The ground floor of the dev stack got re-poured this week. Five categories filed under settled — package manager, terminal multiplexer, API keys, filesystem, database — all shipped rebuilds, and the rebuilds share two assumptions: distrust the supply chain by default (Homebrew's tap-trust gate landed the same week ~400 AUR packages were caught shipping a rootkit), and assume the thing at the keyboard is sometimes an agent (Boo's no-TTY scripting, Talos minting scoped agent tokens offline). Zed's DeltaDB makes the same bet a layer up — version control of every operation between commits, built for human-agent collaboration — but it's a waitlist, not a tool, so it frames this note instead of taking a slot. Also dropped: Xiaomi's MiMo Code launch (a model release is a press release until its benchmarks survive a week of strangers) and the entire Claude Fable news cycle — guardrails apology, hot takes, a prompt-funding stunt — news, not tools. The kicker strips your ums.
Homebrew 6.0.0
The package manager under most Mac (and many Linux) dev setups shipped a major release: third-party taps now require explicit trust before their code runs. Taps are arbitrary Ruby, and until now brew tap meant agreeing to execute a stranger's code on every install. Also in: the faster internal JSON API as default (all metadata in one download, ~30% faster startup on commands like brew leaves), Bubblewrap sandboxing for build/test/postinstall phases on Linux, and parallel brew bundle installs with npm, krew, and winget support.
The timing argues the case for them — the same week, roughly 400 AUR packages were caught shipping an infostealer and a rootkit. Package managers are the widest supply-chain door on your machine, and the trust prompt is brew admitting it. Delete the assumption that a popular tap is a vetted tap. Tradeoff: trust prompts only work if you read them — most people will hammer yes — and Intel Mac support starts its deprecation clock in September.
link