated_casks
+        require "bundle/cask_dumper"
+        @outdated_casks ||= Homebrew::Bundle::CaskDumper.outdated_cask_names
+      end
+    end
+  end
+end

Library/Homebrew/bundle/checker.rb

@@ -0,0 +1,156 @@
+# typed: true
+# frozen_string_literal: true
+
+module Homebrew
+  module Bundle
+    module Checker
+      class Base
+        # Implement these in any subclass
+        # PACKAGE_TYPE = :pkg
+        # PACKAGE_TYPE_NAME = "Package"
+
+        def exit_early_check(packages, no_upgrade:)
+          work_to_be_done = packages.find do |pkg|
+            !installed_and_up_to_date?(pkg, no_upgrade:)
+          end
+
+          Array(work_to_be_done)
+        end
+
+        def failure_reason(name, no_upgrade:)
+          reason = if no_upgrade && Bundle.upgrade_formulae.exclude?(name)
+            "needs to be installed."
+          else
+            "needs to be installed or updated."
+          end
+          "#{self.class.const_get(:PACKAGE_TYPE_NAME)} #{name} #{reason}"
+        end
+
+        def full_check(packages, no_upgrade:)
+          packages.reject { |pkg| installed_and_up_to_date?(pkg, no_upgrade:) }
+                  .map { |pkg| failure_reason(pkg, no_upgrade:) }
+        end
+
+        def checkable_entries(all_entries)
+          require "bundle/skipper"
+          all_entries.select { |e| e.type == self.class.const_get(:PACKAGE_TYPE) }
+                     .reject(&Bundle::Skipper.method(:skip?))
+        end
+
+        def format_checkable(entries)
+          checkable_entries(entries).map(&:name)
+        end
+
+        def installed_and_up_to_date?(_pkg, no_upgrade: false)
+          raise NotImplementedError
+        end
+
+        def find_actionable(entries, exit_on_first_error: false, no_upgrade: false, verbose: false)
+          requested = format_checkable entries
+
+          if exit_on_first_error
+            exit_early_check(requested, no_upgrade:)
+          else
+            full_check(requested, no_upgrade:)
+          end
+        end
+      end
+
+      CheckResult = Struct.new :work_to_be_done, :errors
+
+      CHECKS = {
+        taps_to_tap:           "Taps",
+        casks_to_install:      "Casks",
+        extensions_to_install: "VSCode Extensions",
+        apps_to_install:       "Apps",
+        formulae_to_install:   "Formulae",
+        formulae_to_start:     "Services",
+      }.freeze
+
+      def self.check(global: false, file: nil, exit_on_first_error: false, no_upgrade: false, verbose: false)
+        require "bundle/brewfile"
+        @dsl ||= Brewfile.read(global:, file:)
+
+        check_method_names = CHECKS.keys
+
+        errors = []
+        enumerator = exit_on_first_error ? :find : :map
+
+        work_to_be_done = check_method_names.public_send(enumerator) do |check_method|
+          check_errors =
+            send(check_method, exit_on_first_error:, no_upgrade:, verbose:)
+          any_errors = check_errors.any?
+          errors.concat(check_errors) if any_errors
+          any_errors
+        end
+
+        work_to_be_done = Array(work_to_be_done).flatten.any?
+
+        CheckResult.new work_to_be_done, errors
+      end
+
+      def self.casks_to_install(exit_on_first_error: false, no_upgrade: false, verbose: false)
+        require "bundle/cask_checker"
+        Homebrew::Bundle::Checker::CaskChecker.new.find_actionable(
+          @dsl.entries,
+          exit_on_first_error:, no_upgrade:, verbose:,
+        )
+      end
+
+      def self.formulae_to_install(exit_on_first_error: false, no_upgrade: false, verbose: false)
+        require "bundle/brew_checker"
+        Homebrew::Bundle::Checker::BrewChecker.new.find_actionable(
+          @dsl.entries,
+          exit_on_first_error:, no_upgrade:, verbose:,
+        )
+      end
+
+      def self.taps_to_tap(exit_on_first_error: false, no_upgrade: false, verbose: false)
+        require "bundle/tap_checker"
+        Homebrew::Bundle::Checker::TapChecker.new.find_actionable(
+          @dsl.entries,
+          exit_on_first_error:, no_upgrade:, verbose:,
+        )
+      end
+
+      def self.apps_to_install(exit_on_first_error: false, no_upgrade: false, verbose: false)
+        require "bundle/mac_app_store_checker"
+        Homebrew::Bundle::Checker::MacAppStoreChecker.new.find_actionable(
+          @dsl.entries,
+          exit_on_first_error:, no_upgrade:, verbose:,
+        )
+      end
+
+      def self.extensions_to_install(exit_on_first_error: false, no_upgrade: false, verbose: false)
+        require "bundle/vscode_extension_checker"
+        Homebrew::Bundle::Checker::VscodeExtensionChecker.new.find_actionable(
+          @dsl.entries,
+          exit_on_first_error:, no_upgrade:, verbose:,
+        )
+      end
+
+      def self.formulae_to_start(exit_on_first_error: false, no_upgrade: false, verbose: false)
+        require "bundle/brew_service_checker"
+        Homebrew::Bundle::Checker::BrewServiceChecker.new.find_actionable(
+          @dsl.entries,
+          exit_on_first_error:, no_upgrade:, verbose:,
+        )
+      end
+
+      def self.reset!
+        require "bundle/cask_dumper"
+        require "bundle/formula_dumper"
+        require "bundle/mac_app_store_dumper"
+        require "bundle/tap_dumper"
+        require "bundle/brew_services"
+
+        @dsl = nil
+        Homebrew::Bundle::CaskDumper.reset!
+        Homebrew::Bundle::FormulaDumper.reset!
+        Homebrew::Bundle::MacAppStoreDumper.reset!
+        Homebrew::Bundle::TapDumper.reset!
+        Homebrew::Bundle::BrewServices.reset!
+      end
+    end
+  end
+end

Library/Homebrew/bundle/commands/add.rb

@@ -0,0 +1,17 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "bundle/adder"
+
+module Homebrew
+  module Bundle
+    module Commands
+      module Add
+        sig { params(args: String, type: Symbol, global: T::Boolean, file: T.nilable(String)).void }
+        def self.run(*args, type:, global:, file:)
+          Homebrew::Bundle::Adder.add(*args, type:, global:, file:)
+        end
+      end
+    end
+  end
+end

Library/Homebrew/bundle/commands/check.rb

@@ -0,0 +1,51 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "bundle/checker"
+
+module Homebrew
+  module Bundle
+    module Commands
+      module Check
+        sig {
+          params(global: T::Boolean, file: T.nilable(String), no_upgrade: T::Boolean, verbose: T::Boolean,
+                 quiet: T::Boolean).void
+        }
+        def self.run(global: false, file: nil, no_upgrade: false, verbose: false, quiet: false)
+          output_errors = verbose
+          exit_on_first_error = !verbose
+          check_result = Homebrew::Bundle::Checker.check(
+            global:, file:,
+            exit_on_first_error:, no_upgrade:, verbose:
+          )
+
+          # Allow callers of `brew bundle check` to specify when they've already
+          # output some formulae errors.
+          check_missing_formulae = ENV.fetch("HOMEBREW_BUNDLE_CHECK_ALREADY_OUTPUT_FORMULAE_ERRORS", "")
+                                      .strip
+                                      .split
+
+          if check_result.work_to_be_done
+            puts "brew bundle can't satisfy your Brewfile's dependencies." if check_missing_formulae.blank?
+
+            if output_errors
+              check_result.errors.each do |error|
+                if (match = error.match(/^Formula (.+) needs to be installed/)) &&
+                   check_missing_formulae.include?(match[1])
+                  next
+                end
+
+                puts "→ #{error}"
+              end
+            end
+
+            puts "Satisfy missing dependencies with `brew bundle install`."
+            exit 1
+          end
+
+          puts "The Brewfile's dependencies are satisfied." unless quiet
+        end
+      end
+    end
+  end
+end

Library/Homebrew/bundle/commands/cleanup.rb

@@ -0,0 +1,221 @@
+# typed: true # rubocop:todo Sorbet/StrictSigil
+# frozen_string_literal: true
+
+require "utils/formatter"
+
+module Homebrew
+  module Bundle
+    module Commands
+      # TODO: refactor into multiple modules
+      module Cleanup
+        def self.reset!
+          require "bundle/cask_dumper"
+          require "bundle/formula_dumper"
+          require "bundle/tap_dumper"
+          require "bundle/vscode_extension_dumper"
+          require "bundle/brew_services"
+
+          @dsl = nil
+          @kept_casks = nil
+          @kept_formulae = nil
+          Homebrew::Bundle::CaskDumper.reset!
+          Homebrew::Bundle::FormulaDumper.reset!
+          Homebrew::Bundle::TapDumper.reset!
+          Homebrew::Bundle::VscodeExtensionDumper.reset!
+          Homebrew::Bundle::BrewServices.reset!
+        end
+
+        def self.run(global: false, file: nil, force: false, zap: false, dsl: nil,
+                     formulae: true, casks: true, taps: true, vscode: true)
+          @dsl ||= dsl
+
+          casks = casks ? casks_to_uninstall(global:, file:) : []
+          formulae = formulae ? formulae_to_uninstall(global:, file:) : []
+          taps = taps ? taps_to_untap(global:, file:) : []
+          vscode_extensions = vscode ? vscode_extensions_to_uninstall(global:, file:) : []
+          if force
+            if casks.any?
+              args = zap ? ["--zap"] : []
+              Kernel.system HOMEBREW_BREW_FILE, "uninstall", "--cask", *args, "--force", *casks
+              puts "Uninstalled #{casks.size} cask#{"s" if casks.size != 1}"
+            end
+
+            if formulae.any?
+              Kernel.system HOMEBREW_BREW_FILE, "uninstall", "--formula", "--force", *formulae
+              puts "Uninstalled #{formulae.size} formula#{"e" if formulae.size != 1}"
+            end
+
+            Kernel.system HOMEBREW_BREW_FILE, "untap", *taps if taps.any?
+
+            Bundle.exchange_uid_if_needed! do
+              vscode_extensions.each do |extension|
+                Kernel.system(T.must(Bundle.which_vscode).to_s, "--uninstall-extension", extension)
+              end
+            end
+
+            cleanup = system_output_no_stderr(HOMEBREW_BREW_FILE, "cleanup")
+            puts cleanup unless cleanup.empty?
+          else
+            would_uninstall = false
+
+            if casks.any?
+              puts "Would uninstall casks:"
+              puts Formatter.columns casks
+              would_uninstall = true
+            end
+
+            if formulae.any?
+              puts "Would uninstall formulae:"
+              puts Formatter.columns formulae
+              would_uninstall = true
+            end
+
+            if taps.any?
+              puts "Would untap:"
+              puts Formatter.columns taps
+              would_uninstall = true
+            end
+
+            if vscode_extensions.any?
+              puts "Would uninstall VSCode extensions:"
+              puts Formatter.columns vscode_extensions
+              would_uninstall = true
+            end
+
+            cleanup = system_output_no_stderr(HOMEBREW_BREW_FILE, "cleanup", "--dry-run")
+            unless cleanup.empty?
+              puts "Would `brew cleanup`:"
+              puts cleanup
+            end
+
+            puts "Run `brew bundle cleanup --force` to make these changes." if would_uninstall || !cleanup.empty?
+            exit 1 if would_uninstall
+          end
+        end
+
+        def self.casks_to_uninstall(global: false, file: nil)
+          require "bundle/cask_dumper"
+          Homebrew::Bundle::CaskDumper.cask_names - kept_casks(global:, file:)
+        end
+
+        def self.formulae_to_uninstall(global: false, file: nil)
+          kept_formulae = self.kept_formulae(global:, file:)
+
+          require "bundle/formula_dumper"
+          require "bundle/formula_installer"
+          current_formulae = Homebrew::Bundle::FormulaDumper.formulae
+          current_formulae.reject! do |f|
+            Homebrew::Bundle::FormulaInstaller.formula_in_array?(f[:full_name], kept_formulae)
+          end
+
+          # Don't try to uninstall formulae with keepme references
+          current_formulae.reject! do |f|
+            Formula[f[:full_name]].installed_kegs.any? do |keg|
+              keg.keepme_refs.present?
+            end
+          end
+          current_formulae.map { |f| f[:full_name] }
+        end
+
+        private_class_method def self.kept_formulae(global: false, file: nil)
+          require "bundle/brewfile"
+          require "bundle/formula_dumper"
+          require "bundle/cask_dumper"
+
+          @kept_formulae ||= begin
+            @dsl ||= Brewfile.read(global:, file:)
+
+            kept_formulae = @dsl.entries.select { |e| e.type == :brew }.map(&:name)
+            kept_formulae += Homebrew::Bundle::CaskDumper.formula_dependencies(kept_casks)
+            kept_formulae.map! do |f|
+              Homebrew::Bundle::FormulaDumper.formula_aliases.fetch(
+                f,
+                Homebrew::Bundle::FormulaDumper.formula_oldnames.fetch(f, f),
+              )
+            end
+
+            kept_formulae + recursive_dependencies(Homebrew::Bundle::FormulaDumper.formulae, kept_formulae)
+          end
+        end
+
+        private_class_method def self.kept_casks(global: false, file: nil)
+          require "bundle/brewfile"
+          return @kept_casks if @kept_casks
+
+          @dsl ||= Brewfile.read(global:, file:)
+          kept_casks = @dsl.entries.select { |e| e.type == :cask }.flat_map(&:name)
+          kept_casks.map! do |c|
+            Homebrew::Bundle::CaskDumper.cask_oldnames.fetch(c, c)
+          end
+          @kept_casks = kept_casks
+        end
+
+        private_class_method def self.recursive_dependencies(current_formulae, formulae_names, top_level: true)
+          @checked_formulae_names = [] if top_level
+          dependencies = T.let([], T::Array[Formula])
+
+          formulae_names.each do |name|
+            next if @checked_formulae_names.include?(name)
+
+            formula = current_formulae.find { |f| f[:full_name] == name }
+            next unless formula
+
+            f_deps = formula[:dependencies]
+            unless formula[:poured_from_bottle?]
+              f_deps += formula[:build_dependencies]
+              f_deps.uniq!
+            end
+            next unless f_deps
+            next if f_deps.empty?
+
+            @checked_formulae_names << name
+            f_deps += recursive_dependencies(current_formulae, f_deps, top_level: false)
+            dependencies += f_deps
+          end
+
+          dependencies.uniq
+        end
+
+        IGNORED_TAPS = %w[homebrew/core].freeze
+
+        def self.taps_to_untap(global: false, file: nil)
+          require "bundle/brewfile"
+          require "bundle/tap_dumper"
+
+          @dsl ||= Brewfile.read(global:, file:)
+          kept_formulae = self.kept_formulae(global:, file:).filter_map { lookup_formula(_1) }
+          kept_taps = @dsl.entries.select { |e| e.type == :tap }.map(&:name)
+          kept_taps += kept_formulae.filter_map(&:tap).map(&:name)
+          current_taps = Homebrew::Bundle::TapDumper.tap_names
+          current_taps - kept_taps - IGNORED_TAPS
+        end
+
+        def self.lookup_formula(formula)
+          Formulary.factory(formula)
+        rescue TapFormulaUnavailableError
+          # ignore these as an unavailable formula implies there is no tap to worry about
+          nil
+        end
+
+        def self.vscode_extensions_to_uninstall(global: false, file: nil)
+          require "bundle/brewfile"
+          @dsl ||= Brewfile.read(global:, file:)
+          kept_extensions = @dsl.entries.select { |e| e.type == :vscode }.map { |x| x.name.downcase }
+
+          # To provide a graceful migration from `Brewfile`s that don't yet or
+          # don't want to use `vscode`: don't remove any extensions if we don't
+          # find any in the `Brewfile`.
+          return [].freeze if kept_extensions.empty?
+
+          require "bundle/vscode_extension_dumper"
+          current_extensions = Homebrew::Bundle::VscodeExtensionDumper.extensions
+          current_extensions - kept_extensions
+        end
+
+        def self.system_output_no_stderr(cmd, *args)
+          IO.popen([cmd, *args], err: :close).read
+        end
+      end
+    end
+  end
+end

Library/Homebrew/bundle/commands/dump.rb

@@ -0,0 +1,24 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "bundle/dumper"
+
+module Homebrew
+  module Bundle
+    module Commands
+      module Dump
+        sig {
+          params(global: T::Boolean, file: T.nilable(String), describe: T::Boolean, force: T::Boolean,
+                 no_restart: T::Boolean, taps: T::Boolean, formulae: T::Boolean, casks: T::Boolean,
+                 mas: T::Boolean, whalebrew: T::Boolean, vscode: T::Boolean).void
+        }
+        def self.run(global:, file:, describe:, force:, no_restart:, taps:, formulae:, casks:, mas:, whalebrew:,
+                     vscode:)
+          Homebrew::Bundle::Dumper.dump_brewfile(
+            global:, file:, describe:, force:, no_restart:, taps:, formulae:, casks:, mas:, whalebrew:, vscode:,
+          )
+        end
+      end
+    end
+  end
+end

Library/Homebrew/bundle/commands/exec.rb

@@ -0,0 +1,348 @@
+# typed: true
+# frozen_string_literal: true
+
+require "English"
+require "exceptions"
+require "extend/ENV"
+require "utils"
+require "PATH"
+require "utils/output"
+
+module Homebrew
+  module Bundle
+    module Commands
+      module Exec
+        extend Utils::Output::Mixin
+
+        PATH_LIKE_ENV_REGEX = /.+#{File::PATH_SEPARATOR}/
+
+        sig {
+          params(
+            args:       String,
+            global:     T::Boolean,
+            file:       T.nilable(String),
+            subcommand: String,
+            services:   T::Boolean,
+            check:      T::Boolean,
+          ).void
+        }
+        def self.run(*args, global: false, file: nil, subcommand: "", services: false, check: false)
+          if check
+            require "bundle/commands/check"
+            Homebrew::Bundle::Commands::Check.run(global:, file:, quiet: true)
+          end
+
+          # Store the old environment so we can check if things were already set
+          # before we start mutating it.
+          old_env = ENV.to_h
+
+          # Setup Homebrew's ENV extensions
+          ENV.activate_extensions!
+
+          command = args.first
+          raise UsageError, "No command to execute was specified!" if command.blank?
+
+          require "bundle/brewfile"
+          @dsl = Brewfile.read(global:, file:)
+
+          require "formula"
+          require "formulary"
+
+          ENV.deps = @dsl.entries.filter_map do |entry|
+            next if entry.type != :brew
+
+            Formulary.factory(entry.name)
+          end
+
+          # Allow setting all dependencies to be keg-only
+          # (i.e. should be explicitly in HOMEBREW_*PATHs ahead of HOMEBREW_PREFIX)
+          ENV.keg_only_deps = if ENV["HOMEBREW_BUNDLE_EXEC_ALL_KEG_ONLY_DEPS"].present?
+            ENV.delete("HOMEBREW_BUNDLE_EXEC_ALL_KEG_ONLY_DEPS")
+            ENV.deps
+          else
+            ENV.deps.select(&:keg_only?)
+          end
+          ENV.setup_build_environment
+
+          # Enable compiler flag filtering
+          ENV.refurbish_args
+
+          # Set up `nodenv`, `pyenv` and `rbenv` if present.
+          env_formulae = %w[nodenv pyenv rbenv]
+          ENV.deps.each do |dep|
+            dep_name = dep.name
+            next unless env_formulae.include?(dep_name)
+
+            dep_root = ENV.fetch("HOMEBREW_#{dep_name.upcase}_ROOT", "#{Dir.home}/.#{dep_name}")
+            ENV.prepend_path "PATH", Pathname.new(dep_root)/"shims"
+          end
+
+          # Setup pkgconf, if needed, to help locate packages
+          Bundle.prepend_pkgconf_path_if_needed!
+
+          # For commands which aren't either absolute or relative
+          # Add the command directory to PATH, since it may get blown away by superenv
+          if command.exclude?("/") && (which_command = which(command)).present?
+            ENV.prepend_path "PATH", which_command.dirname.to_s
+          end
+
+          # Replace the formula versions from the environment variables
+          ENV.deps.each do |formula|
+            formula_name = formula.name
+            formula_version = Bundle.formula_versions_from_env(formula_name)
+            next unless formula_version
+
+            ENV.each do |key, value|
+              opt = %r{/opt/#{formula_name}([/:$])}
+              next unless value.match(opt)
+
+              cellar = "/Cellar/#{formula_name}/#{formula_version}\\1"
+
+              # Look for PATH-like environment variables
+              ENV[key] = if key.include?("PATH") && value.match?(PATH_LIKE_ENV_REGEX)
+                rejected_opts = []
+                path = PATH.new(ENV.fetch("PATH"))
+                           .reject do |path_value|
+                  rejected_opts << path_value if path_value.match?(opt)
+                end
+                rejected_opts.each do |path_value|
+                  path.prepend(path_value.gsub(opt, cellar))
+                end
+                path.to_s
+              else
+                value.gsub(opt, cellar)
+              end
+            end
+          end
+
+          # Ensure brew bundle exec/sh/env commands have access to other tools in the PATH
+          if (homebrew_path = ENV.fetch("HOMEBREW_PATH", nil))
+            ENV.append_path "PATH", homebrew_path
+          end
+
+          # For commands which aren't either absolute or relative
+          raise "command was not found in your PATH: #{command}" if command.exclude?("/") && which(command).nil?
+
+          %w[HOMEBREW_TEMP TMPDIR HOMEBREW_TMPDIR].each do |var|
+            value = ENV.fetch(var, nil)
+            next if value.blank?
+            next if File.writable?(value)
+
+            ENV.delete(var)
+          end
+
+          ENV.each do |key, value|
+            # Look for PATH-like environment variables
+            next if key.exclude?("PATH") || !value.match?(PATH_LIKE_ENV_REGEX)
+
+            # Exclude Homebrew shims from the PATH as they don't work
+            # without all Homebrew environment variables and can interfere with
+            # non-Homebrew builds.
+            ENV[key] = PATH.new(value)
+                           .reject do |path_value|
+              path_value.include?("/Homebrew/shims/")
+            end.to_s
+          end
+
+          if subcommand == "env"
+            ENV.sort.each do |key, value|
+              # Skip exporting Homebrew internal variables that won't be used by other tools.
+              # Those Homebrew needs have already been set to global constants and/or are exported again later.
+              # Setting these globally can interfere with nested Homebrew invocations/environments.
+              if key.start_with?("HOMEBREW_", "PORTABLE_RUBY_")
+                ENV.delete(key)
+                next
+              end
+
+              # No need to export empty values.
+              next if value.blank?
+
+              # Skip exporting things that were the same in the old environment.
+              old_value = old_env[key]
+              next if old_value == value
+
+              # Look for PATH-like environment variables
+              if key.include?("PATH") && value.match?(PATH_LIKE_ENV_REGEX)
+                old_values = old_value.to_s.split(File::PATH_SEPARATOR)
+                path = PATH.new(value)
+                           .reject do |path_value|
+                  # Exclude existing/old values as they've already been exported.
+                  old_values.include?(path_value)
+                end
+                next if path.blank?
+
+                puts "export #{key}=\"#{Utils::Shell.sh_quote(path.to_s)}:${#{key}:-}\""
+              else
+                puts "export #{key}=\"#{Utils::Shell.sh_quote(value)}\""
+              end
+            end
+            return
+          elsif subcommand == "sh"
+            preferred_path = Utils::Shell.preferred_path(default: "/bin/bash")
+            notice = unless Homebrew::EnvConfig.no_env_hints?
+              <<~EOS
+                Your shell has been configured to use a build environment from your `Brewfile`.
+                This should help you build stuff.
+                Hide these hints with `HOMEBREW_NO_ENV_HINTS=1` (see `man brew`).
+                When done, type `exit`.
+              EOS
+            end
+            ENV["HOMEBREW_FORCE_API_AUTO_UPDATE"] = nil
+            args = [Utils::Shell.shell_with_prompt("brew bundle", preferred_path:, notice:)]
+          end
+
+          if services
+            require "bundle/brew_services"
+
+            exit_code = T.let(0, Integer)
+            run_services(@dsl.entries) do
+              Kernel.system(*args)
+              if (system_exit_code = $CHILD_STATUS&.exitstatus)
+                exit_code = system_exit_code
+              end
+            end
+            exit!(exit_code)
+          else
+            exec(*args)
+          end
+        end
+
+        sig {
+          params(
+            entries: T::Array[Homebrew::Bundle::Dsl::Entry],
+            _block:  T.proc.params(
+              entry:                Homebrew::Bundle::Dsl::Entry,
+              info:                 T::Hash[String, T.untyped],
+              service_file:         Pathname,
+              conflicting_services: T::Array[T::Hash[String, T.anything]],
+            ).void,
+          ).void
+        }
+        private_class_method def self.map_service_info(entries, &_block)
+          entries_formulae = entries.filter_map do |entry|
+            next if entry.type != :brew
+
+            formula = Formula[entry.name]
+            next unless formula.any_version_installed?
+
+            [entry, formula]
+          end.to_h
+
+          return if entries_formulae.empty?
+
+          conflicts = entries_formulae.to_h do |entry, formula|
+            [
+              entry,
+              (
+                formula.versioned_formulae_names +
+                  formula.conflicts.map(&:name) +
+                  Array(entry.options[:conflicts_with])
+              ).uniq,
+            ]
+          end
+
+          # The formula + everything that could possible conflict with the service
+          names_to_query = entries_formulae.flat_map do |entry, formula|
+            [
+              formula.name,
+              *conflicts.fetch(entry),
+            ]
+          end
+
+          # We parse from a command invocation so that brew wrappers can invoke special actions
+          # for the elevated nature of `brew services`
+          services_info = JSON.parse(
+            Utils.safe_popen_read(HOMEBREW_BREW_FILE, "services", "info", "--json", *names_to_query),
+          )
+
+          entries_formulae.filter_map do |entry, formula|
+            service_file = Bundle::BrewServices.versioned_service_file(entry.name)
+
+            unless service_file&.file?
+              prefix = formula.any_installed_prefix
+              next if prefix.nil?
+
+              service_file = if Homebrew::Services::System.launchctl?
+                prefix/"#{formula.plist_name}.plist"
+              else
+                prefix/"#{formula.service_name}.service"
+              end
+            end
+
+            next unless service_file.file?
+
+            info = services_info.find { |candidate| candidate["name"] == formula.name }
+            conflicting_services = services_info.select do |candidate|
+              next unless candidate["running"]
+
+              conflicts.fetch(entry).include?(candidate["name"])
+            end
+
+            raise "Failed to get service info for #{entry.name}" if info.nil?
+
+            yield entry, info, service_file, conflicting_services
+          end
+        end
+
+        sig { params(entries: T::Array[Homebrew::Bundle::Dsl::Entry], _block: T.nilable(T.proc.void)).void }
+        private_class_method def self.run_services(entries, &_block)
+          entries_to_stop = []
+          services_to_restart = []
+
+          map_service_info(entries) do |entry, info, service_file, conflicting_services|
+            # Don't restart if already running this version
+            loaded_file = Pathname.new(info["loaded_file"].to_s)
+            next if info["running"] && loaded_file.file? && loaded_file.realpath == service_file.realpath
+
+            if info["running"] && !Bundle::BrewServices.stop(info["name"], keep: true)
+              opoo "Failed to stop #{info["name"]} service"
+            end
+
+            conflicting_services.each do |conflict|
+              if Bundle::BrewServices.stop(conflict["name"], keep: true)
+                services_to_restart << conflict["name"] if conflict["registered"]
+              else
+                opoo "Failed to stop #{conflict["name"]} service"
+              end
+            end
+
+            unless Bundle::BrewServices.run(info["name"], file: service_file)
+              opoo "Failed to start #{info["name"]} service"
+            end
+
+            entries_to_stop << entry
+          end
+
+          return unless block_given?
+
+          begin
+            yield
+          ensure
+            # Do a full re-evaluation of services instead state has changed
+            stop_services(entries_to_stop)
+
+            services_to_restart.each do |service|
+              next if Bundle::BrewServices.run(service)
+
+              opoo "Failed to restart #{service} service"
+            end
+          end
+        end
+
+        sig { params(entries: T::Array[Homebrew::Bundle::Dsl::Entry]).void }
+        private_class_method def self.stop_services(entries)
+          map_service_info(entries) do |_, info, _, _|
+            next unless info["loaded"]
+
+            # Try avoid services not started by `brew bundle services`
+            next if Homebrew::Services::System.launchctl? && info["registered"]
+
+            if info["running"] && !Bundle::BrewServices.stop(info["name"], keep: true)
+              opoo "Failed to stop #{info["name"]} service"
+            end
+          end
+        end
+      end
+    end
+  end
+end

Library/Homebrew/bundle/commands/install.rb

@@ -0,0 +1,39 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "bundle/brewfile"
+require "bundle/installer"
+
+module Homebrew
+  module Bundle
+    module Commands
+      module Install
+        sig {
+          params(
+            global:     T::Boolean,
+            file:       T.nilable(String),
+            no_lock:    T::Boolean,
+            no_upgrade: T::Boolean,
+            verbose:    T::Boolean,
+            force:      T::Boolean,
+            quiet:      T::Boolean,
+          ).void
+        }
+        def self.run(global: false, file: nil, no_lock: false, no_upgrade: false, verbose: false, force: false,
+                     quiet: false)
+          @dsl = Brewfile.read(global:, file:)
+          Homebrew::Bundle::Installer.install!(
+            @dsl.entries,
+            global:, file:, no_lock:, no_upgrade:, verbose:, force:, quiet:,
+          ) || exit(1)
+        end
+
+        sig { returns(T.nilable(Dsl)) }
+        def self.dsl
+          @dsl ||= T.let(nil, T.nilable(Dsl))
+          @dsl
+        end
+      end
+    end
+  end
+end

Library/Homebrew/bundle/commands/list.rb

@@ -0,0 +1,25 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "bundle/brewfile"
+require "bundle/lister"
+
+module Homebrew
+  module Bundle
+    module Commands
+      module List
+        sig {
+          params(global: T::Boolean, file: T.nilable(String), formulae: T::Boolean, casks: T::Boolean,
+                 taps: T::Boolean, mas: T::Boolean, whalebrew: T::Boolean, vscode: T::Boolean).void
+        }
+        def self.run(global:, file:, formulae:, casks:, taps:, mas:, whalebrew:, vscode:)
+          parsed_entries = Brewfile.read(global:, file:).entries
+          Homebrew::Bundle::Lister.list(
+            parsed_entries,
+            formulae:, casks:, taps:, mas:, whalebrew:, vscode:,
+          )
+        end
+      end
+    end
+  end
+end

Library/Homebrew/bundle/commands/remove.rb

@@ -0,0 +1,17 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "bundle/remover"
+
+module Homebrew
+  module Bundle
+    module Commands
+      module Remove
+        sig { params(args: T.anything, type: Symbol, global: T::Boolean, file: T.nilable(String)).void }
+        def self.run(*args, type:, global:, file:)
+          Homebrew::Bundle::Remover.remove(*args, type:, global:, file:)
+        end
+      end
+    end
+  end
+end

Library/Homebrew/bundle/dsl.rb

@@ -0,0 +1,134 @@
+# typed: true # rubocop:todo Sorbet/StrictSigil
+# frozen_string_literal: true
+
+module Homebrew
+  module Bundle
+    class Dsl
+      class Entry
+        attr_reader :type, :name, :options
+
+        def initialize(type, name, options = {})
+          @type = type
+          @name = name
+          @options = options
+        end
+
+        def to_s
+          name
+        end
+      end
+
+      attr_reader :entries, :cask_arguments, :input
+
+      def initialize(path)
+        @path = path
+        @input = path.read
+        @entries = []
+        @cask_arguments = {}
+
+        begin
+          process
+        # Want to catch all exceptions for e.g. syntax errors.
+        rescue Exception => e # rubocop:disable Lint/RescueException
+          error_msg = "Invalid Brewfile: #{e.message}"
+          raise RuntimeError, error_msg, e.backtrace
+        end
+      end
+
+      def process
+        instance_eval(@input, @path.to_s)
+      end
+
+      def cask_args(args)
+        raise "cask_args(#{args.inspect}) should be a Hash object" unless args.is_a? Hash
+
+        @cask_arguments.merge!(args)
+      end
+
+      def brew(name, options = {})
+        raise "name(#{name.inspect}) should be a String object" unless name.is_a? String
+        raise "options(#{options.inspect}) should be a Hash object" unless options.is_a? Hash
+
+        name = Homebrew::Bundle::Dsl.sanitize_brew_name(name)
+        @entries << Entry.new(:brew, name, options)
+      end
+
+      def cask(name, options = {})
+        raise "name(#{name.inspect}) should be a String object" unless name.is_a? String
+        raise "options(#{options.inspect}) should be a Hash object" unless options.is_a? Hash
+
+        options[:full_name] = name
+        name = Homebrew::Bundle::Dsl.sanitize_cask_name(name)
+        options[:args] = @cask_arguments.merge options.fetch(:args, {})
+        @entries << Entry.new(:cask, name, options)
+      end
+
+      def mas(name, options = {})
+        id = options[:id]
+        raise "name(#{name.inspect}) should be a String object" unless name.is_a? String
+        raise "options[:id](#{id}) should be an Integer object" unless id.is_a? Integer
+
+        @entries << Entry.new(:mas, name, id:)
+      end
+
+      def whalebrew(name)
+        raise "name(#{name.inspect}) should be a String object" unless name.is_a? String
+
+        @entries << Entry.new(:whalebrew, name)
+      end
+
+      def vscode(name)
+        raise "name(#{name.inspect}) should be a String object" unless name.is_a? String
+
+        @entries << Entry.new(:vscode, name)
+      end
+
+      def tap(name, clone_target = nil, options = {})
+        raise "name(#{name.inspect}) should be a String object" unless name.is_a? String
+        if clone_target && !clone_target.is_a?(String)
+          raise "clone_target(#{clone_target.inspect}) should be nil or a String object"
+        end
+
+        options[:clone_target] = clone_target
+        name = Homebrew::Bundle::Dsl.sanitize_tap_name(name)
+        @entries << Entry.new(:tap, name, options)
+      end
+
+      HOMEBREW_TAP_ARGS_REGEX = %r{^([\w-]+)/(homebrew-)?([\w-]+)$}
+      HOMEBREW_CORE_FORMULA_REGEX = %r{^homebrew/homebrew/([\w+-.@]+)$}i
+      HOMEBREW_TAP_FORMULA_REGEX = %r{^([\w-]+)/([\w-]+)/([\w+-.@]+)$}
+
+      def self.sanitize_brew_name(name)
+        name = name.downcase
+        if name =~ HOMEBREW_CORE_FORMULA_REGEX
+          Regexp.last_match(1)
+        elsif name =~ HOMEBREW_TAP_FORMULA_REGEX
+          user = Regexp.last_match(1)
+          repo = T.must(Regexp.last_match(2))
+          name = Regexp.last_match(3)
+          "#{user}/#{repo.sub("homebrew-", "")}/#{name}"
+        else
+          name
+        end
+      end
+
+      def self.sanitize_tap_name(name)
+        name = name.downcase
+        if name =~ HOMEBREW_TAP_ARGS_REGEX
+          "#{Regexp.last_match(1)}/#{Regexp.last_match(3)}"
+        else
+          name
+        end
+      end
+
+      def self.sanitize_cask_name(name)
+        name = name.split("/").last if name.include?("/")
+        name.downcase
+      end
+
+      def self.pluralize_dependency(installed_count)
+        (installed_count == 1) ? "dependency" : "dependencies"
+      end
+    end
+  end
+end

Library/Homebrew/bundle/dumper.rb

@@ -0,0 +1,89 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "fileutils"
+require "pathname"
+
+module Homebrew
+  module Bundle
+    module Dumper
+      sig { params(brewfile_path: Pathname, force: T::Boolean).returns(T::Boolean) }
+      private_class_method def self.can_write_to_brewfile?(brewfile_path, force: false)
+        raise "#{brewfile_path} already exists" if should_not_write_file?(brewfile_path, overwrite: force)
+
+        true
+      end
+
+      sig {
+        params(
+          describe:   T::Boolean,
+          no_restart: T::Boolean,
+          formulae:   T::Boolean,
+          taps:       T::Boolean,
+          casks:      T::Boolean,
+          mas:        T::Boolean,
+          whalebrew:  T::Boolean,
+          vscode:     T::Boolean,
+        ).returns(String)
+      }
+      def self.build_brewfile(describe:, no_restart:, formulae:, taps:, casks:, mas:, whalebrew:, vscode:)
+        require "bundle/tap_dumper"
+        require "bundle/formula_dumper"
+        require "bundle/cask_dumper"
+        require "bundle/mac_app_store_dumper"
+        require "bundle/whalebrew_dumper"
+        require "bundle/vscode_extension_dumper"
+
+        content = []
+        content << TapDumper.dump if taps
+        content << FormulaDumper.dump(describe:, no_restart:) if formulae
+        content << CaskDumper.dump(describe:) if casks
+        content << MacAppStoreDumper.dump if mas
+        content << WhalebrewDumper.dump if whalebrew
+        content << VscodeExtensionDumper.dump if vscode
+        "#{content.reject(&:empty?).join("\n")}\n"
+      end
+
+      sig {
+        params(
+          global:     T::Boolean,
+          file:       T.nilable(String),
+          describe:   T::Boolean,
+          force:      T::Boolean,
+          no_restart: T::Boolean,
+          formulae:   T::Boolean,
+          taps:       T::Boolean,
+          casks:      T::Boolean,
+          mas:        T::Boolean,
+          whalebrew:  T::Boolean,
+          vscode:     T::Boolean,
+        ).void
+      }
+      def self.dump_brewfile(global:, file:, describe:, force:, no_restart:, formulae:, taps:, casks:, mas:,
+                             whalebrew:, vscode:)
+        path = brewfile_path(global:, file:)
+        can_write_to_brewfile?(path, force:)
+        content = build_brewfile(describe:, no_restart:, taps:, formulae:, casks:, mas:, whalebrew:, vscode:)
+        write_file path, content
+      end
+
+      sig { params(global: T::Boolean, file: T.nilable(String)).returns(Pathname) }
+      def self.brewfile_path(global: false, file: nil)
+        require "bundle/brewfile"
+        Brewfile.path(dash_writes_to_stdout: true, global:, file:)
+      end
+
+      sig { params(file: Pathname, overwrite: T::Boolean).returns(T::Boolean) }
+      private_class_method def self.should_not_write_file?(file, overwrite: false)
+        file.exist? && !overwrite && file.to_s != "/dev/stdout"
+      end
+
+      sig { params(file: Pathname, content: String).void }
+      def self.write_file(file, content)
+        Bundle.exchange_uid_if_needed! do
+          file.open("w") { |io| io.write content }
+        end
+      end
+    end
+  end
+end

Library/Homebrew/bundle/formula_dumper.rb

@@ -0,0 +1,247 @@
+# typed: true
+# frozen_string_literal: true
+
+require "json"
+require "tsort"
+require "utils/output"
+
+module Homebrew
+  module Bundle
+    # TODO: refactor into multiple modules
+    module FormulaDumper
+      extend Utils::Output::Mixin
+
+      def self.reset!
+        require "bundle/brew_services"
+
+        Homebrew::Bundle::BrewServices.reset!
+        @formulae = nil
+        @formulae_by_full_name = nil
+        @formulae_by_name = nil
+        @formula_aliases = nil
+        @formula_oldnames = nil
+      end
+
+      def self.formulae
+        return @formulae if @formulae
+
+        formulae_by_full_name
+        @formulae
+      end
+
+      def self.formulae_by_full_name(name = nil)
+        return @formulae_by_full_name[name] if name.present? && @formulae_by_full_name&.key?(name)
+
+        require "formula"
+        require "formulary"
+        Formulary.enable_factory_cache!
+
+        @formulae_by_name ||= {}
+        @formulae_by_full_name ||= {}
+
+        if name.nil?
+          formulae = Formula.installed.map { add_formula(_1) }
+          sort!(formulae)
+          return @formulae_by_full_name
+        end
+
+        formula = Formula[name]
+        add_formula(formula)
+      rescue FormulaUnavailableError => e
+        opoo "'#{name}' formula is unreadable: #{e}"
+        {}
+      end
+
+      def self.formulae_by_name(name)
+        formulae_by_full_name(name) || @formulae_by_name[name]
+      end
+
+      def self.dump(describe: false, no_restart: false)
+        require "bundle/brew_services"
+
+        requested_formula = formulae.select do |f|
+          f[:installed_on_request?] || !f[:installed_as_dependency?]
+        end
+        requested_formula.map do |f|
+          brewline = if describe && f[:desc].present?
+            f[:desc].split("\n").map { |s| "# #{s}\n" }.join
+          else
+            ""
+          end
+          brewline += "brew \"#{f[:full_name]}\""
+
+          args = f[:args].map { |arg| "\"#{arg}\"" }.sort.join(", ")
+          brewline += ", args: [#{args}]" unless f[:args].empty?
+          brewline += ", restart_service: :changed" if !no_restart && BrewServices.started?(f[:full_name])
+          brewline += ", link: #{f[:link?]}" unless f[:link?].nil?
+          brewline
+        end.join("\n")
+      end
+
+      def self.formula_aliases
+        return @formula_aliases if @formula_aliases
+
+        @formula_aliases = {}
+        formulae.each do |f|
+          aliases = f[:aliases]
+          next if aliases.blank?
+
+          aliases.each do |a|
+            @formula_aliases[a] = f[:full_name]
+            if f[:full_name].include? "/" # tap formula
+              tap_name = f[:full_name].rpartition("/").first
+              @formula_aliases["#{tap_name}/#{a}"] = f[:full_name]
+            end
+          end
+        end
+        @formula_aliases
+      end
+
+      def self.formula_oldnames
+        return @formula_oldnames if @formula_oldnames
+
+        @formula_oldnames = {}
+        formulae.each do |f|
+          oldnames = f[:oldnames]
+          next if oldnames.blank?
+
+          oldnames.each do |oldname|
+            @formula_oldnames[oldname] = f[:full_name]
+            if f[:full_name].include? "/" # tap formula
+              tap_name = f[:full_name].rpartition("/").first
+              @formula_oldnames["#{tap_name}/#{oldname}"] = f[:full_name]
+            end
+          end
+        end
+        @formula_oldnames
+      end
+
+      private_class_method def self.add_formula(formula)
+        hash = formula_to_hash formula
+
+        @formulae_by_name[hash[:name]] = hash
+        @formulae_by_full_name[hash[:full_name]] = hash
+
+        hash
+      end
+
+      private_class_method def self.formula_to_hash(formula)
+        keg = if formula.linked?
+          link = true if formula.keg_only?
+          formula.linked_keg
+        else
+          link = false unless formula.keg_only?
+          formula.any_installed_prefix
+        end
+
+        if keg
+          require "tab"
+
+          tab = Tab.for_keg(keg)
+          args = tab.used_options.map(&:name)
+          version = begin
+            keg.realpath.basename
+          rescue
+            # silently handle broken symlinks
+            nil
+          end.to_s
+          args << "HEAD" if version.start_with?("HEAD")
+          installed_as_dependency = tab.installed_as_dependency
+          installed_on_request = tab.installed_on_request
+          runtime_dependencies = if (runtime_deps = tab.runtime_dependencies)
+            runtime_deps.filter_map { |d| d["full_name"] }
+
+          end
+          poured_from_bottle = tab.poured_from_bottle
+        end
+
+        runtime_dependencies ||= formula.runtime_dependencies.map(&:name)
+
+        bottled = if (stable = formula.stable) && stable.bottle_defined?
+          bottle_hash = formula.bottle_hash.deep_symbolize_keys
+          stable.bottled?
+        end
+
+        {
+          name:                     formula.name,
+          desc:                     formula.desc,
+          oldnames:                 formula.oldnames,
+          full_name:                formula.full_name,
+          aliases:                  formula.aliases,
+          any_version_installed?:   formula.any_version_installed?,
+          args:                     Array(args).uniq,
+          version:,
+          installed_as_dependency?: installed_as_dependency || false,
+          installed_on_request?:    installed_on_request || false,
+          dependencies:             runtime_dependencies,
+          build_dependencies:       formula.deps.select(&:build?).map(&:name).uniq,
+          conflicts_with:           formula.conflicts.map(&:name),
+          pinned?:                  formula.pinned? || false,
+          outdated?:                formula.outdated? || false,
+          link?:                    link,
+          poured_from_bottle?:      poured_from_bottle || false,
+          bottle:                   bottle_hash || false,
+          bottled:                  bottled || false,
+          official_tap:             formula.tap&.official? || false,
+        }
+      end
+
+      class Topo < Hash
+        include TSort
+
+        def each_key(&block)
+          keys.each(&block)
+        end
+        alias tsort_each_node each_key
+
+        def tsort_each_child(node, &block)
+          fetch(node.downcase).sort.each(&block)
+        end
+      end
+
+      private_class_method def self.sort!(formulae)
+        # Step 1: Sort by formula full name while putting tap formulae behind core formulae.
+        #         So we can have a nicer output.
+        formulae = formulae.sort do |a, b|
+          if a[:full_name].exclude?("/") && b[:full_name].include?("/")
+            -1
+          elsif a[:full_name].include?("/") && b[:full_name].exclude?("/")
+            1
+          else
+            a[:full_name] <=> b[:full_name]
+          end
+        end
+
+        # Step 2: Sort by formula dependency topology.
+        topo = Topo.new
+        formulae.each do |f|
+          topo[f[:name]] = topo[f[:full_name]] = f[:dependencies].filter_map do |dep|
+            ff = formulae_by_name(dep)
+            next if ff.blank?
+            next unless ff[:any_version_installed?]
+
+            ff[:full_name]
+          end
+        end
+        @formulae = topo.tsort
+                        .map { |name| @formulae_by_full_name[name] || @formulae_by_name[name] }
+                        .uniq { |f| f[:full_name] }
+      rescue TSort::Cyclic => e
+        e.message =~ /\["([^"]*)".*"([^"]*)"\]/
+        cycle_first = Regexp.last_match(1)
+        cycle_last = Regexp.last_match(2)
+        odie e.message if !cycle_first || !cycle_last
+
+        odie <<~EOS
+          Formulae dependency graph sorting failed (likely due to a circular dependency):
+          #{cycle_first}: #{topo[cycle_first] if topo}
+          #{cycle_last}: #{topo[cycle_last] if topo}
+          Please run the following commands and try again:
+            brew update
+            brew uninstall --ignore-dependencies --force #{cycle_first} #{cycle_last}
+            brew install #{cycle_first} #{cycle_last}
+        EOS
+      end
+    end
+  end
+end

Library/Homebrew/bundle/formula_installer.rb

@@ -0,0 +1,316 @@
+# typed: true # rubocop:todo Sorbet/StrictSigil
+# frozen_string_literal: true
+
+module Homebrew
+  module Bundle
+    class FormulaInstaller
+      def self.reset!
+        @installed_formulae = nil
+        @outdated_formulae = nil
+        @pinned_formulae = nil
+      end
+
+      def self.preinstall!(name, no_upgrade: false, verbose: false, **options)
+        new(name, options).preinstall!(no_upgrade:, verbose:)
+      end
+
+      def self.install!(name, preinstall: true, no_upgrade: false, verbose: false, force: false, **options)
+        new(name, options).install!(preinstall:, no_upgrade:, verbose:, force:)
+      end
+
+      def initialize(name, options = {})
+        @full_name = name
+        @name = name.split("/").last
+        @args = options.fetch(:args, []).map { |arg| "--#{arg}" }
+        @conflicts_with_arg = options.fetch(:conflicts_with, [])
+        @restart_service = options[:restart_service]
+        @start_service = options.fetch(:start_service, @restart_service)
+        @link = options.fetch(:link, nil)
+        @postinstall = options.fetch(:postinstall, nil)
+        @version_file = options.fetch(:version_file, nil)
+        @changed = nil
+      end
+
+      def preinstall!(no_upgrade: false, verbose: false)
+        if installed? && (self.class.no_upgrade_with_args?(no_upgrade, @name) || !upgradable?)
+          puts "Skipping install of #{@name} formula. It is already installed." if verbose
+          @changed = nil
+          return false
+        end
+
+        true
+      end
+
+      def install!(preinstall: true, no_upgrade: false, verbose: false, force: false)
+        install_result = if preinstall
+          install_change_state!(no_upgrade:, verbose:, force:)
+        else
+          true
+        end
+        result = install_result
+
+        if installed?
+          service_result = service_change_state!(verbose:)
+          result &&= service_result
+
+          link_result = link_change_state!(verbose:)
+          result &&= link_result
+
+          postinstall_result = postinstall_change_state!(verbose:)
+          result &&= postinstall_result
+
+          if result && @version_file.present?
+            # Use the version from the environment if it hasn't changed.
+            # Strip the revision number because it's not part of the non-Homebrew version.
+            version = if !changed? && (env_version = Bundle.formula_versions_from_env(@name))
+              PkgVersion.parse(env_version).version
+            else
+              Formula[@full_name].version
+            end.to_s
+            File.write(@version_file, "#{version}\n")
+
+            puts "Wrote #{@name} version #{version} to #{@version_file}" if verbose
+          end
+        end
+
+        result
+      end
+
+      def install_change_state!(no_upgrade:, verbose:, force:)
+        return false unless resolve_conflicts!(verbose:)
+
+        if installed?
+          upgrade_formula!(verbose:, force:)
+        else
+          install_formula!(verbose:, force:)
+        end
+      end
+
+      def start_service?
+        @start_service.present?
+      end
+
+      def start_service_needed?
+        require "bundle/brew_services"
+        start_service? && !BrewServices.started?(@full_name)
+      end
+
+      def restart_service?
+        @restart_service.present?
+      end
+
+      def restart_service_needed?
+        return false unless restart_service?
+
+        # Restart if `restart_service: :always`, or if the formula was installed or upgraded
+        @restart_service.to_s == "always" || changed?
+      end
+
+      def changed?
+        @changed.present?
+      end
+
+      def service_change_state!(verbose:)
+        require "bundle/brew_services"
+
+        file = Bundle::BrewServices.versioned_service_file(@name)
+
+        if restart_service_needed?
+          puts "Restarting #{@name} service." if verbose
+          BrewServices.restart(@full_name, file:, verbose:)
+        elsif start_service_needed?
+          puts "Starting #{@name} service." if verbose
+          BrewServices.start(@full_name, file:, verbose:)
+        else
+          true
+        end
+      end
+
+      def link_change_state!(verbose: false)
+        link_args = []
+        link_args << "--force" if unlinked_and_keg_only?
+
+        cmd = case @link
+        when :overwrite
+          link_args << "--overwrite"
+          "link" unless linked?
+        when true
+          "link" unless linked?
+        when false
+          "unlink" if linked?
+        when nil
+          if keg_only?
+            "unlink" if linked?
+          else
+            "link" unless linked?
+          end
+        end
+
+        if cmd.present?
+          verb = "#{cmd}ing".capitalize
+          with_args = " with #{link_args.join(" ")}" if link_args.present?
+          puts "#{verb} #{@name} formula#{with_args}." if verbose
+          return Bundle.brew(cmd, *link_args, @name, verbose:)
+        end
+
+        true
+      end
+
+      def postinstall_change_state!(verbose:)
+        return true if @postinstall.blank?
+        return true unless changed?
+
+        puts "Running postinstall for #{@name}: #{@postinstall}" if verbose
+        Kernel.system(@postinstall)
+      end
+
+      def self.formula_installed_and_up_to_date?(formula, no_upgrade: false)
+        return false unless formula_installed?(formula)
+        return true if no_upgrade_with_args?(no_upgrade, formula)
+
+        !formula_upgradable?(formula)
+      end
+
+      def self.no_upgrade_with_args?(no_upgrade, formula_name)
+        no_upgrade && Bundle.upgrade_formulae.exclude?(formula_name)
+      end
+
+      def self.formula_in_array?(formula, array)
+        return true if array.include?(formula)
+        return true if array.include?(formula.split("/").last)
+
+        require "bundle/formula_dumper"
+        old_names = Homebrew::Bundle::FormulaDumper.formula_oldnames
+        old_name = old_names[formula]
+        old_name ||= old_names[formula.split("/").last]
+        return true if old_name && array.include?(old_name)
+
+        resolved_full_name = Homebrew::Bundle::FormulaDumper.formula_aliases[formula]
+        return false unless resolved_full_name
+        return true if array.include?(resolved_full_name)
+        return true if array.include?(resolved_full_name.split("/").last)
+
+        false
+      end
+
+      def self.formula_installed?(formula)
+        formula_in_array?(formula, installed_formulae)
+      end
+
+      def self.formula_upgradable?(formula)
+        # Check local cache first and then authoritative Homebrew source.
+        formula_in_array?(formula, upgradable_formulae) && Formula[formula].outdated?
+      end
+
+      def self.installed_formulae
+        @installed_formulae ||= formulae.map { |f| f[:name] }
+      end
+
+      def self.upgradable_formulae
+        outdated_formulae - pinned_formulae
+      end
+
+      def self.outdated_formulae
+        @outdated_formulae ||= formulae.filter_map { |f| f[:name] if f[:outdated?] }
+      end
+
+      def self.pinned_formulae
+        @pinned_formulae ||= formulae.filter_map { |f| f[:name] if f[:pinned?] }
+      end
+
+      def self.formulae
+        require "bundle/formula_dumper"
+        Homebrew::Bundle::FormulaDumper.formulae
+      end
+
+      private
+
+      def installed?
+        FormulaInstaller.formula_installed?(@name)
+      end
+
+      def linked?
+        Formula[@full_name].linked?
+      end
+
+      def keg_only?
+        Formula[@full_name].keg_only?
+      end
+
+      def unlinked_and_keg_only?
+        !linked? && keg_only?
+      end
+
+      def upgradable?
+        FormulaInstaller.formula_upgradable?(@name)
+      end
+
+      def conflicts_with
+        @conflicts_with ||= begin
+          conflicts_with = Set.new
+          conflicts_with += @conflicts_with_arg
+
+          require "bundle/formula_dumper"
+          if (formula = Homebrew::Bundle::FormulaDumper.formulae_by_full_name(@full_name)) &&
+             (formula_conflicts_with = formula[:conflicts_with])
+            conflicts_with += formula_conflicts_with
+          end
+
+          conflicts_with.to_a
+        end
+      end
+
+      def resolve_conflicts!(verbose:)
+        conflicts_with.each do |conflict|
+          next unless FormulaInstaller.formula_installed?(conflict)
+
+          if verbose
+            puts <<~EOS
+              Unlinking #{conflict} formula.
+              It is currently installed and conflicts with #{@name}.
+            EOS
+          end
+          return false unless Bundle.brew("unlink", conflict, verbose:)
+
+          next unless restart_service?
+
+          require "bundle/brew_services"
+          puts "Stopping #{conflict} service (if it is running)." if verbose
+          BrewServices.stop(conflict, verbose:)
+        end
+
+        true
+      end
+
+      def install_formula!(verbose:, force:)
+        install_args = @args.dup
+        install_args << "--force" << "--overwrite" if force
+        install_args << "--skip-link" if @link == false
+        with_args = " with #{install_args.join(" ")}" if install_args.present?
+        puts "Installing #{@name} formula#{with_args}. It is not currently installed." if verbose
+        unless Bundle.brew("install", "--formula", @full_name, *install_args, verbose:)
+          @changed = nil
+          return false
+        end
+
+        FormulaInstaller.installed_formulae << @name
+        @changed = true
+        true
+      end
+
+      def upgrade_formula!(verbose:, force:)
+        upgrade_args = []
+        upgrade_args << "--force" if force
+        with_args = " with #{upgrade_args.join(" ")}" if upgrade_args.present?
+        puts "Upgrading #{@name} formula#{with_args}. It is installed but not up-to-date." if verbose
+        unless Bundle.brew("upgrade", "--formula", @name, *upgrade_args, verbose:)
+          @changed = nil
+          return false
+        end
+
+        @changed = true
+        true
+      end
+    end
+  end
+end

Library/Homebrew/bundle/installer.rb

@@ -0,0 +1,84 @@
+# typed: true # rubocop:todo Sorbet/StrictSigil
+# frozen_string_literal: true
+
+require "bundle/dsl"
+require "bundle/formula_installer"
+require "bundle/cask_installer"
+require "bundle/mac_app_store_installer"
+require "bundle/whalebrew_installer"
+require "bundle/vscode_extension_installer"
+require "bundle/tap_installer"
+require "bundle/skipper"
+
+module Homebrew
+  module Bundle
+    module Installer
+      def self.install!(entries, global: false, file: nil, no_lock: false, no_upgrade: false, verbose: false,
+                        force: false, quiet: false)
+        success = 0
+        failure = 0
+
+        entries.each do |entry|
+          name = entry.name
+          args = [name]
+          options = {}
+          verb = "Installing"
+          type = entry.type
+          cls = case type
+          when :brew
+            options = entry.options
+            verb = "Upgrading" if Homebrew::Bundle::FormulaInstaller.formula_upgradable?(name)
+            Homebrew::Bundle::FormulaInstaller
+          when :cask
+            options = entry.options
+            verb = "Upgrading" if Homebrew::Bundle::CaskInstaller.cask_upgradable?(name)
+            Homebrew::Bundle::CaskInstaller
+          when :mas
+            args << entry.options[:id]
+            Homebrew::Bundle::MacAppStoreInstaller
+          when :whalebrew
+            Homebrew::Bundle::WhalebrewInstaller
+          when :vscode
+            Homebrew::Bundle::VscodeExtensionInstaller
+          when :tap
+            verb = "Tapping"
+            options = entry.options
+            Homebrew::Bundle::TapInstaller
+          end
+
+          next if cls.nil?
+          next if Homebrew::Bundle::Skipper.skip? entry
+
+          preinstall = if cls.preinstall!(*args, **options, no_upgrade:, verbose:)
+            puts Formatter.success("#{verb} #{name}")
+            true
+          else
+            puts "Using #{name}" unless quiet
+            false
+          end
+
+          if cls.install!(*args, **options,
+                         preinstall:, no_upgrade:, verbose:, force:)
+            success += 1
+          else
+            $stderr.puts Formatter.error("#{verb} #{name} has failed!")
+            failure += 1
+          end
+        end
+
+        unless failure.zero?
+          dependency = Homebrew::Bundle::Dsl.pluralize_dependency(failure)
+          $stderr.puts Formatter.error "`brew bundle` failed! #{failure} Brewfile #{dependency} failed to install"
+          return false
+        end
+
+        unless quiet
+          dependency = Homebrew::Bundle::Dsl.pluralize_dependency(success)
+          puts Formatter.success "`brew bundle` complete! #{success} Brewfile #{dependency} now installed."
+        end
+
+        true
+      end
+    end
+  end
+end

Library/Homebrew/bundle/lister.rb

@@ -0,0 +1,33 @@
+# typed: strict
+# frozen_string_literal: true
+
+module Homebrew
+  module Bundle
+    module Lister
+      sig {
+        params(entries: T::Array[Homebrew::Bundle::Dsl::Entry], formulae: T::Boolean, casks: T::Boolean,
+               taps: T::Boolean, mas: T::Boolean, whalebrew: T::Boolean, vscode: T::Boolean).void
+      }
+      def self.list(entries, formulae:, casks:, taps:, mas:, whalebrew:, vscode:)
+        entries.each do |entry|
+          puts entry.name if show?(entry.type, formulae:, casks:, taps:, mas:, whalebrew:, vscode:)
+        end
+      end
+
+      sig {
+        params(type: Symbol, formulae: T::Boolean, casks: T::Boolean, taps: T::Boolean, mas: T::Boolean,
+               whalebrew: T::Boolean, vscode: T::Boolean).returns(T::Boolean)
+      }
+      private_class_method def self.show?(type, formulae:, casks:, taps:, mas:, whalebrew:, vscode:)
+        return true if formulae && type == :brew
+        return true if casks && type == :cask
+        return true if taps && type == :tap
+        return true if mas && type == :mas
+        return true if whalebrew && type == :whalebrew
+        return true if vscode && type == :vscode
+
+        false
+      end
+    end
+  end
+end

Library/Homebrew/bundle/mac_app_store_checker.rb

@@ -0,0 +1,36 @@
+# typed: true # rubocop:todo Sorbet/StrictSigil
+# frozen_string_literal: true
+
+require "bundle/mac_app_store_installer"
+
+module Homebrew
+  module Bundle
+    module Checker
+      class MacAppStoreChecker < Homebrew::Bundle::Checker::Base
+        PACKAGE_TYPE = :mas
+        PACKAGE_TYPE_NAME = "App"
+
+        def installed_and_up_to_date?(id, no_upgrade: false)
+          Homebrew::Bundle::MacAppStoreInstaller.app_id_installed_and_up_to_date?(id, no_upgrade:)
+        end
+
+        def format_checkable(entries)
+          checkable_entries(entries).to_h { |e| [e.options[:id], e.name] }
+        end
+
+        def exit_early_check(app_ids_with_names, no_upgrade:)
+          work_to_be_done = app_ids_with_names.find do |id, _name|
+            !installed_and_up_to_date?(id, no_upgrade:)
+          end
+
+          Array(work_to_be_done)
+        end
+
+        def full_check(app_ids_with_names, no_upgrade:)
+          app_ids_with_names.reject { |id, _name| installed_and_up_to_date?(id, no_upgrade:) }
+                            .map { |_id, name| failure_reason(name, no_upgrade:) }
+        end
+      end
+    end
+  end
+end

Library/Homebrew/bundle/mac_app_store_dumper.rb

@@ -0,0 +1,44 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "json"
+
+module Homebrew
+  module Bundle
+    module MacAppStoreDumper
+      sig { void }
+      def self.reset!
+        @apps = nil
+      end
+
+      sig { returns(T::Array[[String, String]]) }
+      def self.apps
+        @apps ||= T.let(nil, T.nilable(T::Array[[String, String]]))
+        @apps ||= if Bundle.mas_installed?
+          `mas list 2>/dev/null`.split("\n").map do |app|
+            app_details = app.match(/\A(?<id>\d+)\s+(?<name>.*?)\s+\((?<version>[\d.]*)\)\Z/)
+
+            # Only add the application details should we have a valid match.
+            # Strip unprintable characters
+            if app_details
+              name = T.must(app_details[:name])
+              [T.must(app_details[:id]), name.gsub(/[[:cntrl:]]|\p{C}/, "")]
+            end
+          end
+        else
+          []
+        end.compact
+      end
+
+      sig { returns(T::Array[Integer]) }
+      def self.app_ids
+        apps.map { |id, _| id.to_i }
+      end
+
+      sig { returns(String) }
+      def self.dump
+        apps.sort_by { |_, name| name.downcase }.map { |id, name| "mas \"#{name}\", id: #{id}" }.join("\n")
+      end
+    end
+  end
+end

Library/Homebrew/bundle/mac_app_store_installer.rb

@@ -0,0 +1,79 @@
+# typed: true # rubocop:todo Sorbet/StrictSigil
+# frozen_string_literal: true
+
+require "os"
+
+module Homebrew
+  module Bundle
+    module MacAppStoreInstaller
+      def self.reset!
+        @installed_app_ids = nil
+        @outdated_app_ids = nil
+      end
+
+      def self.preinstall!(name, id, no_upgrade: false, verbose: false)
+        unless Bundle.mas_installed?
+          puts "Installing mas. It is not currently installed." if verbose
+          Bundle.brew("install", "mas", verbose:)
+          raise "Unable to install #{name} app. mas installation failed." unless Bundle.mas_installed?
+        end
+
+        if app_id_installed?(id) &&
+           (no_upgrade || !app_id_upgradable?(id))
+          puts "Skipping install of #{name} app. It is already installed." if verbose
+          return false
+        end
+
+        true
+      end
+
+      def self.install!(name, id, preinstall: true, no_upgrade: false, verbose: false, force: false)
+        return true unless preinstall
+
+        if app_id_installed?(id)
+          puts "Upgrading #{name} app. It is installed but not up-to-date." if verbose
+          return false unless Bundle.system "mas", "upgrade", id.to_s, verbose: verbose
+
+          return true
+        end
+
+        puts "Installing #{name} app. It is not currently installed." if verbose
+
+        return false unless Bundle.system "mas", "install", id.to_s, verbose: verbose
+
+        installed_app_ids << id
+        true
+      end
+
+      def self.app_id_installed_and_up_to_date?(id, no_upgrade: false)
+        return false unless app_id_installed?(id)
+        return true if no_upgrade
+
+        !app_id_upgradable?(id)
+      end
+
+      def self.app_id_installed?(id)
+        installed_app_ids.include? id
+      end
+
+      def self.app_id_upgradable?(id)
+        outdated_app_ids.include? id
+      end
+
+      def self.installed_app_ids
+        require "bundle/mac_app_store_dumper"
+        @installed_app_ids ||= Homebrew::Bundle::MacAppStoreDumper.app_ids
+      end
+
+      def self.outdated_app_ids
+        @outdated_app_ids ||= if Bundle.mas_installed?
+          `mas outdated 2>/dev/null`.split("\n").map do |app|
+            app.split(" ", 2).first.to_i
+          end
+        else
+          []
+        end
+      end
+    end
+  end
+end

Library/Homebrew/bundle/remover.rb

@@ -0,0 +1,52 @@
+# typed: true # rubocop:todo Sorbet/StrictSigil
+# frozen_string_literal: true
+
+require "utils/output"
+
+module Homebrew
+  module Bundle
+    module Remover
+      extend ::Utils::Output::Mixin
+
+      def self.remove(*args, type:, global:, file:)
+        require "bundle/brewfile"
+        require "bundle/dumper"
+
+        brewfile = Brewfile.read(global:, file:)
+        content = brewfile.input
+        entry_type = type.to_s if type != :none
+        escaped_args = args.flat_map do |arg|
+          names = if type == :brew
+            possible_names(arg)
+          else
+            [arg]
+          end
+
+          names.uniq.map { |a| Regexp.escape(a) }
+        end
+
+        new_content = content.split("\n")
+                             .grep_v(/#{entry_type}(\s+|\(\s*)"(#{escaped_args.join("|")})"/)
+                             .join("\n") << "\n"
+
+        if content.chomp == new_content.chomp &&
+           type == :none &&
+           args.any? { |arg| possible_names(arg, raise_error: false).count > 1 }
+          opoo "No matching entries found in Brewfile. Try again with `--formula` to match formula " \
+               "aliases and old formula names."
+          return
+        end
+
+        path = Dumper.brewfile_path(global:, file:)
+        Dumper.write_file path, new_content
+      end
+
+      def self.possible_names(formula_name, raise_error: true)
+        formula = Formulary.factory(formula_name)
+        [formula_name, formula.name, formula.full_name, *formula.aliases, *formula.oldnames].compact.uniq
+      rescue FormulaUnavailableError
+        raise if raise_error
+      end
+    end
+  end
+end

Library/Homebrew/bundle/skipper.rb

@@ -0,0 +1,56 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "hardware"
+
+module Homebrew
+  module Bundle
+    module Skipper
+      class << self
+        sig { params(entry: Dsl::Entry, silent: T::Boolean).returns(T::Boolean) }
+        def skip?(entry, silent: false)
+          require "bundle/formula_dumper"
+
+          return true if @failed_taps&.any? do |tap|
+            prefix = "#{tap}/"
+            entry.name.start_with?(prefix) || entry.options[:full_name]&.start_with?(prefix)
+          end
+
+          entry_type_skips = Array(skipped_entries[entry.type])
+          return false if entry_type_skips.empty?
+
+          # Check the name or ID particularly for Mac App Store entries where they
+          # can have spaces in the names (and the `mas` output format changes on
+          # occasion).
+          entry_ids = [entry.name, entry.options[:id]&.to_s].compact
+          return false unless entry_type_skips.intersect?(entry_ids)
+
+          puts Formatter.warning "Skipping #{entry.name}" unless silent
+          true
+        end
+
+        sig { params(tap_name: String).void }
+        def tap_failed!(tap_name)
+          @failed_taps ||= T.let([], T.nilable(T::Array[String]))
+          @failed_taps << tap_name
+        end
+
+        private
+
+        sig { returns(T::Hash[Symbol, T::Array[String]]) }
+        def skipped_entries
+          return @skipped_entries if @skipped_entries
+
+          @skipped_entries ||= T.let({}, T.nilable(T::Hash[Symbol, T::Array[String]]))
+          [:brew, :cask, :mas, :tap, :whalebrew].each do |type|
+            @skipped_entries[type] =
+              ENV["HOMEBREW_BUNDLE_#{type.to_s.upcase}_SKIP"]&.split
+          end
+          @skipped_entries
+        end
+      end
+    end
+  end
+end
+
+require "extend/os/bundle/skipper"

Library/Homebrew/bundle/tap_checker.rb

@@ -0,0 +1,26 @@
+# typed: strict
+# frozen_string_literal: true
+
+module Homebrew
+  module Bundle
+    module Checker
+      class TapChecker < Homebrew::Bundle::Checker::Base
+        PACKAGE_TYPE = :tap
+        PACKAGE_TYPE_NAME = "Tap"
+
+        sig {
+          params(entries: T::Array[Homebrew::Bundle::Dsl::Entry], exit_on_first_error: T::Boolean,
+                 no_upgrade: T::Boolean, verbose: T::Boolean).returns(T::Array[String])
+        }
+        def find_actionable(entries, exit_on_first_error: false, no_upgrade: false, verbose: false)
+          requested_taps = format_checkable(entries)
+          return [] if requested_taps.empty?
+
+          require "bundle/tap_dumper"
+          current_taps = Homebrew::Bundle::TapDumper.tap_names
+          (requested_taps - current_taps).map { |entry| "Tap #{entry} needs to be tapped." }
+        end
+      end
+    end
+  end
+end

Library/Homebrew/bundle/tap_dumper.rb

@@ -0,0 +1,47 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "json"
+
+module Homebrew
+  module Bundle
+    module TapDumper
+      sig { void }
+      def self.reset!
+        @taps = nil
+      end
+
+      sig { returns(String) }
+      def self.dump
+        taps.map do |tap|
+          remote = if tap.custom_remote? && (tap_remote = tap.remote)
+            if (api_token = ENV.fetch("HOMEBREW_GITHUB_API_TOKEN", false).presence)
+              # Replace the API token in the remote URL with interpolation.
+              # Rubocop's warning here is wrong; we intentionally want to not
+              # evaluate this string until the Brewfile is evaluated.
+              # rubocop:disable Lint/InterpolationCheck
+              tap_remote = tap_remote.gsub api_token, '#{ENV.fetch("HOMEBREW_GITHUB_API_TOKEN")}'
+              # rubocop:enable Lint/InterpolationCheck
+            end
+            ", \"#{tap_remote}\""
+          end
+          "tap \"#{tap.name}\"#{remote}"
+        end.sort.uniq.join("\n")
+      end
+
+      sig { returns(T::Array[String]) }
+      def self.tap_names
+        taps.map(&:name)
+      end
+
+      sig { returns(T::Array[Tap]) }
+      private_class_method def self.taps
+        @taps ||= T.let(nil, T.nilable(T::Array[Tap]))
+        @taps ||= begin
+          require "tap"
+          Tap.select(&:installed?).to_a
+        end
+      end
+    end
+  end
+end

Library/Homebrew/bundle/tap_installer.rb

@@ -0,0 +1,46 @@
+# typed: true # rubocop:todo Sorbet/StrictSigil
+# frozen_string_literal: true
+
+module Homebrew
+  module Bundle
+    module TapInstaller
+      def self.preinstall!(name, verbose: false, **_options)
+        if installed_taps.include? name
+          puts "Skipping install of #{name} tap. It is already installed." if verbose
+          return false
+        end
+
+        true
+      end
+
+      def self.install!(name, preinstall: true, verbose: false, force: false, **options)
+        return true unless preinstall
+
+        puts "Installing #{name} tap. It is not currently installed." if verbose
+        args = []
+        official_tap = name.downcase.start_with? "homebrew/"
+        args << "--force" if force || (official_tap && Homebrew::EnvConfig.developer?)
+
+        success = if options[:clone_target]
+          Bundle.brew("tap", name, options[:clone_target], *args, verbose:)
+        else
+          Bundle.brew("tap", name, *args, verbose:)
+        end
+
+        unless success
+          require "bundle/skipper"
+          Homebrew::Bundle::Skipper.tap_failed!(name)
+          return false
+        end
+
+        installed_taps << name
+        true
+      end
+
+      def self.installed_taps
+        require "bundle/tap_dumper"
+        @installed_taps ||= Homebrew::Bundle::TapDumper.tap_names
+      end
+    end
+  end
+end

Library/Homebrew/bundle/vscode_extension_checker.rb

@@ -0,0 +1,24 @@
+# typed: strict
+# frozen_string_literal: true
+
+module Homebrew
+  module Bundle
+    module Checker
+      class VscodeExtensionChecker < Homebrew::Bundle::Checker::Base
+        PACKAGE_TYPE = :vscode
+        PACKAGE_TYPE_NAME = "VSCode Extension"
+
+        sig { params(extension: String, no_upgrade: T::Boolean).returns(String) }
+        def failure_reason(extension, no_upgrade:)
+          "#{PACKAGE_TYPE_NAME} #{extension} needs to be installed."
+        end
+
+        sig { params(extension: String, no_upgrade: T::Boolean).returns(T::Boolean) }
+        def installed_and_up_to_date?(extension, no_upgrade: false)
+          require "bundle/vscode_extension_installer"
+          Homebrew::Bundle::VscodeExtensionInstaller.extension_installed?(extension)
+        end
+      end
+    end
+  end
+end

Library/Homebrew/bundle/vscode_extension_dumper.rb

@@ -0,0 +1,30 @@
+# typed: strict
+# frozen_string_literal: true
+
+module Homebrew
+  module Bundle
+    module VscodeExtensionDumper
+      sig { void }
+      def self.reset!
+        @extensions = nil
+      end
+
+      sig { returns(T::Array[String]) }
+      def self.extensions
+        @extensions ||= T.let(nil, T.nilable(T::Array[String]))
+        @extensions ||= if Bundle.vscode_installed?
+          Bundle.exchange_uid_if_needed! do
+            `"#{Bundle.which_vscode}" --list-extensions 2>/dev/null`
+          end.split("\n").map(&:downcase)
+        else
+          []
+        end
+      end
+
+      sig { returns(String) }
+      def self.dump
+        extensions.map { |name| "vscode \"#{name}\"" }.join("\n")
+      end
+    end
+  end
+end

Library/Homebrew/bundle/vscode_extension_installer.rb

@@ -0,0 +1,52 @@
+# typed: true # rubocop:todo Sorbet/StrictSigil
+# frozen_string_literal: true
+
+module Homebrew
+  module Bundle
+    module VscodeExtensionInstaller
+      def self.reset!
+        @installed_extensions = nil
+      end
+
+      def self.preinstall!(name, no_upgrade: false, verbose: false)
+        if !Bundle.vscode_installed? && Bundle.cask_installed?
+          puts "Installing visual-studio-code. It is not currently installed." if verbose
+          Bundle.brew("install", "--cask", "visual-studio-code", verbose:)
+        end
+
+        if extension_installed?(name)
+          puts "Skipping install of #{name} VSCode extension. It is already installed." if verbose
+          return false
+        end
+
+        raise "Unable to install #{name} VSCode extension. VSCode is not installed." unless Bundle.vscode_installed?
+
+        true
+      end
+
+      def self.install!(name, preinstall: true, no_upgrade: false, verbose: false, force: false)
+        return true unless preinstall
+        return true if extension_installed?(name)
+
+        puts "Installing #{name} VSCode extension. It is not currently installed." if verbose
+
+        return false unless Bundle.exchange_uid_if_needed! do
+          Bundle.system(T.must(Bundle.which_vscode), "--install-extension", name, verbose:)
+        end
+
+        installed_extensions << name
+
+        true
+      end
+
+      def self.extension_installed?(name)
+        installed_extensions.include? name.downcase
+      end
+
+      def self.installed_extensions
+        require "bundle/vscode_extension_dumper"
+        @installed_extensions ||= Homebrew::Bundle::VscodeExtensionDumper.extensions
+      end
+    end
+  end
+end

Library/Homebrew/bundle/whalebrew_dumper.rb

@@ -0,0 +1,36 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "utils/output"
+
+module Homebrew
+  module Bundle
+    module WhalebrewDumper
+      extend Utils::Output::Mixin
+
+      sig { void }
+      def self.reset!
+        @images = T.let(nil, T.nilable(T::Array[String]))
+      end
+
+      sig { returns(T::Array[T.nilable(String)]) }
+      def self.images
+        return [] unless Bundle.whalebrew_installed?
+
+        odisabled "`brew bundle` `whalebrew` support", "using `whalebrew` directly"
+        @images ||= T.let(
+          `whalebrew list 2>/dev/null`.split("\n")
+                                      .reject { |line| line.start_with?("COMMAND ") }
+                                      .filter_map { |line| line.split(/\s+/).last }
+                                      .uniq,
+          T.nilable(T::Array[String]),
+        )
+      end
+
+      sig { returns(String) }
+      def self.dump
+        images.map { |image| "whalebrew \"#{image}\"" }.join("\n")
+      end
+    end
+  end
+end

Library/Homebrew/bundle/whalebrew_installer.rb

@@ -0,0 +1,52 @@
+# typed: true # rubocop:todo Sorbet/StrictSigil
+# frozen_string_literal: true
+
+require "utils/output"
+
+module Homebrew
+  module Bundle
+    module WhalebrewInstaller
+      extend Utils::Output::Mixin
+
+      def self.reset!
+        @installed_images = nil
+      end
+
+      def self.preinstall!(name, verbose: false, **_options)
+        unless Bundle.whalebrew_installed?
+          puts "Installing whalebrew. It is not currently installed." if verbose
+          Bundle.brew("install", "--formula", "whalebrew", verbose:)
+          raise "Unable to install #{name} app. Whalebrew installation failed." unless Bundle.whalebrew_installed?
+        end
+
+        if image_installed?(name)
+          puts "Skipping install of #{name} app. It is already installed." if verbose
+          return false
+        end
+
+        true
+      end
+
+      def self.install!(name, preinstall: true, verbose: false, force: false, **_options)
+        odisabled "`brew bundle` `whalebrew` support", "using `whalebrew` directly"
+        return true unless preinstall
+
+        puts "Installing #{name} image. It is not currently installed." if verbose
+
+        return false unless Bundle.system "whalebrew", "install", name, verbose: verbose
+
+        installed_images << name
+        true
+      end
+
+      def self.image_installed?(image)
+        installed_images.include? image
+      end
+
+      def self.installed_images
+        require "bundle/whalebrew_dumper"
+        @installed_images ||= Homebrew::Bundle::WhalebrewDumper.images
+      end
+    end
+  end
+end

Library/Homebrew/cachable.rb

@@ -7,16 +7,8 @@ module Cachable
     @cache ||= T.let({}, T.nilable(T::Hash[T.untyped, T.untyped]))
   end
 
-  # NOTE: We overwrite here instead of using `Hash#clear` to handle frozen hashes.
   sig { void }
   def clear_cache
-    overwrite_cache!({})
-  end
-
-  private
-
-  sig { params(hash: T::Hash[T.untyped, T.untyped]).void }
-  def overwrite_cache!(hash)
-    @cache = hash
+    cache.clear
   end
 end

Library/Homebrew/cask/artifact.rb

@@ -22,6 +22,9 @@ require "cask/artifact/prefpane"
 require "cask/artifact/qlplugin"
 require "cask/artifact/mdimporter"
 require "cask/artifact/screen_saver"
+require "cask/artifact/bashcompletion"
+require "cask/artifact/fishcompletion"
+require "cask/artifact/zshcompletion"
 require "cask/artifact/service"
 require "cask/artifact/stage_only"
 require "cask/artifact/suite"