What's Changed

• dev-cmd/typecheck: Support typechecking in taps by @issyl0 in #18027
• brew.sh: further improve git describe cache. by @MikeMcQuaid in #18087
• feat: add attestation to installer by @SMillerDev in #17827
• Revert "feat: add attestation to installer" by @carlocab in #18089
• Minor type safety improvements by @dduugg in #18081
• Remove global include Kernel by @Bo98 in #18093
• Remove some unnecessary include Kernel by @Bo98 in #18094
• enable typed: strict in Homebrew::CLI::Args by @dduugg in #18083
• bin/brew: tighten check in export_homebrew_env_file by @carlocab in #18095
• .rubocop.yml: add respond_to_missing? to OptionalBooleanParameter exemptions by @carlocab in #18097
• extend/ENV/super: set GOTOOLCHAIN by @carlocab in #18099
• docs/Typechecking: update to latest code standards by @Bo98 in #18101
• upgrade: remove module_function by @Bo98 in #18100
• api/analytics: use typed: strict by @p-linnane in #18088
• Replace some include Kernel usages with requires_ancestor by @Bo98 in #18102
• Use plist main binary for Rosetta audit by @leipert in #18109
• Revert "bin/brew: tighten check in export_homebrew_env_file" by @MikeMcQuaid in #18112
• dev-cmd/edit: correct path types by @mistydemeo in #18107
• Rosetta audit: Build full executable path by @leipert in #18113
• sorbet: Ignore Formula and Casks directories by @issyl0 in #18119
• shared_audits: remove module_function by @Bo98 in #18131
• livecheck: remove module_function by @Bo98 in #18130
• extend/ENV: remove fake EnvMethods from RBI by @Bo98 in #18132
• Don't assume ENV is a superenv in RBI by @Bo98 in #18134
• cmd/list: add --poured-from-bottle and --built-from-source by @FnControlOption in #18133
• language/python: reduce some differences between macOS and Linux venv by @cho-m in #18129
• language/python: avoid modifying all Python symlinks by @cho-m in #18128
• formula_auditor: fix typechecking failure by @carlocab in #18136
• docs: use NOTE rather than NOTICE by @cho-m in #18137
• Add typing for Cask#url and fix detected issues by @Bo98 in #18139
• dev-cmd/bottle: use default tar when bottling gnu-tar by @cho-m in #18138
• brew.sh: remove some shellcheck disables by @carlocab in #18146
• keg_relocate: allow spaces/tabs after shebang by @cho-m in #18149
• utils/github: fix too_many_open_prs? by @carlocab in #18150
• utils/github: use paginate_graphql in sponsorships by @carlocab in #18152
• Speed up CoreCaskTap#cask_files_by_name by @apainintheneck in #18151
• formula_auditor: ensure tag is not nil when doing online audit by @chenrui333 in #18154
• utils/github: a few more simplifications by @carlocab in #18155
• bin/brew: improve sudo handling by @carlocab in #18156
• shims/super/cc: unset LD_LIBRARY_PATH by @ZhongRuoyu in #18162
• Speed up the Tap#formula_files and Tap#cask_files methods by @apainintheneck in #18165
• utils/helpers.sh: remove a shellcheck disable by @carlocab in #18147
• dev-cmd/bottle: include installed_size in metadata by @cho-m in #18144
• workflow/tests: move Docker tests to docker.yml by @ZhongRuoyu in #18168

New Contributors

• @leipert made their first contribution in #18109

Full Changelog: 4.3.17...4.3.18

What's Changed

• diagnostic: check for strings in XDG_DATA_DIRS by @cho-m in #18074
• cleaner: use typed: strict by @p-linnane in #18079
• hardware.rb: use typed: strict by @p-linnane in #18082
• Make Cask::Artifact::Installer typesafe by @dduugg in #18080
• brew.sh: hide ignorable permission errors. by @MikeMcQuaid in #18084
• devcontainer: Tap bundle and services in Codespaces by @issyl0 in #18078

Full Changelog: 4.3.16...4.3.17

What's Changed

• Refactor method to remove extra tap requires by @apainintheneck in #18010
• sorbet: Bump some cmd/* files to typed: strict by @issyl0 in #18011
• Make FromContentLoader.try_new typesafe by @dduugg in #18019
• sorbet: Bump more files to typed: strict by @issyl0 in #18004
• Fix incompatibility in brew shellenv with older version of Fish shell by @smsearcy in #18001
• rubocop: Use Sorbet/StrictSigil as it's better than comments by @issyl0 in #18023
• attestation: specialize error when gh is old by @woodruffw in #17926
• Revert "attestation: specialize error when gh is old" by @woodruffw in #18030
• Make Cask::Artifact::Installer typesafe by @dduugg in #18020
• Revert "Make Cask::Artifact::Installer typesafe" by @bevanjkay in #18033
• Improve VSCode configuration by @MikeMcQuaid in #18026
• formula_auditor: fix eol check by @chenrui333 in #18034
• unpack_strategy/dmg: fix UID handling by @Bo98 in #18040
• formula_name_cask_token_auditor: use typed: strict by @p-linnane in #18041
• download: use typed: strict by @p-linnane in #18042
• extend/io: use typed: strict by @p-linnane in #18043
• Deprecate invoking commands in the old (non-AbstractCommand) style by @dduugg in #18008
• Verify more constants are not loaded at startup by @apainintheneck in #18012
• Fix message when disablement is in the past. by @reitermarkus in #18054
• extend/os/linux/keg: use typed: strict by @p-linnane in #18046
• extend/os/linux/formula_installer: use typed: strict by @p-linnane in #18045
• Add brew debugger command by @Rylan12 in #18050
• Update dev container recommended extensions by @Rylan12 in #18058
• Suppress sorbet type errors when using `undef' by @dduugg in #18056
• Improve VS Code debugger support by @Rylan12 in #18057
• Add a bunch more UNDEFINED_CONSTANTS for startup. by @MikeMcQuaid in #18065

New Contributors

• @smsearcy made their first contribution in #18001

Full Changelog: 4.3.15...4.3.16

What's Changed

• Fix SBOM schema validation by @Bo98 in #17987
• language/*: only check required deps in detected_*_shebang by @MikeMcQuaid in #17993
• sorbet: Comment more files that can't be strict because of undef by @issyl0 in #17997
• formula_creator: don't recommend interpolating bin by @p-linnane in #18000
• Share code between cask token and formula name audits. by @reitermarkus in #17562
• Faster brew formulae command (and formula completion!) by @metacollin in #18003
• Make ruby-lsp-activate.sh executable by @apainintheneck in #18016
• cask/dsl/caveats: fix rosetta caveat printing by @bevanjkay in #18021
• Honor homebrew curlrc config for analytics by @ntkme in #17999
• Relax cask token regex. by @reitermarkus in #18009
• cmd/update-report: don't output cask updates on linux by @bevanjkay in #18022

Full Changelog: 4.3.14...4.3.15

What's Changed

• diagnostic: fix XDG_DATA_DIRS check by @gromgit in #17947
• Show dependencies for casks by @HaraldNordgren in #17940
• cmd/update: make chown suggestion consistent by @Bo98 in #17977
• Fix Homebrew auto-update for GNU find by @maxim-belkin in #17968
• pkg-installer: don't build on Dependabot PR's by @p-linnane in #17976
• Vendor SBOM schema by @Bo98 in #17981

Full Changelog: 4.3.13...4.3.14

What's Changed

• feat: enable audit for wayback urls on all formulae by @iMichka in #17901
• cleaner: rewrite node shebangs by @branchvincent in #17773
• brew.sh: fix brew -v by @carlocab in #17903
• language/python: support pure-Python wheel installs by @woodruffw in #17897
• Formula-Cookbook: add std_npm_args by @p-linnane in #17881
• Improve locking UX by @MikeMcQuaid in #17904
• sandbox: disallow backslashes in path filter names by @woodruffw in #17919
• tapioca/compilers/args: remove non-AbstractCommand handling by @Bo98 in #17920
• Homebrew-and-Python: more PEP 668 guidance by @woodruffw in #17922
• rubocop: Discourage the use of rm_f and rm_rf in formulae and casks by @issyl0 in #17705
• rubocops/text: Add autocorrection for the interpolated bin audit by @issyl0 in #17933
• sbom: don't store runtime dependencies when bottling. by @MikeMcQuaid in #17935
• Add vscode Ruby LSP config by @Rylan12 in #17934
• rubocops/shared/url_helper: fix url audit by @khipp in #17937
• rubocops/shared/url_helper: update url audit by @khipp in #17938
• docs: Update find-appcast command by @thatrobotdev in #17943
• More VS Code improvements by @Rylan12 in #17942
• Portable Ruby 3.3.4_1 by @Bo98 in #17948
• upgrade: fix missed upgrades when an alias is changed to a formula by @Bo98 in #17946
• debrew/irb: fix errors under Ruby 3.3 by @Bo98 in #17945
• shellenv: fix MANPATH and INFOPATH handling for [t]csh by @carlocab in #17951
• shims/super/cc: pass -ld_classic if needed for -dead_strip_dylibs by @cho-m in #17950
• dev-cmd/dispatch-build-bottle: add missing require by @chenrui333 in #17959
• utils/analytics: improve accuracy of GitHub Packages download counts by @carlocab in #17957
• rubocops/text: Allow bin interpolation inside word arrays by @issyl0 in #17961
• Formula-Cookbook: Stop recommending rm_f in postinstall by @issyl0 in #17965
• rubocops/lines: audit std_npm_args usage by @branchvincent in #17867

New Contributors

• @thatrobotdev made their first contribution in #17943

Full Changelog: 4.3.12...4.3.13

What's Changed

• resource_auditor: normalize PyPI names to kebab case before auditing by @woodruffw in #17896
• attestation: remove gh version detection by @woodruffw in #17899
• Fix GitHub API credential encoding errors by @Bo98 in #17902

Full Changelog: 4.3.11...4.3.12

What's Changed

• shellenv: prepend colon to MANPATH if set by @gromgit in #17633
• Introduce UnpackStrategyType by @dduugg in #17640
• livecheck: finish expanding typed: strict by @samford in #17643
• Use struct for #audit_formula args by @samford in #17651
• dev-cmd/bump-formula-pr: Fix fetch_resource_and_forced_version types by @issyl0 in #17655
• context: fix original context not being restored by @EricFromCanada in #17654
• cask/dsl/caveats: allow for simulated system checks in rosetta caveat by @bevanjkay in #17659
• docker: revert back linuxbrew's UID to 1000 by @andreineculau in #17660
• Assume the --greedy flag for brew outdated when HOMEBREW_UPGRADE_GREEDY is set by @andrewbraxton in #17668
• cmd/shellenv.sh: handle undefined MANPATH and set -eu. by @MikeMcQuaid in #17674
• cli/named_args: raise priority of core casks by @Bo98 in #17681
• sorbet: Make more files (that have public APIs defined in them) typed: strict by @issyl0 in #17636
• test/dev-cmd/bottle: Mark the bottling test as needs_network by @issyl0 in #17680
• unpack_strategy/dmg: Convert to Sorbet typed: strict by @issyl0 in #17683
• formula_assertions: Fix type of cmd param in shell_output by @issyl0 in #17688
• Add cask install receipts by @Rylan12 in #17554
• workflows: pin actions by @Moisan in #17691
• Use Downloadable API in FromBottleLoader. by @reitermarkus in #17695
• Restrict direct url installs to the file:https:// scheme by @Rylan12 in #17697
• Portable Ruby 3.3.4 by @MikeMcQuaid in #17696
• workflows/vendor-gems: handle input string more robustly by @ZhongRuoyu in #17698
• attestations: widen the beta by @woodruffw in #17692
• attestation: don't dupe stderr by @woodruffw in #17704
• Don't allow special characters in sandbox rule paths by @Rylan12 in #17700
• curl_spec: remove no-op Marshal use by @woodruffw in #17699
• formula_installer: skip attestations on local_bottle_path by @woodruffw in #17706
• feat: do not use existing sudo authentication in brew commands by @SMillerDev in #17694
• Deny file mode changes outside of specified paths in sandbox by @Rylan12 in #17708
• Create Resource::BottleManifest. by @reitermarkus in #17709
• attestation: allow disabling verification. by @MikeMcQuaid in #17712
• attestation: only enable for developers outside CI by @MikeMcQuaid in #17713
• Rearrange requires by @MikeMcQuaid in #17707
• Remove maintainers.json by @MikeMcQuaid in #17715
• bump: add utils/repology require by @samford in #17717
• workflows/vendor-gem: remove use of pull_request target. by @MikeMcQuaid in #17718
• Port brew help (without arguments) to Bash by @MikeMcQuaid in #17710
• Widen attestation verification rollout by @MikeMcQuaid in #17716
• Port brew --repository to Bash by @ZhongRuoyu in #17726
• global: fix require order. by @MikeMcQuaid in #17730
• vendor_gems: require utils/git by @Moisan in #17732
• cmd/--repository: improve tap name error checking by @ZhongRuoyu in #17733
• pypi: allow universal wheels as resources by @woodruffw in #17724
• sandbox: deny signal to other processes by @Moisan in #17719
• brew.sh: speed up brew --help, brew -h, etc. by @ZhongRuoyu in #17735
• workflows/tests: enable attestations by @woodruffw in #17736
• utils/analytics: strip out more data. by @MikeMcQuaid in #17729
• Output disable date for deprecated packages by @MikeMcQuaid in #17721
• global: more require ordering fixes. by @MikeMcQuaid in #17737
• Require utils/backtrace when install fails to load formula by @Rylan12 in #17738
• Make ignore_interrupts thread-safe. by @reitermarkus in #17722
• dev-cmd/bottle: add missing require. by @MikeMcQuaid in #17739
• dev-cmd/pr-publish: add missing require by @p-linnane in #17741
• brew bump: do not call repology by default by @Moisan in #17740
• attestation: improve error message when gh is too old by @nandahkrishna in #17727
• brew.sh: fix nested developer command detection by @Bo98 in #17745
• dev-cmd/update-test: fix dev channel testing by @Bo98 in #17747
• dev-cmd/bump-formula-pr: fix missing require by @ZhongRuoyu in #17749
• cmd/tap: add missing require by @p-linnane in #17746
• utils/pypi: add missing import by @woodruffw in #17753
• Add stub Ruby commands for all Bash commands. by @MikeMcQuaid in #17742
• formula: add require utils/gzip by @Moisan in #17755
• formula: require utils/git_repository by @Moisan in #17754
• Revert "sandbox: deny signal to other processes" by @Rylan12 in #17759
• cask/info: fix installed size reporting by @krehel in #17757
• Have tap_git_head return nil when no tap is installed by @Rylan12 in #17763
• Add ShellCommand module for shell command stubs by @ZhongRuoyu in #17758
• brew bump: cleanup and improve --eval-all handling by @nandahkrishna in #17748
• formula: fix missing require by @branchvincent in #17772
• cask/audit: handle cask_min_os is nil by @khipp in #17768
• utils/analytics: fix handling of newlines by @Bo98 in #17775
• Add utils/backtrace requires by @samford in #17762
• formula_assertions: Fix pipe_output type sig by @issyl0 in #17780
• dev-cmd/pr-automerge: add missing require by @shivammathur in #17783
• Fix UID handling with cask installer script: by @Bo98 in #17782
• download_strategy: fix UID handling for Git submodules by @carlocab in #17786
• attestation: avoid touching working directory by @Bo98 in #17785
• Ensure early installation of gh for attestations by @nandahkrishna in #17760
• FormulaURILoader: use regex to validate refs before attempting to cast by @Rylan12 in #17766
• Formula-Cookbook: add std_*_args explanations by @p-linnane in #17792
• Update How-To-Open-a-Homebrew-Pull-Request.md: add links to Manpage by @muescha in #17797
• dependency: fix missed upgrades when an alias is changed to a formula by @Bo98 in #17799
• attestation: handle bad configurations better by @Bo98 in #17800
• attestation: fix comment by @woodruffw in #17805
• Update Brew-Livecheck.md: add examples for modify version information by @muescha in #17798
• Fix missing requires for tap-info command by @kmontag in #17778
• Add missing_formula require to Homebrew::CLI::NamedArgs by @ah91086 in #17809
• contributions, github: add missing requires, fix type errors by @samford in #17806
• Avoid frozen array errors in brew upgrade by @apainintheneck in #17793
• Add better "--quiet" support to cask upgrade by @ericsampson in #17761
• resource_auditor: add missing require by @chenrui333 in #17822
• download_strategy: fix handling of Apa...

What's Changed

• docker: revert back linuxbrew's UID to 1000 by @andreineculau in #17660
• cli/named_args: raise priority of core casks by @Bo98 in #17681
• utils/analytics: strip out more data. by @MikeMcQuaid in #17729
• utils/analytics: fix handling of newlines by @Bo98 in #17775
• dependency: fix missed upgrades when an alias is changed to a formula by @Bo98 in #17799

Full Changelog: 4.3.9...4.3.10

What's Changed

• Load tap migration renames from api by @apainintheneck in #17599
• ci: improve Dockerfile to make proper use of build cache by @marcosnils in #17584
• Use effective_arch for rustflags by @git-mann in #17597
• Use API for description searches by @rrotter in #17582
• Load tap migration renames from API with short names by @apainintheneck in #17607
• cask/audit: handle on_os range bounded by depends_on by @EricFromCanada in #17608
• Remove broken opavote links by @Rylan12 in #17613
• rubocops/class: allow disabled formulae to be without a test block by @bayandin in #17614
• sorbet: Migrate dev-cmd files from typed: true to typed: strict by @issyl0 in #17606
• extract: Log formula version by @Kentzo in #17622
• dev-cmd/typecheck: Stop dry running Spoom sigil bumps by @issyl0 in #17621
• sorbet: Tighten up dev-cmd types by @issyl0 in #17625
• clear description cache if updated w/o EVAL_ALL by @rrotter in #17602
• dev-cmd/bump-formula-pr: formula_version should return Version not String by @issyl0 in #17628
• Use cached json API file for formulae and cask specified paths by @Rylan12 in #17615
• livecheck: expand typed: strict usage by @samford in #17632
• Improve "unknown command" error by @MikeMcQuaid in #17634
• extract: Fix missing '--git-revision' in the usage banner by @Kentzo in #17638

New Contributors

• @marcosnils made their first contribution in #17584
• @git-mann made their first contribution in #17597

Full Changelog: 4.3.8...4.3.9