Auto-update issues a confusing and seemingly useless warning for untrusted taps

[ilyagr]

brew doctor output

🐟 brew doctor
Please note that these warnings are just used to help the Homebrew maintainers
with debugging if you file an issue. If everything you use Homebrew for is
working fine: please don't worry or file an issue; just ignore this. Thanks!

Warning: Some installed casks are deprecated or disabled.
You should find replacements for the following casks:
  far2l
  librewolf

Warning: Some installed formulae are deprecated or disabled.
You should find replacements for the following formulae:
  icu4c@77

Warning: Unbrewed dylibs were found in /usr/local/lib.
If you didn't put them there on purpose they could cause problems when
building Homebrew formulae and may need to be deleted.

Unexpected dylibs:
  /usr/local/lib/libfdb_c.dylib

Warning: Unbrewed header files were found in /usr/local/include.
If you didn't put them there on purpose they could cause problems when
building Homebrew formulae and may need to be deleted.

Unexpected header files:
  /usr/local/include/foundationdb/*

Verification

• I ran brew update twice and am still able to reproduce my issue.
• My "brew doctor output" above says Your system is ready to brew or a definitely unrelated Tier message.
• This issue's title and/or description do not reference a single formula e.g. brew install wget. If they do, open an issue at https://github.com/Homebrew/homebrew-core/issues/new/choose instead.

brew config output

🐠 brew config
HOMEBREW_VERSION: 6.0.1
ORIGIN: https://github.com/Homebrew/brew
HEAD: 109191be4988470b51a60a5ef1998520aa24c01b
Last commit: 3 days ago
Branch: stable
Core tap: N/A
Core cask tap: N/A
HOMEBREW_PREFIX: /opt/homebrew
HOMEBREW_CASK_OPTS: []
HOMEBREW_DISPLAY: /private/tmp/com.apple.launchd.Ks2iJh9zCh/org.xquartz:0
HOMEBREW_DOWNLOAD_CONCURRENCY: 24
HOMEBREW_EDITOR: vim
HOMEBREW_FORBID_PACKAGES_FROM_PATHS: set
HOMEBREW_MAKE_JOBS: 12
HOMEBREW_NO_CLEANUP_FORMULAE: fish tmux tig
HOMEBREW_NO_INSTALL_CLEANUP: set
HOMEBREW_REQUIRE_TAP_TRUST: set
Homebrew Ruby: 4.0.5 => /opt/homebrew/Library/Homebrew/vendor/portable-ruby/4.0.5_1/bin/ruby
CPU: dodeca-core 64-bit arm_blizzard_avalanche
Clang: 17.0.0 build 1700
Git: 2.54.0 => /opt/homebrew/bin/git
Curl: 8.7.1 => /usr/bin/curl
macOS: 15.7.7-arm64
CLT: 26.3.0.0.1.1771626560
Xcode: 26.3
Metal Toolchain: N/A
Rosetta 2: false

What were you trying to do (and why)?

Run brew outdated with the new trust settings on. I've trusted some formulas but no taps:

$ brew untrust
Untrusted taps:
  macos-fuse-t/cask
  mistydemeo/cmd
  narugit/tap
  neurosnap/tap
  sourcemeta/apps
Untrusted casks:
  macos-fuse-t/cask/scorpi

What happened (include all command output)?

I get this warning:

Warning: Skipping macos-fuse-t/cask because it is not trusted. Run brew trust macos-fuse-t/cask to trust it..

Full output:

$ brew outdated
==> Auto-updating Homebrew...
Adjust how often this is run with `$HOMEBREW_AUTO_UPDATE_SECS` or disable with
`$HOMEBREW_NO_AUTO_UPDATE=1`. Hide these hints with `$HOMEBREW_NO_ENV_HINTS=1` (see `man brew`).
==> Auto-updated Homebrew!
Updated 2 taps (homebrew/core and homebrew/cask).
==> New Formulae
==> Downloading https://formulae.brew.sh/api/formula.jws.json
container2wasm: Container to WASM converter
cyclonedx-cli: Tool for analysis and manipulation of CycloneDX SBOMs
dbx-cli: Command-line interface for DBX database connections, schema, and safe queries
fakecloud: Free, open-source local AWS cloud emulator for integration testing
gnhf: Autonomous agent orchestrator for long-running coding tasks
isponsorblocktv: SponsorBlock client for all YouTube TV clients
poppler-qt6: PDF rendering library (based on the xpdf-3.0 code base)
pv-migrate: CLI tool to migrate or backup/restore Kubernetes persistent volumes
redli: Humane alternative to redis-cli with TLS support
ttl: Modern traceroute/mtr-style TUI with hop stats and ASN/geo enrichment
==> New Casks
==> Downloading https://formulae.brew.sh/api/cask.jws.json
ctivo: Download and convert Tivo shows
font-paperlogy
font-yuyu
font-yuyu-short
r-rig-app: R Installation Manager

You have 12 outdated formulae and 3 outdated casks installed.
Warning: Skipping macos-fuse-t/cask because it is not trusted. Run `brew trust macos-fuse-t/cask` to trust it.

fluid-synth (2.5.4) < 2.5.5
gcc (15.2.0) < 15.2.0_1
gdk-pixbuf (2.44.6) < 2.44.6_1
libnghttp3 (1.15.0) < 1.16.0
libngtcp2 (1.22.1) < 1.23.0
mise (2026.5.15, 2026.5.18) < 2026.6.10
mpg123 (1.33.5) < 1.33.6
openexr (3.4.12) < 3.4.12_1
openjph (0.27.3) < 0.28.1
python@3.14 (3.14.5) < 3.14.6
tig (2.6.0) < 2.6.1
usage (3.3.0, 3.4.0) < 3.5.0
claude-code@latest (2.1.174) != 2.1.177
librewolf (151.0.3,1) != 151.0.4,1
mouseless (0.4.3) != 0.4.4

What did you expect to happen?

No warning. My understanding is that it is not actionable (the tap's trusted formulas are still checked for updates), and that trusting the formulas and not the entire tap is the recommended approach.

A warning if some of the formulas that are installed are not trusted might be useful, but then the advice should be "trust either the formula or the tap".

Step-by-step reproduction instructions (by running brew commands)

1. Set up HOMEBREW_REQUIRE_TAP_TRUST=true.
2. Install a cask from an external tap. Trust the cask, but not the tap. (Update: I initially said formula; I imagine it still reproduces with a formula instead of a cask, but when I encountered it, it was a cask)
3. Run a command that causes brew to auto-update. (Yes, I fibbed when I said that the bug can be reproduced by running brew update twice, since, well, the bug is about auto-updating)
4. Observe the warning.

Update: An AI claims that the warning might also be conditional on the cache being empty.

Update 2: Here is a more reliable way to get the same warning.

rm "$(brew --cache)/cask_descriptions.json"
brew search --desc anything

In this case, the warning makes more sense, but the same code path can be hit with brew outdated, brew update, etc, where it doesn't belong.

[MikeMcQuaid]

I think this warning makes sense as a transitional state because it's not necessarily obvious to users what code paths a few weeks ago would have produced results on said taps will now ignore them. The warning indicates that they are being ignored and we can silence it at a later point.

[ilyagr]

I now regret a little going into so much detail of what codepath the warning is generated by.

In the original context, when running brew outdated or brew update, I maintain that the warning was both confusing and misleading.

But I don't know how easy it is to improve, and of course it's up to you what to do. Now you're aware of the situation in case you get similar bug reports (or perhaps you won't, which will also be a sign). I now know when to ignore the warning, so I'm happy :)

Thank you very much for continuing to maintain Homebrew!

[MikeMcQuaid]

No worries, thanks for the kind words!