Approval timeframes for Casks/Taps

[benrfairless]

Firstly, this should not be intended as a good work of the maintainers of Homebrew, who provide an outstanding service.

However I've noticed there can be what feels like a decent delay between being notified within an app of an update, and the update actually being available. In some cases, this feels like it can be up to 24 hours.

Regular examples include copilot, claude-code and codex but can also include Thaw (for example). I'm not sure if this is because of my timezone (I am based in Western Australia, so UTC +8).

I'm wondering if there's a way to streamline PR approvals - if BrewTestBot is automatically creating PRs and those PRs pass, should they be auto-approved and merged? Forgive me if this is already happening.

Once again, this is not a criticism - I'm just trying to understand how things could be better here.

[bevanjkay]

There have been times in the past where bump PRs were automerged, but without a human in the chain there is a significant security concern - which has been seen before. This is why all PRs require a maintainer to approve/merge.

In terms of the time between, it should never be 24 hours, except in rare circumstances.
BrewTestBot checks for new versions once every 3 hours, and then it can take between 5 minutes -> 6 hours for a maintainer to review depending on maintainer availability. Then there's an additional ~15 minutes for the API to be updated for the new versions to be shipped to users.

If you really need the latest versions as soon as they become available then I would suggest using the in-app updaters when you are prompted to update. Homebrew has a specific stanza auto_updates that prevents Casks from being upgraded by default when they have their own upgrade mechanism, because you will always have a quicker experience when you let the apps upgrade themselves.

[SMillerDev]

I'm wondering if there's a way to streamline PR approvals - if BrewTestBot is automatically creating PRs and those PRs pass, should they be auto-approved and merged? Forgive me if this is already happening.

No, we had this and it created a security incident. All work is manually reviewed and approved.
We have volunteers who are globally distributed, but since they are volunteers there is no guarantees on timelines.

In addition to that there are no guarantees that an update you're getting is also available for everyone else already. If you see an update that doesn't have a PR open yet, please make one. The automation might be behind.

[bevanjkay]

In addition to that there are no guarantees that an update you're getting is also available for everyone else already. If you see an update that doesn't have a PR open yet, please make one. The automation might be behind.

@SMillerDev Makes a great additional point here, I have definitely seen what appears to be a staged rollout with claude-code where I see a notice about an upgrade in the CLI, but it doesn't show through the standard version API check immediately.

[p-linnane]

How often are you running brew update? I checked the last few thaw PR's and they were merged within minutes to hours of the PR being open.