[MikeMcQuaid]

• Share the curl header version between Ruby and Bash.
• Omit GitHub API token headers with older curl.
• Check HOMEBREW_GITHUB_API_TOKEN with older curl in brew doctor.
• Pass command environment values directly to child processes.

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include brew benchmark results.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug?
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• I did not use AI/LLM to create this PR, or I disclosed the tool/model below and reviewed its output; I did not attribute commits to AI and will answer maintainer questions and review comments myself without AI/LLM.

Codex with GPT 6.1 Sol at Extra High effort, with local review and testing.

---

[coderabbitai]

No actionable comments were generated in the recent review.

Summary

Summary by CodeRabbit

• Bug Fixes
  • GitHub authorization tokens are no longer exposed in curl command-line arguments. Older curl versions may make GitHub API requests without authentication, which can result in lower request limits.
• New Features
  • GitHub authorization headers are passed to curl through standard input when using curl 7.55.0 or later.
  • A diagnostic warns when an older curl version may prevent a configured GitHub API token from being used.

The change adds curl-version-aware handling for GitHub authorization headers. Supported curl versions receive headers through standard input. The update command uses this path for GitHub API requests, and diagnostics report token-related limits for older curl.

Changes: GitHub token header transport

Layer / File(s)	Summary
Configure and transport authorization headers Library/Homebrew/brew.sh, Library/Homebrew/global.rb, Library/Homebrew/utils/curl.sh, Library/Homebrew/utils/curl.rb, Library/Homebrew/system_command.rb, Library/Homebrew/test/utils/curl_spec.rb, Library/Homebrew/test/download_strategies/curl_spec.rb, Library/Homebrew/test/download_strategies/curl_github_packages_spec.rb, Library/Homebrew/test/system_command_spec.rb	The code sets the header-file minimum to curl 7.55.0. Supported curl versions receive authorization headers through standard input. For older curl, Authorization: token ... headers are omitted from arguments. The system command passes environment variables through its environment hash. Tests cover header transport, version probing, and HTTP/1.1 retries.
Use header input for GitHub API requests Library/Homebrew/cmd/update.sh, Library/Homebrew/test/cmd/update_spec.rb	The update command configures the upstream or user token with setup_curl_header and supplies header input to both GitHub API requests. The test checks that token values are absent from curl arguments and present in request input.
Report token handling on older curl Library/Homebrew/diagnostic.rb, Library/Homebrew/test/diagnostic/tools_spec.rb, Library/Homebrew/test/cmd/doctor_spec.rb	The diagnostic reports token-related request limits when HOMEBREW_GITHUB_API_TOKEN is configured and curl is older than 7.55.0. Specs cover token and version conditions.

Merge Risk: Minimal · up to f0d70

The curl-version mismatch has been corrected. No actionable merge-blocking risk remains identified.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title "Read curl headers from stdin with curl 7.55+" matches the main change. The changeset moves GitHub API Authorization headers from curl arguments to standard input (--header @-) when curl i…
Description check		The description lists four changes: sharing the curl header version between Ruby and Bash, omitting GitHub API token headers with older curl, checking HOMEBREW_GITHUB_API_TOKEN in brew doctor with old…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title "Read curl headers from stdin with curl 7.55+" matches the main change. The changeset moves GitHub API Authorization headers from curl arguments to standard input (--header @-) when curl is 7.55.0 or newer, via curl_with_workarounds and the new setup_curl_header function. The title is specific and concise, and it names the version threshold.

Full details: Description check

Explanation

The description lists four changes: sharing the curl header version between Ruby and Bash, omitting GitHub API token headers with older curl, checking HOMEBREW_GITHUB_API_TOKEN in brew doctor with older curl, and passing command environment values directly to child processes. Each one matches a part of the changeset, such as global.rb and utils/curl.sh, diagnostic.rb, and system_command.rb. The description is related to the changeset.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6c7aea58-2e09-4348-bc85-647e9024cc40

Commits

Reviewing files that changed from the base of the PR and between 695e256 and f0d70f2.

Files selected for processing: 4

• Library/Homebrew/test/cmd/doctor_spec.rb
• Library/Homebrew/test/download_strategies/curl_spec.rb
• Library/Homebrew/test/utils/curl_spec.rb
• Library/Homebrew/utils/curl.rb

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.