It's per-package semantic versioning, not one big version for .NET Core. So you could have an app which has dependencies all over the place - old versions of some packages, new versions of others. Say you have application A, uses System.Foo version 3.4; then you have application B which uses System.Foo version 3.9. They're both old apps, the current version of System.Foo is 3.12. Now we find a security hole in System.Foo going back to version 2.3. MS is going to patch and release updated versions of every one of them, in case some application is still using 2.3?