Taking your Mac's updates back into your own hands

Howard Oakley has written the reference we wish Apple shipped: a plain, complete account of driving macOS updates from the command line with softwareupdate. It exists because the built-in documentation doesn’t. The man page claims a last revision in 2012 and still talks about standalone EFI firmware; the usage text omits the one flag — --include-config-data — that makes security-data updates like XProtect show up at all. Run softwareupdate -l the way the docs describe and you’ll simply never see the XProtect payload sitting there waiting to install.

What we like here is the posture. This isn’t a nag screen deciding on your behalf when your machine restarts; it’s the set of commands that lets you list exactly what’s available, fetch a specific labelled update, or pull a full installer for a version Software Update won’t offer you. That’s the machine behaving like something you own. The wrinkle worth knowing: from Sequoia on, the live copy of XProtect moved to /var/protected/xprotect/ and is no longer maintained by softwareupdate at all — you now keep it current with a separate xprotect check / xprotect update pair, and Oakley notes even that is going quiet in the Golden Gate betas.

We come back to this a lot as we build: good software tells you what it’s doing and gives you the controls to do it yourself. A tool you can inspect and drive by hand is a tool that respects you.