One of Mojave’s more subtle changes is its reversion to a Software Update pane in System Preferences. Behind that, much more is different.

The Software Update pane checks with Apple’s update servers whether there is an update available for Mojave itself, which presumably should include any Security Updates which Apple might release for it. These shouldn’t any longer be offered as updates in the App Store. So when you hear that 10.14.1 has been released, as it should be any day now, use the Software Update pane to download and install that update if it doesn’t already inform you that there’s a system update waiting.

The pane also offers options for which updates are automatically downloaded and installed. You can just let macOS manage that by ticking the Automatically keep my Mac up to date box, or configure it in detail using the Advanced… button.

I show here my suggested minimum configuration for automatic access to updates: ensure that the Check for updates and Install system data files and security updates boxes are ticked. If you want to make this more automatic, tick the Download new updates when available box, and that enables the other two Install options.

The option to Install system data files and security updates is important, as it lets Apple push security updates to your Mac automatically, rather than your having to install them yourself. If you prefer, you can take control of this using LockRattler’s controls, or at the command line if you really want.

The security and related data files which are covered by this include:

• Core Suggestions Configuration Data, CoreLSKD Configuration Data, and IncompatibleAppList,
• EFI Allow List,
• Gatekeeper Configuration Data*,
• Gatekeeper Disk Image Configuration Data*,
• Incompatible Kernel Extension Configuration Data*,
• MRT Configuration Data*,
• TCC Compatibility Bundle*,
• XProtectPlistConfigData*.

These are detailed in this article about silent security updates. Those marked with an asterisk* are checked by LockRattler.

EFI firmware updates are performed as part of macOS updates; full details about checking your Mac’s version and a listing of version numbers are given here.

When you have Install system data files and security updates enabled, there’s another even longer list of updates which your Mac will receive. Some of these are downloaded when they’re available; others are only updated when you use features which trigger the check for updates. Apple doesn’t provide any more detail, and in many cases their updates won’t be listed in SystHist or System Information, as they aren’t installed using the Installer.

These include:

• fonts, voice dictation services, dictionaries, language models, input methods, etc.
• improvements to Contacts and Calendar such as enhanced suggestions;
• Bluetooth discovery and use;
• network routing;
• various iCloud features, particularly for iCloud keychain;
• Safari configuration include new top-level domains, and website suggestions;
• SSL security certificates;
• support for additional RAW image formats;
• firmware updates for input devices and power adaptors;
• Help information.

Other parts of macOS which are installed and updated on demand include:

• printer, scanner, and fax drivers;
• language support, according to those which you have included in the Language & Region pane, but that apparently doesn’t include language models
• voices for the Speech feature in Accessibility.

Some of those are recorded in SystHist and System Information when they are updated.

Several Apple apps use separately-downloaded data files which are managed by that app. Those include Xcode, audio and video tools. Those apps, of course, are updated through the new App Store app. Unfortunately that has a nasty habit at present of removing most of the records it used to keep of software updates which you have already installed.

One problem posed by this extensive but ragged patchwork of update methods is that there is no central log or registry in which all installed updates are recorded. Most of the more significant are listed in System Information’s Installations, and in SystHist. But there are also plenty now which slip those nets altogether, and just happen in complete silence. The first that you might know is when an app or service starts behaving differently.