> And conversely, when a dependency introduces a critical vulnerability, the AppImage or static build is unaffected What's more common in practice ? Widely us

> And conversely, when a dependency introduces a critical vulnerability, the AppImage or static build is unaffected What's more common in practice ? Widely used libraries introducing critical vulnerabilities in 2023. Or old vulnerabilities being discovered/exploited, and patched? > unless you as the upstream app developer decide not to build against the latest security updates of your dependencies; but if that's the case, that's a completely separate issue from dynamic vs. static linkage. That's precisely the problem isn't it? What if "You the upstream app developer" is on a long vacation, or abandoned the project? Multiply this by N where N is the number of different app developers. Compare with "you as the OS admin". If you're using your system, you update that vulnerable dynamic library, and you're done. If users of other machines are on vacation or abandoned their machine, that's not your problem. Your system is secure. So I feel parent's point had everything to do with dynamic vs. static linkage.