[p-linnane]

Dependency#to_formula, Dependency#to_installed_formula and brew bundle passed runtime dependency names from install receipts and bottle manifests to Formulary, which also loads paths, so a name pointing at a Ruby file in the Cellar, which post-install code can write along with the receipt, was evaluated by later brew bundle and brew deps --installed runs and by Dependency#installed?, which brew upgrade calls for names from cached bottle manifests. Dependency now raises FormulaUnavailableError for names that aren't bare or tap-qualified formula names, including ones Formulary would load as a .rb or bottle file from the working directory, and brew bundle drops them from its dependency lists.

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include brew benchmark results.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug?
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• I did not use AI/LLM to create this PR, or I disclosed the tool/model below and reviewed its output; I did not attribute commits to AI and will answer maintainer questions and review comments myself without AI/LLM.

Claude Code (Opus 5.5) wrote the change and tests, reproduced on macOS before the change that a post-install step's planted receipt and Ruby file got the file evaluated by brew bundle dump, brew deps --installed (after brew postinstall) and Dependency#installed? and checked none of them evaluate it with the change, checked that the new examples fail without the change and when any part of the check is removed and ran brew lgtm --online.

---

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 22f1cb56-0a18-46fe-9060-f19097398edb

Commits

Reviewing files that changed from the base of the PR and between 41faef3 and c5c555a.

Files selected for processing: 4

• Library/Homebrew/bundle/brew.rb
• Library/Homebrew/dependency.rb
• Library/Homebrew/test/bundle/brew_spec.rb
• Library/Homebrew/test/dependency_spec.rb

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

Summary

Summary by CodeRabbit

• Bug Fixes
  • Dependency listings now exclude entries that are not valid formula names, such as paths, URLs and non-text values.
  • Attempts to resolve an invalid dependency name now return a clear unavailable-formula error instead of proceeding with resolution.
  • Valid formula names, including tap-qualified names, continue to be recognised.

Dependency conversion methods now validate names before formula resolution. Bundle runtime dependencies are filtered to retain only string values that match formula-name rules.

Changes: Formula dependency validation

Layer / File(s)	Summary
Validate names before formula resolution Library/Homebrew/dependency.rb, Library/Homebrew/test/dependency_spec.rb	formula_name? checks names against formula-name rules. to_installed_formula and to_formula raise FormulaUnavailableError for names that fail the check. Tests cover accepted and rejected names and formula-file loading.
Filter bundle runtime dependencies Library/Homebrew/bundle/brew.rb, Library/Homebrew/test/bundle/brew_spec.rb	formula_to_hash keeps runtime dependency values that are strings and pass formula_name?. The test checks valid formula names alongside paths, URLs, traversal-like strings and a non-string value.

Merge Risk: Minimal · up to c5c55

No actionable merge-blocking risk was identified.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title clearly summarises the main change: restrict dependency loading to formula names.
Description check		The description directly explains the security issue, the affected code paths, the fix, the tests, and validation performed.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[MikeMcQuaid]

Thanks!