[p-linnane]

Formulae loaded from the API split a dependency with more than one role, such as depends_on "foo" => [:build, :test], into separate :build and :test dependencies, while loading the formula's Ruby source keeps one Dependency with both tags. FormulaStructGenerator.process_dependencies now unions each name's role tags in a fixed order (:build, :test, :recommended, :optional, then :no_linkage) so API-loaded formulae get the same dependencies as source-loaded ones; separate :build and :test declarations of one name also load as one combined dependency. Runtime entries stay separate, so a formula that depends on gettext and also declares it :build keeps it in both dependencies and build_dependencies from Formula#to_hash. The round-trip examples now cover a runtime dependency with combined tags, compare the Formula#to_hash dependency lists and stub the API metadata Formula#to_hash reads so they run offline. Brew versions before 7.0.10 (#24262) reject array-valued tags in the internal API when HOMEBREW_SORBET_RUNTIME is set.

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include brew benchmark results.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug?
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• I did not use AI/LLM to create this PR, or I disclosed the tool/model below and reviewed its output; I did not attribute commits to AI and will answer maintainer questions and review comments myself without AI/LLM.

Codex (GPT-6 Astra) wrote the change and tests, compared source and API-loaded dependencies across homebrew/core for all 16 OS/arch tags, checked the new examples fail before the change on host and --generic and ran brew lgtm --online. Claude Code (Opus 5.5) reviewed it, found that an earlier version dropped runtime dependencies from the Formula#to_hash role lists, reran the comparison on the final version for the formulae whose output could change, checked the new examples fail on the previous code offline on host and --generic, rebased onto current main and ran brew lgtm --online on this commit.

---

Summary by CodeRabbit

• Bug Fixes
  • Improved dependency metadata handling to remove duplicate entries and preserve all applicable dependency types.
  • Dependencies can now retain multiple tags, including build, test, recommended, optional, runtime and no-linkage classifications.
  • Dependency metadata round-trips now more reliably preserve these classifications and their ordering.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2b8094af-fa74-4ef7-b152-8a22ef72b22a

📥 Commits

Reviewing files that changed from the base of the PR and between 41f40de and 1ef23e2.

📒 Files selected for processing: 3

• Library/Homebrew/api/formula/formula_struct_generator.rb
• Library/Homebrew/test/api/formula/formula_struct_generator_spec.rb
• Library/Homebrew/test/formulary_spec.rb

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Walkthrough

Dependency generation now deduplicates dependencies and combines applicable tags. Tests cover tag ordering and preservation of dependency metadata through a formula round-trip.

Changes: Dependency metadata

Layer / File(s)	Summary
Merge dependency tags Library/Homebrew/api/formula/formula_struct_generator.rb, Library/Homebrew/test/api/formula/formula_struct_generator_spec.rb	process_dependencies deduplicates dependencies and combines applicable tags. Specifications cover tag combinations, no_linkage, and tag ordering.
Verify dependency metadata round-trip Library/Homebrew/test/formulary_spec.rb	The round-trip fixture covers runtime and multi-context dependencies. The test compares the restored formula’s dependency hash with the source formula’s hash.

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to 1ef23

Combined dependency tags are accepted and preserved by the current formula loader. No issue requiring resolution before merge was identified.

Security architecture risk: ⚪ Minimal · up to 1ef23

The change combines dependency roles without introducing dependency names or removing separate runtime requirements. Existing readers support combined tags, and no new privilege or trust-boundary bypass was identified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — An actor controlling dependency metadata can influence reconstructed dependency arguments, as before. Within the changed helper, outputs remain derived from supplied dependency entries and existing role categories; combining tags does not itself create dependency names or a new authority channel. This conclusion does not assess how remote metadata is authenticated.

Trust Boundaries and Controls

• observed — Reconstructed stable and HEAD dependencies still pass through the existing depends_on DSL and dependency collector. Role predicates use tag membership, so combined arrays preserve individually recognizable roles rather than introducing an alternate evaluator or loading path.

Pre-merge checks: 4

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: combining dependency role tags from API metadata.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[MikeMcQuaid]

Thanks!