[HaraldNordgren]

On my MacBook Air (macOS 12.7.6, so few bottles), brew upgrade --dry-run ruby wanted to rebuild rust and llvm from source because of a new ca-certificates release:

==> Would upgrade 7 dependencies:
ca-certificates  2026-10-20 -> 2026-11-05
cmake            4.4.4      -> 4.4.5
lz4              1.10.0     -> 1.11.0
sqlite           3.54.0     -> 3.54.1
expat            2.9.0      -> 2.10.0
llvm             22.1.8     -> 23.1.5
rust             1.96.1     -> 1.99.1
==> Would upgrade 1 requested outdated package
ruby 4.0.7_1 -> 4.0.9

rust 1.96.1 has a matching compatibility_version, so #24273 should leave it at its installed version. With ca-certificates current it does, and none of those dependencies are upgraded. Two separate bugs cause this, so there's one commit for each.

A harmless upgrade forces an outdated dependency to upgrade. brew upgrades an outdated dependency if anything in its receipt has an incompatible upgrade, and rust's receipt lists ca-certificates. Poured kegs never record a compatibility_version, so every ca-certificates release counts as incompatible. An upgrade no longer counts when the formula has an :all bottle, its keg has no include directory and its receipt records no compatibility_version. An :all bottle has no compiled code to link against, and none of the 1,119 in homebrew/core has a compatibility_version above 1. The include check rules out header-only libraries like eigen, whose code is compiled into their dependents. ca-certificates itself still upgrades, so certificates stay current.

Compatible dependencies behind an upgraded one are upgraded anyway. That's why cmake, sqlite and expat are in the plan. When rust has to upgrade, brew plans again, and later passes could only leave a dependency alone if an earlier pass had. An outdated dependency left alone hides everything behind it, so these were first reached on a later pass. This now tracks the dependencies that must be upgraded instead. The number of passes is still bounded, now by every dependency reachable with the selected options, because more can be left alone on later passes.

Plans for ruby on main and this branch:

Outdated	Main	This branch
rust and ca-certificates	ca-certificates, cmake, lz4, sqlite, expat, llvm, rust	ca-certificates
rust and openssl@4, with a compatibility_version bump on openssl@4	openssl@4, cmake, lz4, sqlite, expat, llvm, rust	openssl@4, lz4, llvm, rust

Across my 107 outdated formulae, the only other plan that changes is ripgrep, which stops upgrading ruby when ca-certificates is outdated.

This is the part of #24496 that doesn't need any new DSL. brew upgrade rust itself still upgrades llvm, because rust links it and their compatibility_versions differ. --build-bottle and pouring bottles are unchanged.

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include brew benchmark results.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug?
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• I did not use AI/LLM to create this PR, or I disclosed the tool/model below and reviewed its output; I did not attribute commits to AI and will answer maintainer questions and review comments myself without AI/LLM.

Claude Code (Claude Opus 5.5) traced why ca-certificates pulled in rust and llvm, wrote the changes and their specs and verified them. Each new spec fails when the code it covers is broken. It compared plans between main and this branch against my real kegs and ran brew lgtm, which passes.

---

[coderabbitai]

No actionable comments were generated in the recent review.

Summary

Summary by CodeRabbit

• Bug Fixes
  • Improved dependency upgrades when updating Ruby, avoiding unnecessary upgrades of bottled dependencies that remain compatible.
  • Dependencies are upgraded when recorded compatibility information, available bottles, or build requirements indicate they need updating.
  • Improved handling of nested and optional build dependencies, so they are upgraded when they rely on a dependency that is also being upgraded.

The formula installer now repeats dependency expansion when kept dependencies have recorded runtime dependencies that intersect incompatible upgrades. It excludes an :all bottle from that check when no installed headers or recorded compatibility version exist. Tests cover bottle, receipt, header, and optional build-dependency cases.

Changes: Dependency compatibility

Layer / File(s)	Summary
Iterative dependency expansion Library/Homebrew/formula_installer.rb, Library/Homebrew/test/formula_installer_spec.rb	The installer tracks dependencies that cannot be kept across expansion passes. It checks reachable dependencies for compatibility-version mismatches, with an exception for an :all bottle that has no installed headers or recorded compatibility version. Tests cover upgrade outcomes for receipts, headers, bottles, nested runtime dependencies, and selected optional build dependencies.

Merge Risk: Low · up to 252a9

The change reduces unnecessary dependency upgrades when building from source. In rare cases with several installed versions, a stale receipt could still trigger an extra upgrade. This is low risk and a bounded follow-up.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title summarises the reduction in dependency upgrades for source builds.
Description check		The description explains both dependency upgrade changes and their expected effects.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 34ab50b0-e2b3-4651-8830-49b12856bdfd

Commits

Reviewing files that changed from the base of the PR and between fbd2e79 and 252a90c.

Files selected for processing: 2

• Library/Homebrew/formula_installer.rb
• Library/Homebrew/test/formula_installer_spec.rb

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 7 remain after this review.

[coderabbitai]

Actionable comments posted: 1

Review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 5d8d1fb8-64c9-4ede-8cc7-6f1e086c2d9f

Commits

Reviewing files that changed from the base of the PR and between 970da0c and fbd2e79.

Files selected for processing: 2

• Library/Homebrew/formula_installer.rb
• Library/Homebrew/test/formula_installer_spec.rb

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

[MikeMcQuaid]

Makes sense, thanks!