Mac OS X Release History: 10.0 Cheetah to 10.15 Catalina Security

Mac OS X shipped sixteen major versions between 10.0 Cheetah on 24 March 2001 and macOS 10.15 Catalina on 7 October 2019. All are now out of security support: the last was Security Update 2022-005 Catalina on 20 July 2022. Along the way Apple added FileVault, Gatekeeper, System Integrity Protection, APFS, notarization and a read only system volume.

If you still run any 10.x release, treat it as unpatched. This guide walks through each version with its release date, processor architecture and final security update, explains which protection arrived when and how update delivery changed, and ends with a step by step check you can run on an old Mac today. It is the prequel to our macOS release history from Big Sur onward, which picks up where Catalina leaves off. Dates come from Apple's own press releases and Apple's security update archive pages; feature descriptions come from the Apple Platform Security guide and Apple developer documentation, all listed at the end.

Key takeaways

• No 10.x release is supported. Apple's archive lists Security Update 2022-005 Catalina (20 July 2022) as the last OS security update for 10.15. Mojave's ended on 21 July 2021 and High Sierra's on 12 November 2020.
• Apple publishes no end of life policy. From Mavericks onward, each release received security updates for roughly three years. That is a pattern, not a promise.
• The big protections arrived in order. FileVault (10.3, 2003), Gatekeeper (10.8, 2012), System Integrity Protection (10.11, 2015), kernel extension approval and APFS (10.13, 2017), mandatory notarization (10.14.5 and 10.15) and a read only system volume (10.15, 2019).
• Architecture changes broke old software twice. Snow Leopard dropped PowerPC Macs, and Catalina stopped running 32 bit apps. Freezing an OS to keep an old app trades a compatibility problem for a security one.
• Background updates are not OS patches. XProtect signatures and notarization revocations update separately, but they do not fix kernel or framework bugs.

Where did Mac OS X come from?

Mac OS X was not a new version of the classic Mac OS. It was a new operating system built on technology Apple brought in with its acquisition of NeXT, with an open source core called Darwin.

Apple's press release for Darwin 1.0, dated 5 April 2000, calls Darwin "the advanced operating system core at the heart of Mac OS X" and says its kernel "is based on FreeBSD and Mach 3.0 technologies." It also says Darwin was processor independent, built for both PowerPC and Intel, which is part of why the Intel transition in 2005 and 2006 was possible at all. That Mach and BSD kernel, XNU, is still the kernel family under macOS today, and Apple's open source releases page still publishes per release source for Darwin components.

Apple's newsroom archive records the launch: Mac OS X was unveiled at Macworld Expo on 5 January 2000, a Public Beta followed on 13 September 2000, and on 9 January 2001 Apple announced it "will ship on March 24, 2001" at US$129. The headline technical features were "true memory protection, preemptive multi-tasking and symmetric multiprocessing," on "an incredibly stable, open source, UNIX based foundation called Darwin."

Those features were the security story. Classic Mac OS had no memory protection, so one bad application could corrupt another or freeze the machine. Mac OS X gave each process its own address space and a UNIX permission model with separate user accounts, the base every later protection in this article builds on. Old applications ran inside Classic, an environment Apple says was based on Mac OS 9.1.

Timeline: every version from 10.0 to 10.15

Apple's Find out which macOS your Mac is using article lists every release name, from "Mac OS X Cheetah 10" through "macOS Catalina 10.15." The release dates below come from Apple's own press releases, and the last security update for each version comes from Apple's security update archive pages linked from Apple security releases. Where Apple's archive lists a combined update for several versions, the date shown is the last update whose "available for" column names that version.

A few notes on reading this table:

• Branding changed twice. Apple's own list uses "Mac OS X" through Snow Leopard, "OS X" from Lion through El Capitan, and "macOS" from Sierra onward. The version numbers stayed in the 10.x series until Big Sur became macOS 11 in 2020.
• Price changed too. Jaguar through Leopard were US$129 boxed products; Lion was a US$29.99 Mac App Store download, Mountain Lion US$19.99, and every release from Mavericks onward was free.
• App updates outlived the OS. Safari 15.6.1 on 18 August 2022 still listed Catalina, but a Safari patch does not fix the kernel. The OS security update date is the one that matters.

Release by release: what changed for security

What did each version add or change that matters for security? Where Apple's documentation names the release that introduced a feature, that is stated; where it does not, the text says so.

10.0 Cheetah and 10.1 Puma (2001)

The first two releases established the security model rather than adding features to it: protected memory, multi user accounts and file permissions, so a normal user could not overwrite system files without an administrator password. Mac OS X 10.1 followed about six months later as "the first major upgrade," per Apple's 25 September 2001 press release, and like 10.0 it ran only on PowerPC Macs.

Apple's "August 2003 and earlier" security archive shows how early patching worked: many fixes were updates to bundled open source components such as Apache, OpenSSL, Sendmail and Samba, tracked by CVE candidate numbers with the old "CAN" prefix. From day one, patching a Mac meant patching an open source supply chain shipped inside the OS.

10.2 Jaguar (2002)

Jaguar went on sale at 10:20 p.m. on 23 August 2002, according to Apple. Its press release focuses on Mail with junk mail filtering, iChat and Rendezvous networking. By this point Apple was shipping regular, named Security Updates, and Jaguar stayed in that program for about two and a half years.

10.3 Panther (2003)

Panther is the first release with a headline security feature. Apple's 8 October 2003 press release lists FileVault, which "uses the latest security standards and 128-bit encryption technology to ensure that data in the home directory is kept secure and private at all times." This first FileVault encrypted the home folder only; system files and applications were not covered. Panther received updates for about four years, longer than any release from Mavericks onward.

10.4 Tiger (2005)

Tiger went on sale on 29 April 2005. Apple's press release lists "64-bit virtual memory, Access Control Lists" among changes to the UNIX foundation. Access Control Lists allow finer grained file permissions than the classic owner, group and other model.

Tiger also crossed architectures. On 6 June 2005 Apple announced Macs with Intel processors "by this time next year" and a full transition "by the end of 2007," previewing Tiger running on an Intel based Mac. On 10 January 2006 Apple shipped the first Intel based iMac, so Tiger exists in both PowerPC and Intel builds.

10.5 Leopard (2007)

Leopard went on sale on 26 October 2007, and its press release leads with Time Machine, "an effortless way to automatically back up everything on a Mac." Against ransomware or a dead disk, default restorable backups matter more than most features. Leopard is also the release that brought application code signing to the Mac, the mechanism that Gatekeeper, SIP, notarization and the hardened runtime all depend on. It was the last release to run on both PowerPC and Intel Macs.

10.6 Snow Leopard (2009)

Snow Leopard went on sale on 28 August 2009 and ended PowerPC support: Apple says it "is designed to run on any Mac computer with an Intel processor." The same press release says system applications including Finder, Mail and Safari were 64 bit for the first time, which "increases performance and improves security while remaining compatible with 32-bit applications."

10.7 Lion (2011)

Lion was the first release sold as a download. Apple's 20 July 2011 press release says it was "available today as a download from the Mac App Store for $29.99" and required "an Intel-based Mac with a Core 2 Duo, i3, i5, i7 or Xeon processor." The Mac App Store itself had opened on 6 January 2011, per Apple's press release that day.

Two security changes from the Lion era shaped everything after it:

• Full volume FileVault. Lion replaced home folder encryption with encryption of the whole startup volume, often called FileVault 2. The Apple Platform Security guide describes today's FileVault as using "the AES-XTS data encryption algorithm to protect full volumes on internal and removable storage devices."
• App Sandbox. Apple's developer documentation describes App Sandbox as restricting "access to system resources and user data in macOS apps to contain damage if an app becomes compromised," and states that "to distribute a macOS app through the Mac App Store, you must enable the App Sandbox capability." The Mac App Store therefore became a channel where every app ran inside a sandbox by rule.

10.8 Mountain Lion (2012)

Mountain Lion arrived on 25 July 2012 at US$19.99. Apple's press release lists "the revolutionary new Gatekeeper, which makes downloading software from the Internet safer" and Power Nap, which "automatically updates your apps and system while your Mac is asleep."

Gatekeeper changed the Mac's default trust model. The Platform Security guide describes it as "designed to help ensure that only trusted software runs on a user's Mac." Notarization came later; in 2012 Gatekeeper checked that an app came from the Mac App Store or carried a Developer ID signature. Our post on what Gatekeeper and notarization check for developers covers the developer side in depth.

Mountain Lion also moved system updates into the Mac App Store.

10.9 Mavericks (2013)

Mavericks was the first free release. Apple's 22 October 2013 press release says users could "upgrade to Mavericks for free directly from OS X Snow Leopard, Lion or Mountain Lion," and quotes Craig Federighi saying Apple wanted "every Mac user to experience the latest features, the most advanced technologies, and the strongest security." Free upgrades made it reasonable for Apple to expect users to move forward, and the support window for older releases settled into a shorter, predictable pattern. Mavericks also introduced iCloud Keychain for syncing saved passwords across trusted devices.

10.10 Yosemite (2014)

Yosemite, released on 16 October 2014, is a design and Continuity release with no headline security feature. It is a clean example of the support pattern: about two years and nine months of OS updates, then nothing.

10.11 El Capitan (2015)

El Capitan is the release that took root access away from the administrator account for system files. Apple announced on 29 September 2015 that it would be available "on Wednesday, September 30 as a free update."

The Apple Platform Security guide describes System Integrity Protection (SIP) as restricting "components to read-only in specific critical file system locations to help prevent malicious code from modifying them," and states that SIP "is a computer-specific setting that's on by default when a user upgrades to OS X 10.11 or later." Before SIP, any root process could modify system binaries; after it, even root could not unless someone turned SIP off from recovery, which Apple says to do "only temporarily."

10.12 Sierra (2016)

Sierra, released on 20 September 2016, introduced the "macOS" name and brought Siri and Apple Pay on the web to the Mac. Its support ended almost exactly three years after launch.

10.13 High Sierra (2017)

High Sierra, released on 25 September 2017, changed two foundations at once.

• APFS. Apple's press release describes the Apple File System as "a new, advanced storage architecture" that "delivers enhanced performance, security and reliability." The Platform Security guide notes that "since its introduction, APFS has provided file-system metadata integrity using noncryptographic checksums on the internal storage device," which later releases built on.
• User approved kernel extensions. The Platform Security guide states that "user consent is required to load kernel extensions installed with or after installing macOS 10.13," a process Apple calls User-Approved Kernel Extension Loading. Kernel extensions already on a Mac upgraded from 10.12 or earlier did not need the new approval.

High Sierra was also the period when Apple began warning about 32 bit apps, as covered below.

10.14 Mojave (2018)

Mojave arrived on 24 September 2018 with Dark Mode and a redesigned Mac App Store, and moved system updates back into a Software Update pane in System Preferences.

For security, Mojave is the notarization release. Apple's developer documentation states: "Beginning in macOS 10.14.5, software signed with a new Developer ID certificate and all new or updated kernel extensions must be notarized to run." Notarization requires the hardened runtime, which Apple describes as protecting "the runtime integrity of your software by preventing certain classes of exploits, like code injection, dynamically linked library (DLL) hijacking, and process memory space tampering." The Platform Security guide describes notarization as "a malware scanning service provided by Apple" that issues a ticket when no known malware is found.

10.15 Catalina (2019)

Catalina, released on 7 October 2019, was the last 10.x release and changed the most at once. Apple's press release says its security improvements "better protect macOS from tampering, help ensure apps are safe, and give users greater control over access to their data."

• Read only system volume. Per the press release, "macOS Catalina runs in a dedicated, read-only system volume, which means it is completely separate from all other data." The Platform Security guide confirms: "In macOS 10.15, Apple introduced the read-only system volume, a dedicated, isolated volume for system content."
• Notarization for everything new. Apple's developer documentation states: "Beginning in macOS 10.15, all software built after June 1, 2019, and distributed with Developer ID must be notarized." It also says that in 10.15 and later, apps can load quarantined plug-ins "only if the plug-in is notarized."
• Gatekeeper on all apps. The press release says Gatekeeper "now checks all apps for known security issues."
• Data protections. New rules "require all apps to get permission before accessing user documents."
• System extensions. The Platform Security guide says macOS 10.15 allows developers to extend macOS with system extensions "that run in user space rather than at the kernel level," which "increase the stability and security of macOS."
• No 32 bit apps. Covered in the architecture section below.

In Catalina and earlier, FileVault was what protected the system volume at rest. The Platform Security guide notes that "in macOS 10.15 or earlier, FileVault protects operating system software while at rest by encrypting user and system content." In macOS 11 the read only volume became a cryptographically sealed signed system volume, which is where our Big Sur onward history begins.

Which security features arrived when?

This table compresses the notes above, with the Apple source for each row.

One caveat: Apple's current pages describe full volume FileVault and the App Sandbox requirement without naming the first release for either. Lion is the release generally associated with both.

How did software update delivery change?

Update delivery moved three times in the 10.x era.

1. Software Update application (10.0 to 10.7). A dedicated Software Update tool delivered fixes, and major versions came on discs. Apple's archive shows early fixes with dated names such as "Security Update 2003-08-14," before the "Security Update YYYY-NNN" naming that ran until 2022.
2. Mac App Store Updates tab (10.8 to 10.13). Starting with Mountain Lion, OS updates appeared in the Mac App Store alongside app updates. Mountain Lion's Power Nap also allowed updates to download while the Mac slept.
3. Software Update in System Preferences (10.14 and 10.15). Mojave moved OS updates back into a dedicated Software Update pane, while the redesigned Mac App Store kept app updates.

Alongside these, Apple built background channels that update protections without a full OS update. The Platform Security guide describes XProtect as "built-in antivirus technology" for "the signature-based detection and removal of malware," with signatures Apple "updates automatically, independent from system updates." It adds that "by default, macOS checks for these updates daily" and that notarization updates "distributed using CloudKit sync are much more frequent." The same guide says XProtect "includes technology to remediate infections," an engine driven "based on updates automatically delivered from Apple (as part of automatic updates of system data files and security updates)." On older 10.x releases, that remediation component appeared in install history as a separate item usually labelled MRT; the step by step section shows how to check what your own Mac received.

The limit is easy to miss: signature and revocation updates block known malicious files, but they cannot fix a vulnerable kernel, framework or bundled library. Only an OS security update does that, and for every 10.x release those stopped by July 2022.

How did the PowerPC to Intel transition and the 32 bit removal affect old software?

PowerPC to Intel (2005 to 2009)

When Apple announced the move to Intel in June 2005, it also announced a Developer Transition Kit so developers could "prepare versions of their applications which will run on both PowerPC and Intel-based Macs." The packaging format for that was the universal binary, one application file containing code for both architectures. Apple's archived Universal Binary Programming Guidelines include an appendix on Rosetta, which "describes the translation process that allows PowerPC binaries to run on an Intel-based Macintosh computer."

Rosetta kept PowerPC only applications running on Intel Macs through Snow Leopard. Lion required an Intel Core 2 Duo or newer and did not include Rosetta, so those applications stopped on any Mac that moved to 10.7, and teams that depended on them kept Snow Leopard machines running long after its last update in September 2013.

32 bit to 64 bit only (2017 to 2019)

The second break was gentler but wider. Apple says it "began transitioning to 64-bit hardware and software technology well over a decade ago," told developers in 2018 that Mojave would be the last version to run 32 bit apps, and that "starting with macOS Catalina 10.15, 32-bit apps are no longer compatible with macOS." When installing Catalina, Apple says, "you may see a list of recently used apps that are 32-bit" before deciding whether to continue.

The lesson from both breaks is the same: keeping an old binary alive pins the whole machine to the last OS that can run it. If a 32 bit app is why a Mac is still on Mojave, that Mac has had no OS security update since July 2021.

How long did Apple support each version?

Apple does not publish an end of life policy for macOS. Its security releases page lists what it has shipped, and its Software Update guidance says that "to maintain your computer's security, stability, and compatibility, Apple recommends using the latest macOS that is compatible with your Mac." Apple also states on its security releases page that "for the protection of our customers, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are generally available." The combination means you cannot know in advance when the last update for a release will ship; you find out afterwards, when no new update appears.

The archive does show a pattern. Measuring from release date to the last OS security update that lists each version:

Two worked examples show how to read it.

Example 1: a Mac on El Capitan. El Capitan shipped on 30 September 2015. The last update that names it is Security Update 2018-004 El Capitan on 9 July 2018. From 30 September 2015 to 9 July 2018 is 1,013 days, about 2.8 years. Anything Apple fixed in later releases after July 2018 was never fixed on El Capitan. As of October 2026, such a Mac has gone more than eight years without an OS security update.

Example 2: a Mac on Catalina. Catalina shipped on 7 October 2019 and received its last OS update on 20 July 2022, 1,017 days later, again about 2.8 years. Across Mavericks to Catalina, the spans cluster between 2 years 9 months and 3 years 2 months, which in practice meant a release kept receiving fixes while it was one of the three newest. Apple has never stated that as a rule, and the paid releases before Lion were supported longer.

Even inside the window, older releases did not always get every fix. Apple's archive shows many updates where the newest version got a point release and older versions got a separate Security Update, with each fix's security content listing the versions it applies to. To know whether a specific vulnerability is fixed on a specific Mac, compare that security content with the Mac's version and build.

Comparison table: what each version enforces

This table compares the four protections that most often come up when someone asks whether an old Mac is "secure enough": encryption at rest, code signing enforcement, sandbox requirements and system volume protection. It reflects the default state for each release, based on the Apple sources cited above.

Almost all modern default protections arrived in the last five 10.x releases. A Mac on Yosemite or earlier has none of SIP, APFS, kext approval, notarization or the read only system volume, and no patches since 2017.

Step by step: check an old Mac and plan what to do with it

These steps are read only and nothing here erases data. Run the commands in Terminal; if a command is missing, that itself tells you the Mac is on an older release.

Step 1: identify the version and build

Apple's documented route is Apple menu, then About This Mac, which "always includes the name and version number of the macOS that your Mac is currently using." Clicking the version number shows the build. In Terminal:

# Product name, version and build number
sw_vers

# Fuller system summary, including kernel version and boot volume
system_profiler SPSoftwareDataType

# Kernel (Darwin) release, useful when sw_vers output is unexpected
uname -a

Write down the version and the build. Each Security Update changes the build string, so the build tells you which update is installed.

Step 2: check the processor and what the Mac can run

# Intel or PowerPC, model identifier and memory
system_profiler SPHardwareDataType | egrep "Model Identifier|Processor Name|Chip|Memory"

# Architecture of the running kernel
uname -m

Compare the model identifier with Apple's compatibility pages for later releases, linked from the which macOS is your Mac using article. If the Mac can run a supported release, upgrading is almost always the right answer. Our guide to installing macOS on an Intel Mac covers the installer and recovery steps.

Step 3: check whether updates still arrive

# Ask Apple's update service what is available for this Mac
softwareupdate --list

# Installed update history (available on recent 10.x releases)
softwareupdate --history

# Full install history, including background data updates such as XProtect
system_profiler SPInstallHistoryDataType | egrep -A3 "XProtect|MRT|Security Update|Gatekeeper"

Compare the result with the timeline table. On any 10.x release, OS security updates have stopped whatever softwareupdate says, and if the newest Security Update in the history is older than the final one in the table, the Mac is missing even the last fixes Apple shipped.

Step 4: check which protections are actually on

# System Integrity Protection (10.11 and later)
csrutil status

# Gatekeeper assessment status
spctl --status

# FileVault status (Mountain Lion and later)
fdesetup status

# File system of the startup volume: APFS on 10.13 and later for SSDs
diskutil info / | egrep "File System Personality|Read-Only Volume"

# On Catalina, the system volume should be mounted read only
mount | egrep " on / "

If csrutil status reports disabled on a machine that is not a deliberate test rig, that is a finding on its own. Apple's developer documentation says SIP should be disabled "only temporarily" and that leaving it off "leaves your computer vulnerable to malicious code."

Step 5: find the apps that are holding the Mac back

# List applications with their architecture details (can take a minute)
system_profiler SPApplicationsDataType > ~/apps.txt
egrep -B6 "64-Bit \(Intel\): No" ~/apps.txt | egrep "^    [A-Za-z]"

# Check a single application's binary architectures
file "/Applications/Example.app/Contents/MacOS/Example"
lipo -archs "/Applications/Example.app/Contents/MacOS/Example"

# Check the code signature and Gatekeeper assessment of an app
codesign -dv --verbose=4 "/Applications/Example.app"
spctl -a -vv "/Applications/Example.app"

A binary that reports only i386 is 32 bit and will not run on Catalina or later. A binary that reports ppc only will not run on Lion or later. Those are the apps to replace, rewrite, or move into a supported environment.

Step 6: decide on upgrade, isolation or retirement

Use this decision table once you have the facts from steps 1 to 5.

For isolation, at minimum turn on the built in application firewall and stealth mode. Our guide on turning on the host firewall on macOS and Windows covers the settings in detail.

# Check and enable the application firewall
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on

A firewall only limits inbound connections, so isolation also means no browsing and no email on that Mac. When it is retired, follow our deep clean and secure delete guide for macOS, which includes the device path checks to run before any erase command.

Common mistakes

• Assuming an old Mac still gets patches because Software Update runs. softwareupdate can report "No new software available" on a Mac that has not received an OS fix in years. That message means there is nothing new for that release, not that the release is safe.
• Reading XProtect updates as security support. Install history on an old Mac may show recent XProtect or Gatekeeper data updates. Those block known malicious files; they do not patch the kernel, Safari's engine or bundled libraries.
• Disabling SIP permanently for one tool. A driver or utility that once needed SIP off is a reason to replace the tool, not to run the whole fleet without SIP. Apple's own advice is to re enable it "as soon as possible."
• Keeping 32 bit era apps by freezing the OS. The app keeps working; the OS stops getting fixes. Mojave's last OS update was July 2021, so a Mac frozen there for a 32 bit app has gone over five years without one.
• Keeping old build machines on old OS versions. Build Macs are often left alone because "they work." They run compilers, package managers and signing keys, which makes them more sensitive, not less.
• Forgetting the bundled open source. Every 10.x release shipped open source components such as OpenSSL, Apache, Samba and Sendmail in its early years. When the OS stops getting updates, those components freeze at whatever version shipped last.

FAQ

What was the first version of Mac OS X?

Mac OS X 10.0, code named Cheetah, went on sale on 24 March 2001 at US$129, according to Apple's press releases. It ran only on PowerPC Macs and was built on Darwin, Apple's open source core based on Mach and FreeBSD.

When did Catalina stop getting security updates?

Apple's archive lists Security Update 2022-005 Catalina on 20 July 2022 as the last OS security update for 10.15. Apple shipped Safari 15.6.1 for Catalina on 18 August 2022, but that is a browser update, not an OS fix.

Is it safe to use Mojave or High Sierra in 2026?

Not for a connected, general purpose Mac. Mojave's last OS security update was July 2021, and High Sierra's was November 2020. Use them only on isolated machines with no browsing or email, and plan replacement.

Which version of Mac OS X introduced Gatekeeper?

OS X 10.8 Mountain Lion, released on 25 July 2012. Apple's press release lists "the revolutionary new Gatekeeper, which makes downloading software from the Internet safer."

When was System Integrity Protection introduced?

OS X 10.11 El Capitan, in September 2015. Apple's Platform Security guide states SIP "is on by default when a user upgrades to OS X 10.11 or later."

Which macOS version stopped running 32 bit apps?

macOS 10.15 Catalina. Apple states that "starting with macOS Catalina 10.15, 32-bit apps are no longer compatible with macOS," and that Mojave 10.14 was the last version to run them.

When did notarization become mandatory?

Apple's developer documentation says that beginning in macOS 10.14.5, software signed with a new Developer ID certificate and all new or updated kernel extensions must be notarized, and that beginning in macOS 10.15, all software built after 1 June 2019 and distributed with Developer ID must be notarized.

Does Apple publish an end of life date for macOS versions?

No. Apple lists the updates it has shipped and recommends running the latest compatible macOS. From Mavericks onward, each 10.x release received OS security updates for roughly three years, but Apple has never stated that as policy.

Where Safeguard fits, honestly

Safeguard does not patch macOS, manage Macs or scan firmware, and it cannot add security updates to a release Apple has stopped supporting. The fix for an unsupported Mac is an upgrade, isolation or replacement.

Where Safeguard helps is with the software your team builds and ships, including the software that runs on Macs or is built on them. Safeguard scans repositories, container images and SBOM files for open source dependencies, matches them against vulnerability data, and shows which projects contain a given component and version. If an old build Mac has been producing artifacts with an outdated library, scanning those repositories and images shows where that library is, and autonomous remediation can open pull requests to move it to a fixed version.

An old Mac is rarely just an old Mac: it is often a build machine, a signing host or a developer laptop that pulls dependencies every time a project is built, and those dependencies age as quietly as the OS underneath. The operating system patch has to come from Apple, but the open source components in the software you build and ship are yours to fix, which is what the next section covers.

Fix it without waiting for upstream

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation categories include dependencies, licenses, security posture and findings, and each one is set separately. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds.

3. Gold Registry: start from components that are already fixed

Gold Registry provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs and a completed license check, with signed build provenance (signed with Safeguard's key and verifiable with cosign, SLSA Build Level 3 as the design target) and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. Ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

The first demo is a real Safeguard CLI session. It installs the CLI, opens the interactive terminal and asks it to fix a lodash CVE in a repository; the assistant reads the finding and advisory, asks before any command that changes something, edits package.json to lodash 4.17.21, runs npm install and npm test with your approval and pushes nothing. The same flow applies to a macOS app or tool whose repository still pins a library from the era of the old build Mac that produced it.

Click through it at your own pace, or open it full screen.

The second demo sets up the Safeguard runner on your own machine, approves it with its device code and then scans from the terminal. If you are moving builds off an unsupported Mac, this is how a replacement machine can scan the same repositories locally before the first new build ships.

Click through it at your own pace, or open it full screen.

The third demo connects Claude to the Safeguard MCP server with OAuth and chooses which tools Claude can use. When you are retiring old Macs and want to know which of your projects still carry an outdated library version, the same conversation can ask Safeguard directly.

Click through it at your own pace, or open it full screen.

To try it on your own repositories, download Safeguard and follow the CLI documentation.

Quick check

Sources

• Apple, Apple security releases
• Apple, Apple security updates (2022 to 2023)
• Apple, Apple security updates (2020 to 2021)
• Apple, Apple security updates (2018 to 2019)
• Apple, Apple security updates (2016 to 2017)
• Apple, Apple security updates (2015)
• Apple, Apple security updates (2014)
• Apple, Apple security updates (2013)
• Apple, Apple security updates (2011 to 2012)
• Apple, Apple security updates (15 Jan 2008 to 03 Dec 2009)
• Apple, Apple security updates (25 Jan 2005 to 21 Dec 2007)
• Apple, Apple security updates (03 Oct 2003 to 11 Jan 2005)
• Apple, Apple security updates (August 2003 and earlier)
• Apple, Find out which macOS your Mac is using
• Apple, Update macOS on Mac
• Apple, 32-bit app compatibility with macOS
• Apple Platform Security, System Integrity Protection
• Apple Platform Security, Signed system volume security
• Apple Platform Security, Gatekeeper and runtime protection
• Apple Platform Security, Protecting against malware
• Apple Platform Security, Volume encryption with FileVault
• Apple Platform Security, Securely extending the kernel
• Apple Developer, Notarizing macOS software before distribution
• Apple Developer, Disabling and enabling System Integrity Protection
• Apple Developer, Hardened Runtime
• Apple Developer, App Sandbox
• Apple Developer archive, Universal Binary Programming Guidelines
• Apple Open Source, Releases
• Apple Newsroom, Apple Releases Darwin 1.0 Open Source (5 April 2000)
• Apple Newsroom, Apple's Mac OS X to Ship on March 24 (9 January 2001)
• Apple Newsroom, Mac OS X Hits Stores This Weekend (21 March 2001)
• Apple Newsroom, First Major Upgrade to Mac OS X Hits Stores This Weekend (25 September 2001)
• Apple Newsroom, Jaguar Unleashed at 10:20 p.m. Tonight (23 August 2002)
• Apple Newsroom, Apple Announces Mac OS X Panther (8 October 2003)
• Apple Newsroom, Apple to Ship Mac OS X Tiger on April 29 (12 April 2005)
• Apple Newsroom, Apple to Use Intel Microprocessors Beginning in 2006 (6 June 2005)
• Apple Newsroom, Apple Unveils New iMac with Intel Core Duo Processor (10 January 2006)
• Apple Newsroom, Apple to Ship Mac OS X Leopard on October 26 (16 October 2007)
• Apple Newsroom, Apple to Ship Mac OS X Snow Leopard on August 28 (24 August 2009)
• Apple Newsroom, Apple's Mac App Store Opens for Business (6 January 2011)
• Apple Newsroom, Mac OS X Lion Available Today From the Mac App Store (20 July 2011)
• Apple Newsroom, Mountain Lion Available Today From the Mac App Store (25 July 2012)
• Apple Newsroom, OS X Mavericks Available Today Free from the Mac App Store (22 October 2013)
• Apple Newsroom, OS X Yosemite Available Today as a Free Upgrade (16 October 2014)
• Apple Newsroom, OS X El Capitan Available as a Free Update Tomorrow (29 September 2015)
• Apple Newsroom, macOS Sierra now available as a free update (20 September 2016)
• Apple Newsroom, macOS High Sierra now available as a free update (25 September 2017)
• Apple Newsroom, macOS Mojave is available today (24 September 2018)
• Apple Newsroom, macOS Catalina is available today (7 October 2019)

Last reviewed: 25 October 2026.