And this is what NeXTStep/macOS has done for 30 years. Well you could also ship common Frameworks but they all have a version number so should not cause a probl

And this is what NeXTStep/macOS has done for 30 years. Well you could also ship common Frameworks but they all have a version number so should not cause a problem if different apps need different versions of a library. The AppStore or using a library like Sparkle will update when the developer finds an issue or security issue with a dependency. The advantage here is that the OS knows about bundles and so gives an organisation above the file. Anything in that bundle should not be used by anything else. I suspect this is what using containers gives Linux Alternative do as work did 30 years ago - explicitly link to a versioned number of a library. OK then you need to identify which apps use a particular library that needs to be updated for security reasons.