Isn't this what the european Cyber Resilience Act (CRA) is about?
See https://orcwg.org/cra/ and the work of the Open Regulatory Compliance Working Group in general.
p2 (https://www.eclipse.org/equinox/p2/), the provisioning platform used in Eclipse, uses a SAT solver (specifically, http://sat4j.org/) to resolve complex plug-in dependencies (with version range constraints and other OSGi-specific niceties) when you install or update plug-ins in Eclipse.