My point is actually that it's not possible to do that meaningfully past a certain (rather modest) level of complexity and reuse. How does a library like openssl meaningfully and thoroughly notify all it's downstream users in Debian, Node, Gentoo, etc. what changes to pay attention to?