Does the file /var/run/reboot-required ONLY occur from a kernel update, or can a developer of a software package decide herself if she wants it to be created, if desired?
The following link explain how it is created (duplicate): What creates the file /var/run/reboot-required
The Debian Policy doesn't provide any guidance on when a package should use reboot-required, only that that's the mechanism to be used:
9.12. Signaling that a reboot is required
Programs can signal that a reboot is required by
touching/run/reboot-required. It is conventional to add the name of the package(s) requiring the reboot to/run/reboot-required.pkgs. Programs should not add a package name to/run/reboot-required.pkgsif it is already present there.The
/run/reboot-requiredmechanism is used when a reboot is needed to fully apply the changes introduced by package installation or upgrade. Typically it is thepostinstmaintainer script that touches/run/reboot-required, at the end of a successful configuration of the package.There are no guarantees provided by the
/run/reboot-requiredconvention as to when or whether the requested reboot will occur.
So, I'd say any package maintainer can use it if they feel a reboot is required after the package is updated. Common examples include core libraries like glibc, which are used by so many things that rebooting is pretty much the only effective way to get everything to use the updated library.
One user checked the postinsts of a few packages and came up with varied list: https://askubuntu.com/a/731993/158442. Other examples can be found in the bug report asking for documentation on this mechanism to be included in the Debian Policy (#919507).