What to do with casks not passing the macOS Gatekeeper check?

[FlavioB79]

Output of brew config

HOMEBREW_VERSION: 6.0.21
ORIGIN: https://github.com/Homebrew/brew
HEAD: 560147012b9678b42ef5e83b690f0895552d1366
Last commit: 2 days ago
Branch: stable
Core tap: N/A
Core cask tap: N/A
HOMEBREW_PREFIX: /opt/homebrew
Homebrew Ruby: 4.0.6 => /opt/homebrew/Library/Homebrew/vendor/portable-ruby/4.0.6/bin/ruby
CPU: octa-core 64-bit arm_firestorm_icestorm
Clang: 21.0.0 build 2100
Git: 2.50.1 => /Library/Developer/CommandLineTools/usr/bin/git
Curl: 8.7.1 => /usr/bin/curl
macOS: 26.6.2-arm64
CLT: 26.6.0.0.1781586589
Xcode: N/A
Rosetta 2: false

Output of brew doctor

Please note that these warnings are just used to help the Homebrew maintainers
with debugging if you file an issue. If everything you use Homebrew for is
working fine: please don't worry or file an issue; just ignore this. Thanks!

Warning: Some installed casks are deprecated or disabled.
You should find replacements for the following casks:
angry-ip-scanner
  avidemux
  vmpk
  xld

Warning: Some installed formulae are deprecated or disabled.
You should find replacements for the following formulae:
    icu4c@77

Warning: Some installed formulae or casks are missing dependencies.
Run `brew missing` for more details.

You should `brew install` the missing dependencies:
  brew install python-packaging python@3.13

Description of issue

As of 2 days ago, following casks won't be upgraded anymore:
==> 4 Deprecated or disabled packages
angry-ip-scanner (disabled)
avidemux (disabled)
vmpk (disabled)
xld (disabled)
The reason is one for all of them:
bonny@Flavios-MacBook-Pro Downloads % brew install angry-ip-scanner
Warning: Not upgrading angry-ip-scanner, it is disabled because it does not pass the macOS Gatekeeper check! It was disabled on 2026-09-01.
bonny@Flavios-MacBook-Pro Downloads % brew install avidemux
Warning: Not upgrading avidemux, it is disabled because it does not pass the macOS Gatekeeper check! It was disabled on 2026-09-01.
bonny@Flavios-MacBook-Pro Downloads % brew install vmpk
Warning: Not upgrading vmpk, it is disabled because it does not pass the macOS Gatekeeper check! It was disabled on 2026-09-01.
bonny@Flavios-MacBook-Pro Downloads % brew install xld
Warning: Not upgrading xld, it is disabled because it does not pass the macOS Gatekeeper check! It was disabled on 2026-09-01.

Genuine question: what should I do with those apps? Just wait for them to maybe somewhen pass the macOS Gatekeeper test? Or simply abandon them from brew and just take care of their upgrades manually?

TIA,
F.

[FlavioB79]

Hi and thanks for your reply. I'll think about the choices you listed - in the meantime I already notified the developer/mainainer of XLD. What looks strange to me is that for XLD there is no new(er) version compared to the one I'm already using (which has been installed via brew). So: why does brew tell me I can't upgrade it, even though there's no upgrade available? Thanks, F.

…

On Thursday, September 3rd, 2026 at 5:22 PM, Junaid Hussnain ***@***.***> wrote: A disabled cask is no longer maintained as an install/upgrade path by Homebrew, so waiting will not make brew upgrade proceed automatically unless the upstream app ships a Gatekeeper-compliant build and the cask is subsequently re-enabled. The practical choices are: - Check the app vendor for a newer signed/notarized macOS build or a supported alternative. - Report the signing/notarization failure upstream. That is something the app vendor must fix; it is not normally fixable in the cask definition. - Keep the currently installed version temporarily if you accept that it will no longer receive Homebrew upgrades, or uninstall it with brew uninstall --cask <name>. - Once upstream fixes the build, the cask can be updated/re-enabled in homebrew/cask. I would not work around this with --no-quarantine, xattr -d com.apple.quarantine, or by disabling Gatekeeper. Homebrew policy explicitly requires macOS casks not to require Gatekeeper to be disabled or bypassed ([Acceptable Casks](https://github.com/Homebrew/brew/blob/main/docs/Acceptable-Casks.md#platform-compatibility-and-macos-security-protections)). A Gatekeeper failure is also an explicit cask deprecation reason, and disabled casks are eventually removed after one year ([lifecycle policy](https://github.com/Homebrew/brew/blob/main/docs/Deprecating-Disabling-and-Removing.md#formulae-and-casks)). So “manage the same unsigned build manually” is technically possible only by bypassing a security control and is not the safe replacement. Prefer a vendor-fixed build or another maintained app. — Reply to this email directly, [view it on GitHub](#7050?email_source=notifications&email_token=AIEUZR5V7HURZRDAZR77VZD5NGSFLA5CNFSNUABIM5UWIORPF5TWS5BNNB2WEL2ENFZWG5LTONUW63SDN5WW2ZLOOQXTCOBSG4ZTINRTUZZGKYLTN5XKMYLVORUG64VFMV3GK3TUVRTG633UMVZF6Y3MNFRWW#discussioncomment-18273463), or [unsubscribe](https://github.com/notifications/unsubscribe-auth/AIEUZR73ON4YQ4K4SLSH2535NGSFLAVCNFSNUABIKJSXA33TNF2G64TZHMZDSMRSGY3DSMJTHNCGS43DOVZXG2LPNY5TCMBXGQZTMNJWUF3AE). You are receiving this because you authored the thread.Message ID: ***@***.***>

[SMillerDev]

Please stop feeding people LLM output, you're killing the open source community like this.

[FlavioB79]

@SMillerDev You weren't replying to me, right?

[SMillerDev]

No no, I was replying to the other user who now seems banned.

[sam-fredrickson]

I have to agree that the way this has been handled was quite unfriendly to users. I can sympathize with the team's decision not to support unsigned casks—but if the motivation there was to avoid spurious bug reports from users confused about OS warnings from unsigned apps, it feels like the way this has gone about will only create more bug reports just like this one, from users who didn't realize what was going on and now have semi-broken systems.

[p-linnane]

We have not been accepting new casks that are unsigned for quite a while, and have been warning about the deprecation of those that already existed.

We often find that despite our best attempts to communicate upcoming changes, many people are still caught off guard because they do not read or take action until the changes have come to pass.

[sam-fredrickson]

Maybe it’s a terminology difference, but I typically read “deprecated” as “will remain available but won’t be updated and will continue printing warnings,” not “the next time you run a brew upgrade these packages will be uninstalled.” There could also have been some “blessed” tap that maintains the casks, perhaps, and the warnings could point to that. Maybe even a script to migrate any installed casks to that “blessed” third party tap.

[p-linnane]

You should probably read project-level documentation rather than assume. The concept of deprecating something, and just printing warnings forever makes 0 sense to me. A deprecation is a warning that something is going to change/happen.

We do not recommend third-party taps. Anyone is free to host their own tap and add whatever they'd like in it though.

[FlavioB79]

Let me add this: I'm not trying to upgrade a specific cask, I'm just upgrading "all" and I'm notified with this:

==> Would upgrade 1 outdated package
drawio 31.3.2 -> 31.4.2
==> 4 Deprecated or disabled packages
angry-ip-scanner (disabled)
avidemux (disabled)
vmpk (disabled)
xld (disabled)

I only verified XLD's official latest version - there's no newer version. So the message above, what exactly is it triggered from?

[FlavioB79]

That's what I thought... but your reply was "attached" to my message... :-)

…

On Friday, September 4th, 2026 at 5:21 PM, Sean Molenaar ***@***.***> wrote: No no, I was replying to the other user who now seems banned. — Reply to this email directly, [view it on GitHub](#7050?email_source=notifications&email_token=AIEUZR7EMJ44D6E65DDX27L5NL22RA5CNFSNUABIM5UWIORPF5TWS5BNNB2WEL2ENFZWG5LTONUW63SDN5WW2ZLOOQXTCOBSHEZTENZYUZZGKYLTN5XKMYLVORUG64VFMV3GK3TUVRTG633UMVZF6Y3MNFRWW#discussioncomment-18293278), or [unsubscribe](https://github.com/notifications/unsubscribe-auth/AIEUZR7IGCWDLI243PAFJ6T5NL22RAVCNFSNUABIKJSXA33TNF2G64TZHMZDSMRSGY3DSMJTHNCGS43DOVZXG2LPNY5TCMBXGQZTMNJWUF3AE). You are receiving this because you authored the thread.Message ID: ***@***.***>

[SMillerDev]

Yeah, it gets very confusing without the other posts and replies

[Danrancan]

So how do I re-enable the disabled apps so that I can still get updates through homebrew, even if they aren't signed?

Is there a solution here?

[SMillerDev]

You can consider hosting them in a personal tap, which is very easy to do: https://docs.brew.sh/How-to-Create-and-Maintain-a-Tap. You can use brew extract to get the last version into your tap and then just let autobump make update PRs for you.

[cooperaj]

This is... suboptimal.

I do understand the reasoning but by the same token I, as a technical user, wholly understand homebrew is a distribution system and signing (or not) of casks is entirely up to the application. I'm not really wanting to remove all these ones I have that are disabled so I guess I'll remain a tier 2 user :(

This is just feedback, not wholly a whinge. I <3 homebrew.

[p-linnane]

And continuing to distribute unsigned applications is entirely up to us as Homebrew maintainers. We've decided we no longer want to support that in our official taps, but individual taps as a great way to install whatever you'd like from wherever you want.