They backport security updates to the existing software versions on stable, which causes the packages to be secure without introducing new behavior. Feature updates only occur with a new stable release I believe.
it is rare but some feature updates do get to stable, most software that is important to up to date with security fixes have the concept of an LTS or somethinf akin to it, firefox has ESR for example, basically it is a version where the devs will continously backport security fixes to it but not the features
How does Debian do level and security updates? Are they generally a good pace but userland starts consistent?
They backport security updates to the existing software versions on stable, which causes the packages to be secure without introducing new behavior. Feature updates only occur with a new stable release I believe.
it is rare but some feature updates do get to stable, most software that is important to up to date with security fixes have the concept of an LTS or somethinf akin to it, firefox has ESR for example, basically it is a version where the devs will continously backport security fixes to it but not the features
Exceptions exist, for example rsync recently got a new upstream version to fix 33 CVEs: rsync.NEWS
I also saw that recently. I’d like to highlight this bit from the news:
So it looks like the package is still mostly kept stable despite the exception made.