Ideally all bundled dependencies should be hooked up to some sort of
automation that notices when there are upstream updates available,
comparable to upstream release monitoring. On Flathub this is done by
flathub-external-data-checker [1], but using it is optional and it's
not useful if it's not used. For Fedora Flatpaks, I don't think any
comparable mechanism exists, but it should be as simple as "update
whenever any component RPM is updated."
[1]
https://github.com/flathub/flatpak-external-data-checker