Homebrew 7.0.13: Zap Stanzas Required in All Official Casks

Key Facts in Homebrew 7.0.13 #

• Zap stanzas are required in all official casks (#24435, by @bevanjkay), as listed in the Homebrew 7.0.13 release notes.
• Explicit package source loading APIs were added (#24438, by @MikeMcQuaid), and formula and cask callers were moved to them in #24439 and #24441.
• MCP server schemas and argument handling were hardened (#24453, by @p-linnane), and MCP help topics are validated before dispatch (#24484).
• The release lists dozens of further entries, covering fixes, documentation and minor features.

Homebrew 7.0.13 and Zap Stanzas in Official Casks #

The 7.0.13 notes list zap stanzas required in all official casks (#24435). The wording of the entry is short enough to quote as written:

Require zap stanzas in all official casks

Homebrew 7.0.13 release notes

The requirement is a widening of an earlier rule. The Homebrew 7.0.11 release notes list "Require zap stanzas in new casks" (#24315), so the check applied to new casks in 7.0.11 and applies to all official casks in 7.0.13. Cask maintainers who have older official casks without a zap stanza are the ones this change reaches.

The Homebrew 7.0.12 release notes list "Replace # No zap stanza required comments" (#24369). This suggests the comment had been a marker the zap rule had to account for, and that it was replaced rather than kept as an exemption.

Homebrew 7.0.13 Adds Explicit Package Source Loading APIs #

The main change in this part is explicit package source loading APIs, added in #24438 by @MikeMcQuaid. Two follow-up entries in the same release move existing code onto them: #24439 migrates formula callers and #24441 migrates cask callers. Because all three are in one release, this suggests the new APIs are meant to be the path both formula and cask loading use.

Earlier, the Homebrew 7.0.12 release notes list "Only load dependencies by formula name" (#24427) and "Call formula specs directly instead of by name" (#24429). Those entries sit in a different release and are listed as separate changes, so they should be read as background rather than as part of the 7.0.13 API work.

MCP Server Schemas and Argument Handling in Homebrew 7.0.13 #

The MCP server schemas and argument handling were hardened in #24453 by @p-linnane. A related entry, #24484 by @MikeMcQuaid, validates MCP help topics before dispatch, so a request is checked before the command runs. Together these two entries place the checks on both the schema and the dispatch step of the MCP server.

The Homebrew 7.0.12 release notes list "mcp: handle empty arguments and failed commands" (#24409). This suggests the MCP argument path has been changed in two consecutive releases, with 7.0.13 tightening it further.

Who Needs to Act on the 7.0.13 Changes #

Cask maintainers in the official tap are the first group to check. Each official cask needs a zap stanza under the 7.0.13 rule, so review any cask that lacks one. The sources do not describe what a zap stanza must contain or how the requirement is enforced, so the official cask code and the Homebrew source are the places to confirm those details.

Authors of scripts or tools that load formulae or casks from Homebrew's Ruby code should review their call sites against the new explicit APIs introduced in #24438, since the release migrates the internal callers to them. Users who run Homebrew's MCP server should confirm that their clients still work with the hardened schemas and the help-topic validation.

Checksum, Tap and Command Lookup Entries in Homebrew 7.0.13 #

Several smaller entries in 7.0.13 touch verification, trust and lookup behaviour. They are listed here so that the ones touching trust and verification can be found quickly:

• Verify backfilled :all bottle subjects (#24447, by @hezhizhen).
• unpack: verify cached cask checksums (#24480, by @MikeMcQuaid).
• Allow untapping untrusted formula taps (#24477, by @MikeMcQuaid).
• Apply the command name check to external lookups (#24483, by @p-linnane).
• Explain root command and service ownership trust (#24457, by @MikeMcQuaid).
• Skip id forks for read-only brew commands (#24455, by @bvolpato).
• bundle: add a pin: true Brewfile option (#24454, by @zhuoqun-chen).
• uninstall: add a dry-run option (#24530, by @HaraldNordgren).

The release lists many more entries than these. The complete list, with contributors and pull request numbers, is in the Homebrew 7.0.13 release notes.