[p-linnane]

FormulaStruct dependency entries currently allow a single tag symbol, so an internal API entry such as { "foo" => [:test, :no_linkage] } fails T::Props validation on readers running with HOMEBREW_SORBET_RUNTIME (brew test, brew test-bot and brew tests). This widens the type to accept an array of tags, matching what uses_from_macos entries already carry, and adds a serialize/deserialize round-trip example. It is split out so released readers accept combined tags before the metadata writer starts emitting them.

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include brew benchmark results.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug?
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• I did not use AI/LLM to create this PR, or I disclosed the tool/model below and reviewed its output; I did not attribute commits to AI and will answer maintainer questions and review comments myself without AI/LLM.

Codex (GPT-6 Astra) wrote the type change and the round-trip example and ran brew lgtm --online; Claude Code (Mythos 5.1) reviewed it, reproduced the TypeError by feeding array-valued entries to a pre-change checkout with HOMEBREW_SORBET_RUNTIME=1 and ran brew lgtm --online on this commit.

---

Summary by CodeRabbit

• New Features
  • Dependencies can now be associated with multiple types, such as test and no-linkage.
• Bug Fixes
  • Combined dependency types are preserved when dependency data is serialized and restored.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8dc6fd6e-bacc-4397-9f90-1b431438c7aa

📥 Commits

Reviewing files that changed from the base of the PR and between f63eb29 and d323f24.

📒 Files selected for processing: 2

• Library/Homebrew/api/formula_struct.rb
• Library/Homebrew/test/api/formula_struct_spec.rb

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

📝 Walkthrough

DependsOnArgs now accepts a single dependency tag or an array of tags. A round-trip test checks that tagged stable dependencies are preserved during serialization and deserialization.

Changes: Formula dependency tags

Layer / File(s)	Summary
Dependency tags and round-trip validation Library/Homebrew/api/formula_struct.rb, Library/Homebrew/test/api/formula_struct_spec.rb	DependsOnArgs accepts a Symbol or an array of Symbols. The test checks that tagged stable_dependencies retain their values after serialization and deserialization.

Priority: ➖ Normal

Merge Risk: ⚪ Minimal · up to d323f

Combined dependency tags can now be represented and round-tripped; no actionable merge-blocking risk remains.

Security architecture risk: ⚪ Minimal · up to d323f

The change accepts tag arrays already understood by dependency handling while retaining single-tag compatibility. It does not change metadata writers or introduce a new privileged operation.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The changed acceptance surface reaches stable and head dependency entries used by formula loading. The inspected path preserves the existing dependency-name source and dependency collector ownership; accepting multiple existing tags does not establish a new source of dependency authority.

Trust Boundaries and Controls

• observed — The existing collector rejects manually supplied :implicit tags after normalizing tags to an array. This control remains applicable to combined tags and is unchanged between the supplied base and head.

Pre-merge checks: 4

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: accepting dependency tag arrays in API metadata.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[MikeMcQuaid]

Thanks!